Hacker News Reader

Comment by izacus | Hacker News Reader

The important part of context here:

If you targeted APIs before Android 6.0 (e.g. you targeted API Level 21 - Lollipop), you didn't have to ask users for permissions to access contacts, sms, SD card and other data. Which made all the new security improvements in Android rather moot - scummy apps (like Snapchat :P) just didn't update their API levels, kept collecting personal data without asking for permission... AND didn't implement improvements of new OSes because they wanted to keep collecting data without restriction.

This is finally great news for Android security.

View on HN

> you didn't have to ask users for permissions to access contacts, sms, SD card and other data

This isn't true. Android 6.0 introduced runtime permissions, where permissions could be granted in the context of the application. Previously, the permissions still had to be granted, but they were granted before the application was installed.

You get asked when you install the app but nobody looks at that huge list of permissions, especially if not accepting means you don't get to use the app

There's a huge difference between apps being able to do stuff without ever asking permission and apps asking permission but users choosing to ignore it and just say yes to everything.

While I agree with permission overload at install time, users pay more attention when permission prompts come up one at a time at first-use. It also gives the app a reason to stagger in permissions only when the feature is used, lest the user loses interest and drops off.

Actually really big news.

Apart from the security implications it will also decrease fragmentation of Android versions and encourage manufacturers to update their OS versions.

Technically snapchat and scummy apps can keep collecting private data indefinitely. Demands for API levels only apply for either new apps or new updates to existing apps. They could simply leave a version in the app store, use that for collecting, and have new versions have their own play entry like an unlocker app currently does it.

Not even the August 2019 deadline prevents that.

So really, there's nothing in here that stops personal data collection.

That's good, but it's almost a year ahead (November 2018), and I wonder how many Snapchat users care about permissions at all.

Yeah this is definitely the biggest point of the article, thanks for highlighting that!

> This is finally great news for Android security

Yea, now only Google is collecting an absurd amount of information on you. They don't like competition, so I'm surprised it took this long for them to implement this.

This just seems unnecessarily harsh on Google. Just because they haven't solved security / privacy in its entirety, they shouldn't be lambasted for taking a step forward!

Reply on news.ycombinator.com