5 ms·

I am ver surprised there is still no mass outrage over Android permissions. 1. They are not properly named or explained. And no, this shouldn't be on some obsc

by romaniv 12y ago

I am ver surprised there is still no mass outrage over Android permissions. 1. They are not properly named or explained. And no, this shouldn't be on some obscure website. This should be right there, in the menu that asks for them. 2. There is no way to filter apps in the play store by permissions. This isn't just a privacy thing. Apps that require the least permissions are often least bloated and the most skillfully written. It's obvious that both of these thing are deliberate, it's obvious that this is an issue, and no one cares.

Sidnicious 12y ago
Also, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)
- TazeTSchnitzel 12y ago
  This was briefly added in Android 4.something, but Google removed it.
  - digi_owl 12y ago
    Appops. Supposedly there as a test system for apps. I guess to see if they would crash in case of malformed data from sensors etc. Some OEMs, like Huawei, offer similar functionality on their products.
    - heywire 12y ago
      It is possible to "activate" this functionality on some phones as well. I have it enabled on my Samsung Galaxy S4, which is rooted, but otherwise is running the stock ROM (though not by choice).
  - on_and_off 12y ago
    It was a test tool and supposed to be hidden : you had to enter its Intent directly in order to launch it (if I remember well, they had also forgotten to hide it as a menu choice when creating a widget shortcut to the settings in one android subversion). Even if they repackaged it as a proper app (it really showed that AppOps was a test tool, the interface was pretty primitive), I don't see the point. Permission revocation is not that useful against an app like Facebook that will use its permissions to access your private data as soon as it is installed. What we need here is granular permission granting. Apps start with only inoffensive permission (bluetooth access ? internet ? I guess some reflection on what these base permissions should be would be needed) and only gain access to your private data (mail, contacts, calendar, ...) if they ask for it and you grant it to them. That way, apps can only collect your data if you let them.
- digi_owl 12y ago
  The basic problem is likely that google is in the data gathering business. This to provide ever more targeted ads. Thus they can't have someone block all data going in or out of the device.
  - TheCapn 12y ago
    Possibly tiers of permissions then? I know apps I've written will not work without a network connection: they're useless without it so to put that as a "required" feature is necessary. However, I do like ease-of-use features like telling the person they don't have their wifi network enabled or something which requires a different permission but totally optional. Lots of apps want access to folders of pictures and accounts which I assume to be for "sharing" and "social" features I never use. I'd love to disable those manually but currently don't have an avenue to do so. Of course apps could still set everything to "required" but at least the option for consumer choice is there.
- freshhawk 12y ago
  If you have root you can install XPrivacy, which allows you to deny (or provide fake data) for any app/permission combination. You have to jump through some hoops to install it because obviously Google doesn't like to encourage this kind of control over your phone, but it's there and I can't imagine using an android phone without it.
shostack 12y ago
While I fully agree with your reasons for why there SHOULD be outrage, I think the reason for why there is still NOT mass outrage is pretty obvious. In short: Consumers don't know and don't care. If they get an app they just click through whatever screens are needed until they can install it. Odds are they don't know what the concept of "permissions" means, or why they should care. Nothing in their phone tells them they should care. It is only fairly recently that some mainstream publications have written about this overreaching and even then the reach is limited. Then you have Google itself that realized it would need to increasingly ask for new permissions in the future, so it basically just asked for EVERYTHING for their apps, so that future updates wouldn't flag anything. So in short, there absolutely should be mass outrage and more granular, user-controlled permissions on Android. Will that happen? Unlikely.
- gombotzd 12y ago
  i fully agree to both of you. as a former apple user and now really happy android user this topic is such an utterly mess. in a group of techs and lawyers we recently discussed the right of ones data. i agree that data protection should allow people and companies to agree on whatever they want, but it should also be possible to revoke rights at any stage and this is not showing in the system especially of googles android but also other systems it is a very bad sign that in our society people have higher awareness that somebody might send them a paper with some advertising (address) than that some applications will send all the data out of their contact list plus their movement profile pretty weird
- on_and_off 12y ago
  Consumers have been trained to click on any 'yes' box for decades. From 'do you really wish to exit?' to 'accept this licence', people have been trained to just click on the yes button. Furthermore, it does not seem trivial to me to add a granular permission system to Android. Beyond the permission system itself, retro-compatibility and implementation by third party apps seems really problematic to me (not impossible, just a lot of work). I just hope that it does not stay in 'low-priority vs high difficulty' hell forever.
drzaiusapelord 12y ago
>They are not properly named or explained. And no, this shouldn't be on some obscure website. Or worse, the developer might argue that he needs location via GPS for things like regional settings and time sentitive settings, but will also use them to sample your location to a T everytime you move to sell for advertisers. The permission system doesn't show me the difference. There was a report on those free flashlight apps on android. Turns out they were sampling your position thousands of times a day and selling it to advertisers. Not only is that horrific from a privacy perspective, but imagine how much that affects battery life. This is done completely behind the scenes. There's no iOS-like "Do you want this app to use your location." Its just does it - usually as a service in the background. I have no idea what google is thinking nowadays. Android is pretty much a hand out to the advertising industry. I think this N5 is my last android phone. iOS is the only thing that remotely seems to respect my privacy. Perhaps Windows Phone is good enough now too. >It's obvious that both of these thing are deliberate, it's obvious that this is an issue, and no one cares. The typical FOSS coterie always reminding us that Apple and MS are the devil has performed a disservice here. Android seems to be the most hazardous OS out there and its owner is very much wed to the advertising industry and has major disincentives to take these complaints seriously.
- freshhawk 12y ago
  > The typical FOSS coterie always reminding us that Apple and MS are the devil has performed a disservice here I agree, but I would also say that subculture has the least support for Google of any of them. I'm sure there are plenty of people out of touch enough to still rant about MS but the actual discussions are mostly about Google (Apple is an unstoppable opportunistic juggernaut, Google is an ideological enemy).
- PhantomGremlin 12y ago
  > I have no idea what google is thinking nowadays. Google's thinking hasn't changed. They've always wanted to vacuum up everything they could about you and your behavior. > I think this N5 is my last android phone. I don't trust Google either. But what about the 99% of smartphone consumers who just want a cheap phone and don't concern themselves about these things? Google doesn't care about what you, part of the 1% on this issue, think. To update something that Lily Tomlin did many decades ago: We don't care. We don't have to. We're Google.

by romaniv 12y ago

Sidnicious 12y ago

Also, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)

TazeTSchnitzel 12y ago
This was briefly added in Android 4.something, but Google removed it.
- digi_owl 12y ago
  Appops. Supposedly there as a test system for apps. I guess to see if they would crash in case of malformed data from sensors etc. Some OEMs, like Huawei, offer similar functionality on their products.
  - heywire 12y ago
    It is possible to "activate" this functionality on some phones as well. I have it enabled on my Samsung Galaxy S4, which is rooted, but otherwise is running the stock ROM (though not by choice).
- on_and_off 12y ago
  It was a test tool and supposed to be hidden : you had to enter its Intent directly in order to launch it (if I remember well, they had also forgotten to hide it as a menu choice when creating a widget shortcut to the settings in one android subversion). Even if they repackaged it as a proper app (it really showed that AppOps was a test tool, the interface was pretty primitive), I don't see the point. Permission revocation is not that useful against an app like Facebook that will use its permissions to access your private data as soon as it is installed. What we need here is granular permission granting. Apps start with only inoffensive permission (bluetooth access ? internet ? I guess some reflection on what these base permissions should be would be needed) and only gain access to your private data (mail, contacts, calendar, ...) if they ask for it and you grant it to them. That way, apps can only collect your data if you let them.
digi_owl 12y ago
The basic problem is likely that google is in the data gathering business. This to provide ever more targeted ads. Thus they can't have someone block all data going in or out of the device.
- TheCapn 12y ago
  Possibly tiers of permissions then? I know apps I've written will not work without a network connection: they're useless without it so to put that as a "required" feature is necessary. However, I do like ease-of-use features like telling the person they don't have their wifi network enabled or something which requires a different permission but totally optional. Lots of apps want access to folders of pictures and accounts which I assume to be for "sharing" and "social" features I never use. I'd love to disable those manually but currently don't have an avenue to do so. Of course apps could still set everything to "required" but at least the option for consumer choice is there.
freshhawk 12y ago
If you have root you can install XPrivacy, which allows you to deny (or provide fake data) for any app/permission combination. You have to jump through some hoops to install it because obviously Google doesn't like to encourage this kind of control over your phone, but it's there and I can't imagine using an android phone without it.

shostack 12y ago

While I fully agree with your reasons for why there SHOULD be outrage, I think the reason for why there is still NOT mass outrage is pretty obvious. In short: Consumers don't know and don't care. If they get an app they just click through whatever screens are needed until they can install it. Odds are they don't know what the concept of "permissions" means, or why they should care. Nothing in their phone tells them they should care. It is only fairly recently that some mainstream publications have written about this overreaching and even then the reach is limited. Then you have Google itself that realized it would need to increasingly ask for new permissions in the future, so it basically just asked for EVERYTHING for their apps, so that future updates wouldn't flag anything. So in short, there absolutely should be mass outrage and more granular, user-controlled permissions on Android. Will that happen? Unlikely.

gombotzd 12y ago
i fully agree to both of you. as a former apple user and now really happy android user this topic is such an utterly mess. in a group of techs and lawyers we recently discussed the right of ones data. i agree that data protection should allow people and companies to agree on whatever they want, but it should also be possible to revoke rights at any stage and this is not showing in the system especially of googles android but also other systems it is a very bad sign that in our society people have higher awareness that somebody might send them a paper with some advertising (address) than that some applications will send all the data out of their contact list plus their movement profile pretty weird
on_and_off 12y ago
Consumers have been trained to click on any 'yes' box for decades. From 'do you really wish to exit?' to 'accept this licence', people have been trained to just click on the yes button. Furthermore, it does not seem trivial to me to add a granular permission system to Android. Beyond the permission system itself, retro-compatibility and implementation by third party apps seems really problematic to me (not impossible, just a lot of work). I just hope that it does not stay in 'low-priority vs high difficulty' hell forever.

drzaiusapelord 12y ago

>They are not properly named or explained. And no, this shouldn't be on some obscure website. Or worse, the developer might argue that he needs location via GPS for things like regional settings and time sentitive settings, but will also use them to sample your location to a T everytime you move to sell for advertisers. The permission system doesn't show me the difference. There was a report on those free flashlight apps on android. Turns out they were sampling your position thousands of times a day and selling it to advertisers. Not only is that horrific from a privacy perspective, but imagine how much that affects battery life. This is done completely behind the scenes. There's no iOS-like "Do you want this app to use your location." Its just does it - usually as a service in the background. I have no idea what google is thinking nowadays. Android is pretty much a hand out to the advertising industry. I think this N5 is my last android phone. iOS is the only thing that remotely seems to respect my privacy. Perhaps Windows Phone is good enough now too. >It's obvious that both of these thing are deliberate, it's obvious that this is an issue, and no one cares. The typical FOSS coterie always reminding us that Apple and MS are the devil has performed a disservice here. Android seems to be the most hazardous OS out there and its owner is very much wed to the advertising industry and has major disincentives to take these complaints seriously.

freshhawk 12y ago
> The typical FOSS coterie always reminding us that Apple and MS are the devil has performed a disservice here I agree, but I would also say that subculture has the least support for Google of any of them. I'm sure there are plenty of people out of touch enough to still rant about MS but the actual discussions are mostly about Google (Apple is an unstoppable opportunistic juggernaut, Google is an ideological enemy).
PhantomGremlin 12y ago
> I have no idea what google is thinking nowadays. Google's thinking hasn't changed. They've always wanted to vacuum up everything they could about you and your behavior. > I think this N5 is my last android phone. I don't trust Google either. But what about the 99% of smartphone consumers who just want a cheap phone and don't concern themselves about these things? Google doesn't care about what you, part of the 1% on this issue, think. To update something that Lily Tomlin did many decades ago: We don't care. We don't have to. We're Google.