3 ms·

Why is it even possible for this to happen? Did someone really think it was a bright idea to provide an API to access people's personal data, and if so, why doe

by zalzane 13y ago

Why is it even possible for this to happen? Did someone really think it was a bright idea to provide an API to access people's personal data, and if so, why doesn't the phone tell them that before letting them install the app? On top of all of that, why wouldn't the phone provide a setting to restrict all personal/identifying information from being accessed by the app?

akgerber 13y ago
That sort of API is necessary for, say, an alternate text messaging app.
meritt 13y ago
It most likely does warn users but most people just click 'Accept' on all those "ABC application wants access to X, Y and Z" warnings.
- Samuel_Michon 13y ago
  Right, this form of security is completely ineffective. It’s just like Vista’s Universal Access Control modals: after being shown the first few of the day, you would stop reading them. I suspect EULAs are written to exploit this phenomenon: no-one reads EULAs because they go on forever, so you can bury all kinds of outrageous conditions in there.
jamesaguilar 13y ago
All of the smartphones I have used ask you before allowing access to your contacts. But many apps want to use these for legitimate purposes -- for example, Vine uses them to find people you're already friends with.
- dotmanish 13y ago
  It's all about trusting what that company is saying "now". They can change later and spam your list or use it for some other purpose. You can shame them publicly if you find it out. But then, it's already too late by that time.
pkulak 13y ago
Address book access is a permission just like anything else (internet access, for example), so it can fly under the radar. Android has been trying to make things like "send text messages" stand out a tad more than "write to local storage", but they may need to go even further. This is my personal favorite app permission that you can request: http://developer.android.com/reference/android/Manifest.permission.html#BRICK http://developer.android.com/reference/android/Manifest.perm...
- ColinCochrane 13y ago
  Wow. I wonder what the use-case for that is?
  - ajanuary 13y ago
    An app that lets you brick your phone remotely if it gets stolen maybe? Depends on how it works.
  - 286c8cb04bda 13y ago
    Enterprise anti-theft tools.

by zalzane 13y ago

akgerber 13y ago

That sort of API is necessary for, say, an alternate text messaging app.

meritt 13y ago

It most likely does warn users but most people just click 'Accept' on all those "ABC application wants access to X, Y and Z" warnings.

Samuel_Michon 13y ago
Right, this form of security is completely ineffective. It’s just like Vista’s Universal Access Control modals: after being shown the first few of the day, you would stop reading them. I suspect EULAs are written to exploit this phenomenon: no-one reads EULAs because they go on forever, so you can bury all kinds of outrageous conditions in there.

jamesaguilar 13y ago

All of the smartphones I have used ask you before allowing access to your contacts. But many apps want to use these for legitimate purposes -- for example, Vine uses them to find people you're already friends with.

dotmanish 13y ago
It's all about trusting what that company is saying "now". They can change later and spam your list or use it for some other purpose. You can shame them publicly if you find it out. But then, it's already too late by that time.

pkulak 13y ago

Address book access is a permission just like anything else (internet access, for example), so it can fly under the radar. Android has been trying to make things like "send text messages" stand out a tad more than "write to local storage", but they may need to go even further. This is my personal favorite app permission that you can request: http://developer.android.com/reference/android/Manifest.permission.html#BRICK http://developer.android.com/reference/android/Manifest.perm...

ColinCochrane 13y ago
Wow. I wonder what the use-case for that is?
- ajanuary 13y ago
  An app that lets you brick your phone remotely if it gets stolen maybe? Depends on how it works.
- 286c8cb04bda 13y ago
  Enterprise anti-theft tools.