Hacker News Reader

Comment by biot | Hacker News Reader

This is why I don't use Android. On iOS, you install the app and at some point you see a prompt "This app would like access to your camera. Allow?" and you can click "Don't Allow" and keep using everything else. Versus Android, which at install time asks "This app wants access to these 37 different things. Allow everything and install, or would you prefer to kindly fuck off?"

View on HN

Android is implementing this in 6.0. No reason to make this a fanboy war.

In any case, the app would probably say "Oh, I can't have camera? Well you can't have app."

And it's not like you weren't warned on the page with "37 permissions".

Actually, part of the problem is that they don't have to ask for 37 permissions... they are grouped together in such large groups that you don't know what permissions they are really after. Cyanogenmod has Privacy Guard that I think can help with this privacy nightmare.

The bigger issue is that they provide no context.

"Facebook wants to send Sms" seems really odd until there's some feature like inviting someone that would obviously require sending Sms. Contextually asking for this permission then is much more reasonable, especially since the app can be used otherwise. Clearly certain permissions like camera may be the entire reason for the app, but the more sinister stuff like location tracking is often not the primary purpose.

On the AppStore, apps are required to gracefully degrade where permissions are not granted, and you can be rejected for not doing that. That seems unlikely to be enforced on the Play Store.

Can anyone confirm if that is the case with uber? On Android, if location isn't enabled, you can't use uber.

And before anyone claims location services are necessary to find the user and stop ddos attacks - I've ordered uber before for people in other parts of town, and I'm a signed in user with a track record of making payments.

Yes, you can set an arbitrary point as the pickup address on Uber for iOS without Location Services.

As much as I respect not wanting to share location, the average user tends to be quite un-tech-savvy. Say that on average users without location services enabled makes 5x more wrong requests - that can result in hundreds of thousands of lost driver hours.

Yes, and if that were a problem, we would not have Uber for iOS. There are whole classes of apps that cannot be made for iOS (it used to be the case of custom keyboards & ad blockers, for example). Because security in general, and privacy in particular, are non-negotiable on iOS.

This is not the case with iOS snapchat. Disabling the camera prevents app use.

I haven't used Android, but culturally it seems like iOS developers try to deliver as much as they can with the permissions you give them. A voice recording app would probably just refuse to function without microphone access, but a video app will typically simply record a silent video if you give camera access but deny microphone access.

I don't know if this is enforced by Apple's review process or whether it's an emergent custom.

Snapchat records silent videos if you disable microphone access, but disallows access to the entire app if you disable camera function.

You cannot even read other people's snaps without enabling camera. I deleted the app because of this function.

It isn't a fanboy war. The Android permission system is terrible, and users cannot get a sense of what apps are able to do. I've used Android since Galaxy I. I've never used an iPhone.

As the parent comment says, this is now fixed. Android has moved to an iOS style permissions system in 6.0

It isn't fixed on my phone, and we've already suffered through years of it.

root your phone and install a permission manager. or use cyanogenmod and enable the built-in.

I would like to do that, but I don't want to risk turning my phone into a brick just to get basic root permissions.

Well, fortune favours the bold. You can take that risk or you can be cattle for all the apps that want you to actually watch the ads they support themselves with. Make your choice.

The quickest solution to your years of suffering would be getting an iPhone.

I'd prefer a Free software OS that gives me root access.

Given that the number of users for whom it's "fixed" rounds to 0 (and the proportion of apps targeting the v6 SDK probably also rounds to 0, so even if you are running Marshmallow it won't work for the vast majority of apps) I think that specifying that it's "fixed" is a tad overstated.

http://arstechnica.com/gadgets/2015/10/android-6-0-marshmall...

Fandoy war? This basic privacy/security feature has been in iOS since forever. It is as common sense as you can get. Not having it is actually outright hostile towards users. I've used both Android and iOS for some time and I can tell you without a shadow of doubt that iOS is far superior.

In the meantime... talk to me when Android gets this basic feature in 6.0.

"I've used both Android and iOS for some time and I can tell you without a shadow of doubt that iOS is far superior."

Nope, no fanboying here, move along folks.

> This basic privacy/security feature has been in iOS since forever.

IOs originally had no permission system at all.

> talk to me when Android gets this basic feature in 6.0.

Half a year ago.

Or October for non-developers. Was that half a year ago? Oh and it only works for apps targeting the latest APIs, which is how many apps?

>has been in iOS since forever

Granular permissions have only been in iOS since version 6.0, which came out 3 years ago. The first version of iOS was 8 years ago. For a feature that's "as common sense as it gets" we sure got along fine without it for half a decade.

I wouldn't say we were getting along fine without it. There were some pretty big privacy breaches[1], which helped move Apple forward. I think Google and Android are great, but on this topic they have held out for as long as possible, it seems[2].

[1] http://www.cnet.com/news/path-shares-photos-oh-and-uploads-y...

[2] http://www.theguardian.com/technology/2013/dec/20/android-ap...

its not really that simple, even on iOS. I'd like to allow facebook to access the camera so I can take a picture to send to someone directly from the app. But that means I've given it permission to access the camera period at that point. Not just permission to take a single picture. Similarly I'd like to give an app permissions to save pictures to the os level photo db. But the permission isn't 'save' it's 'access your photos'. Which means once I give it permission it can look at all the photos on the camera.

I'd personally prefer more fine grained permissions. Permission to take a picture (and read just those pictures the app took), permission to save pictures to the OS picture db. Permission to read pictures from the os picture DB the app didn't take.

I actually don't know if that would be any kind of solution. Another would be if the only way to access pictures was an OS level ui. That way the app couldn't access the pictures directly.

at the same time that would limit useful things apps can do. For example the fb messenger app showing half the display as a live feed from the camera.

Yes, that would be a possible evolution of permissions. If an app lets you choose a picture from your photo library, iOS swaps you to your camera roll where you select the image and then click "Share this image with app". You then get redirected back to the app and iOS sends the app only that image.

Currently, for things like camera, microphone, location, etc. you can always revoke that permission after granting it via Settings.

The solution here is to clearly tell those apps to fuck off.

Though, the latest version of android odes allow you to "allow" or "don't allow" features like that. Its the only reason that I finally installed the facebook app.

You might like this alternative: https://play.google.com/store/apps/details?id=com.danvelazco...

I've been using that app for years. Friends still chuckle when they see that app name on my phone screen.

This is exactly what I need. I've made peace with the fact that Google knows much about me because I use their services and they made the OS and major apps for my phone. I have Facebook purely to get the occasional message or invite from a friend, and I hate how exposed to them I feel for needing this minimal functionality.

I do indeed... Though, I am on the new android, so its mostly a moot issue for me now. I also was using the mobile website before, so this may not have provided much for my use case. Thanks for the link though!

Even such prompts are disingenuous. They amount to a salami attack against the user's privacy, because the overwhelming majority of users will authorize Yes on a per-app basis just to take a look, without really considering the potential consequences.

See also: server admins who accept SSH host keys without verification.

The people who mindlessly click 'Yes' are generally the ones who don't care about the privacy implications of enabling such things though. I know I care, and I have uninstalled several apps after they've started asking for ridiculous permissions to enable non-essential features that I don't care about.

Sure, but we need to be thinking beyond ourselves. You sound pretty pleased with your own approach to software hygiene, and good for you, but it's easy to be rigorous when you understand the implications. Educating end-users won't move that needle much. What I'd like to see is a mobile device stack I could recommend to my dad, with high privacy assurance that he can't inadvertently compromise.

That's not true anymore, as the permission system was overhauled in Android 6.0 Marshmallow.

Reply on news.ycombinator.com