Hacker News Reader

Comment by obsurveyor | Hacker News Reader

Google doesn't even apply the permissions very tightly. App makers are happy to ignore recommendations(I don't think they're requirements) to work, even if not granted the permission. They just do things like prompt over and over or completely stop working if they detect they're given the fake, default data from not being given permission to things like your Contacts or Location. There's no user agency in Android 6.0+ permissions really, the apps can just hold their functionality over the users' head until they accede.

Also, Android permissions are strange. Like, why does an app need access to Contacts to use my Google Account to sign in? An account is not a contact and just because I want to let you unify my logins, that doesn't mean I want you to have access to my contacts.

View on HN

Obviously the first problem is most users (almost 2/3) aren't using M+. However, that being said I do want to clear up some of your points about user agency.

It is true app makers are happy to ignore recommendations, but users with M+ are much more empowered. So, for example, if the app makes permission requests repeatedly, on the 2nd ask Android will provide the "Never ask again" check to auto deny permission requests. So if an app is being annoying about a permission you (the Android user) don't want to give you can silence the app.

Also, you can always deny individual permissions after you've granted them, which also includes apps that don't target M+. So if you don't think an app should require the Contacts permission then you can deny only that permission. You can argue that this is a "power user" feature, but if you're interested in app permissions I think M+ gives you the appropriate levers. And surprisingly, I've seen the developers who fix their app if enough users uninstall it and leaving a review citing poor permissions.

I forgot about the "Never ask again" functionality, that is definitely good for user agency but it would be much better if Google required apps on the Play store to function with real data or fake data. This includes having an alternate auth method if the user doesn't grant access to their account, especially in light of the following paragraph.

However, you don't really address my concern that Contacts is grouped up with Accounts when it shouldn't be. I cannot deny an app access to my contacts while allowing it to use my account to sign in. Android app permissions need to become much more granular and fully backwards compatible.

Ironically, I'm sitting here not upgrading my phone to Nougat because I really dislike the material design aesthetic of the UI. It's ugly, blinding white and turns every icon into boring circles. It also apparently breaks a lot of stuff that I use everyday.

Reply on news.ycombinator.com