6 ms·

The article mentions that the required permissions are "very common permissions", and then in the next paragraph says that 179 apps on the Google Play store req

• octo_t 12y ago
  I can see a popup message of 'we tune our app based on your current power levels' or similar being quite persuasive in this regard too.
• leereeves 12y ago
  The typical consumer would probably just give the app access to the GPS. The hard part is getting them to download it. Interesting research but not the most practical attack.
  • zipperhead 12y ago
    That's the problem with android. The 'typical user' has no control over individual app permission - it's literally all or none. If you install the app you give it access to the GPS, as long as it has specified that permission.
    • wongarsu 12y ago
      Rooted Cyanogenmod actually has privacy settings which enable you to restrict some permissions on a per-app basis. For example I don't allow Facebook Messenger access to GPS and Android asks me before Messenger gets camera access.
      • hackuser 12y ago
        > Rooted Cyanogenmod actually has privacy settings which enable you to restrict some permissions on a per-app basis Why only "some"; why not all?
    • dagar 12y ago
      I honestly don't understand why this is a problem. Isn't it enough that the app says it requires my location when I install it? If you don't like the required permissions no one is forcing you to install it.
      • Sidnicious 12y ago
        Popular apps can essentially request any permission and you'll still download it — are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions? On iOS, the average user has a chance to download that mainstream app and deny it access to their contacts.
        • robotresearcher 12y ago
          > are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions? That sounds like you meant it as a rhetorical question, but "yes" is a reasonable answer.
          • hahainternet 12y ago
            I've no idea why you have been downvoted. I also do not have apps on my phone which ask for permissions I do not like.
          • thesteamboat 12y ago
            It sounds to me like the question was supposed to read > are [most people] really going to forgo having Facebook [...] There will certainly always be people who do pay attention to permissions for privacy or security reasons, but they seem* vastly outnumbered by the people who don't. * Just an intuitive sense, I have not looked for data to back this up.
            • lighthazard 12y ago
              The point is valid, but it still doesn't address the 'general population' problem - how do you get the users to care about their security/privacy? Giving fine-grain control over permissions is a fantastic idea.. but then you realize that the 'general population' that you made this for will never touch those settings, so it's no different than telling users what permissions an application will take. Also, the development cost of 'does this feature exist?' for each permission is pretty high.
  • onion2k 12y ago
    Presumably this is an attack that would be targeted at an atypical user - someone security conscious enough to not give GPS permission to apps they install, and who would have switched off location services that would use wifi instead. In those circumstances you might assume that any tracking would be beyond the capabilities of anyone who didn't have direct access to the phone network. This proof of concept demonstrates that would be an incorrect assumption.
• romaniv 12y ago
  I am ver surprised there is still no mass outrage over Android permissions. 1. They are not properly named or explained. And no, this shouldn't be on some obscure website. This should be right there, in the menu that asks for them. 2. There is no way to filter apps in the play store by permissions. This isn't just a privacy thing. Apps that require the least permissions are often least bloated and the most skillfully written. It's obvious that both of these thing are deliberate, it's obvious that this is an issue, and no one cares.
  • Sidnicious 12y ago
    Also, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)
    • TazeTSchnitzel 12y ago
      This was briefly added in Android 4.something, but Google removed it.
      • digi_owl 12y ago
        Appops. Supposedly there as a test system for apps. I guess to see if they would crash in case of malformed data from sensors etc. Some OEMs, like Huawei, offer similar functionality on their products.
        • heywire 12y ago
          It is possible to "activate" this functionality on some phones as well. I have it enabled on my Samsung Galaxy S4, which is rooted, but otherwise is running the stock ROM (though not by choice).
      • on_and_off 12y ago
        It was a test tool and supposed to be hidden : you had to enter its Intent directly in order to launch it (if I remember well, they had also forgotten to hide it as a menu choice when creating a widget shortcut to the settings in one android subversion). Even if they repackaged it as a proper app (it really showed that AppOps was a test tool, the interface was pretty primitive), I don't see the point. Permission revocation is not that useful against an app like Facebook that will use its permissions to access your private data as soon as it is installed. What we need here is granular permission granting. Apps start with only inoffensive permission (bluetooth access ? internet ? I guess some reflection on what these base permissions should be would be needed) and only gain access to your private data (mail, contacts, calendar, ...) if they ask for it and you grant it to them. That way, apps can only collect your data if you let them.