Hacker News Reader

Comment by tadfisher | Hacker News Reader

It wasn't always this way. The individual permissions used to be displayed to the user directly; newer releases of the Play Store have "streamlined" this permissions prompt so that users see general permissions "groups", and some permissions (such as INTERNET) are considered "not dangerous", requiring a click on the "See all permissions" button to view everything the app requests.

I imagine it's because Google recognized the general insanity of the system, and presenting fewer "scary" permissions improved conversion rates.

Then they threw the whole system out with Android 6.0, moving to a much more sane flow for everyone involved, where the user is able to grant or deny individual permissions at runtime.

View on HN

> I imagine it's because Google recognized the general insanity of the system, and presenting fewer "scary" permissions improved conversion rates.

Because the way to fix "apps can demand a laundry list of permissions and users can only take it or leave it" is to sweep it under the rug?

A sane way to do it would be the way browsers deal with location data: "App [appname] is requesting permission to access [resource]. Allow always / allow / deny / deny always?"

That's how it works in Android 6.0 (Marshmallow) and above.

Kind of, but you still get the situation where an app wants to get your IMEI to identify the device, but is forced to ask for permission to 'phone', which the user promptly denies because that also allows the app to make phone calls.

What does an app want my IMEI for? How do they work on non-cellular tablets (and PCs) which doesn't have one?

Lots of apps use IMEI as a unique device identifier on Android. A practice that is discouraged by Google. Anyway, since 6.0, developers should find a different way to udid. One alternative is Advertising ID which doesn't require any special permissions but is resettable by the user (though not easily found in the system's settings)

http://developer.android.com/google/play-services/id.html

> system is broken and UI is confusing, protect nothing from user even if working right.

> leave system broken but hide UI so nobody cares.

hopefully, it is just incompetence, not evil.

When it comes to Uber, I think the default is to assume malice unless we can prove it is incompetence.

Yeah, I'm afraid that in Uber's case this is what you must assume. Normally I don't default to such a state, I honestly feel that most times it's just incompetence within an organization, but in Uber's case they have been a bad actor for a long time now so they just can't be trusted.

I won't be using Uber, ever.

I'm a latecomer to this situation, what have Uber done in the past to earn that reputation? Genuine question.

http://www.theverge.com/2014/11/18/7240215/uber-exec-casuall... http://www.businessinsider.com/an-uber-exec-brought-up-the-i...

to start... theres more

Uber us quite literally a supervillain! They've done almost every despicable thing in the tech industry. Sabotage, illegal practices etc al. That's why this is actually big on HN. With uber, shoot first then ask questions later!

GP was talking about the Android permissions system, not Uber.

Do you happen to know in which version of the Play Store this change was made?

Reply on news.ycombinator.com