They had implemented that already a while ago, then reverted the behaviour, and now implemented it once again.
It seems as if it was not "enabled" for everyone yet, however.
They hid the permissions with each version better and better and apparently decided now, users don't need them at all.
In particular because not everything is a runtime permission. E.g. I like to know that [apk X] has no internet or file permissions at all - it rules out nearly all practical ways to leak your information. And google just keeps taking more and more steps to hide that information from me.
As far as I know (please correct if this is wrong), there's no such thing as an app with no Internet permissions. All apps can access the Internet without permission, and only additional uses of the Internet (e.g. seeing your WiFi AP name) require special permission.
AFAIK the "Internet" permission many apps requested was actually for this more advanced usage - just to hit a REST endpoint or something required no permission at all.
https://developer.android.com/reference/android/Manifest.per...
It's so commonly requested though, that virtually every app does have it.
But for quite a while you could still read the permissions list in the play store, and see if it used it. And adding the permission would still give you a warning on upgrade (outside the play store anyway). Both of those (I believe) are gone nowadays.
It's obviously going to be requested by most, but its absence can be extremely relevant, e.g. https://play.google.com/store/apps/details?id=keepass2androi...
It is wrong. Internet permission is made of INTERNET and ACCESS_NETWORK_STATE, which are "normal"-level permissions to be specified in the Manifest. Without them, no Internet. Correctly: there are plentiful applications that do not need it.
I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again.
I have yet to find any geolocation functionality in the app.
EDIT: Please see epukaza's comment below. There is a legitimate reason for this permission, which his comment explains.
Why do they refuse to opt you out of being an unpaid drone generating $0.02 worth of data for them after you paid them $250? Because they can, since we don't have any laws forbidding it.
I would be curious if it does any or all of:
- Fetching GPS coordinates, which are typically to many decimal places. - Making API requests to external servers that you don't own.
A tool like MobSF (https://mobsf.github.io) might be very enlightening to understand what a given app does, or at least can do. I've tinkered a bit with an iOS app in it, but not Android so far.
Also, proxying your device through Burp Suite or ZAP could also be interesting to see what traffic occurs, especially if the developers weren't picky about valid TLS certificates.
Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.
Plenty of app developers have muddied the water enough that apps should have a lower level of trust given to them. Stealing data is a reasonable fear now. It is not reasonable to assert otherwise.
It is therefore reasonable for a person to wonder why geolocation is requested but then be suspicious why it doesn't seem to need it. Regardless of the underlying technical reason. Those technical reasons are part of informed consent. If I don't have informed consent, do I really have consent?
Its also not a sad state at all. Its healthy. Its part of the modern landscape that someone can be suspicious and rightly so. If not, you're setting people up for misfortune. Is there some reason you want people to blindly trust like this? That seems almost abusive to me.
This is almost all apps. Your default assumption should be that anything on the big app stores is being as malicious as they can get away with -- especially if it is a forced install leveraging some product you have already purchased that could easily be sent over a standard protocol.
_Maybe_ the app is fine, but in the cases I've checked big corporations abusing your privacy is the norm.
https://developer.android.com/guide/topics/connectivity/blue...
Sure, but why does the app need to be able to scan for any and all Bluetooth devices? There should be an entry in the manifest describing the kind(s) of devices the app wants to interact with, and only those devices should appear in the scan. Naturally the list would need to be reviewed to verify that the selected devices are related to the app, and presented to the user in the app store along with all other requested permissions.
In this particular case the same company designed both the app and the device it's connecting to, so for all we know the device could have an embedded GPS receiver to provide the app with much more detailed location information than it could get from Bluetooth alone. It could also just relay its own Bluetooth scan results. However, the app at least couldn't easily get location data from Bluetooth scans when the device isn't in range.
https://github.com/larsp/co2monitor
Adafruit’s SCD-30 is also nice and pairs well with a Pi Zero W.
Lots of apps only need specific permissions if you use specific parts of the app. And apps are much larger (one app does more things) than they were 5-10 years ago. Eg you can use some apps as a camera, but never as a photo editor, and get use out of it by only giving some specific permissions (camera), forever.
There are products on GitHub; I am looking at NetGuard (from, I think, Marcel Bokhorst aka M66B - the project has many forks). The .md says, «The only way to build a no-root firewall on Android is to use the Android VPN service».
An Android application requires "permissions" to do "anything past the basics"; permissions have to be declared in the "Manifest" file.
There are (simplifying) two main types of permissions: "normal"¹ and "dangerous, runtime"²; the former only need to be specified by the programmer in the Manifest; the latter also need direct confirmation from the user at a requester prompt.
This implies that "normal" permissions are granted by the user implicitly with the action of installing the application. Which means, that it is _quite important_ that the user sees the permissions list beforehand, before installation.
--
¹"Normal": BLUETOOTH, INTERNET, VIBRATE...
²"Dangerous": READ_CONTACTS, RECORD_AUDIO, SEND_SMS...
No, not every application requested network access. And surely not a small number of users checked if a calculator or a sound recorder did, and, also checking the developers' justifications for including specific permissions, decided their (dis)trust.
They could just change their play store listing from "Required permissions" to "Permissions this app can request". This is similar to the "nutrition label" approach that the Apple App Store has.
Google's docs are very clear that apps are meant to explain the need for perms, and the impact of denying them at runtime... I'd love to see the play store to also provide publishers a way to specify what the impact/loss of features is if you deny them at runtime. Trustworthy publishers would love this, and the non-trustworthy ones... ¯\_(ツ)_/¯
No no no no no, this is a total catastrophe. I can't understand how it got implemented at all.
I just missed a birthday notification from my calendar app because Android "helpfully" removed the app's ability to create notifications! After all, I hadn't opened the calendar app in more than six months!
Infuriatingly, I caught the original message telling me "hey, we just noticed that your calendar shouldn't be allowed to send you reminders" and I tried to restore the permission, but that doesn't seem to have worked.
Whoever designed and implemented this "feature" shouldn't be trusted to put on pants.
Certainly agreed: a system should never "take the initiative" and replace you in decisions.
I am seeing cars that act along the lines of "Ah, you turned off the air conditioning, so I'll proactively open the windows": this clearly indicates that some manufacturers have embraced decadence and nihilism, they "have given up" and "want to watch the world burn" (unless they are simply underage savages).
Combined with the fact that Google seems to be sending more notifications for all kinds of junk nowadays makes it even easier to fail to notice that.
Ditto for a wide range of apps. Pretty much everything that isn't a messaging app.
I wouldn’t download, e.g.; a video game that would ask for my contacts or location.
Why should I have to download and wait for the app to install before I know what permissions it’s asking for?
Furthermore - what’s the possible purpose of removing this information when it was already there?
As seen on computers, OS is too important to be left to companies - if you value your freedom of choice and privacy, that is.
Nowadays camera sensors are only half the story and most of the iphone-like photo quality is achieved in software.
Have we reached a point where non-OEM apps can deliver something comparable to the market expectations from big manufacturers?
I am ok with narrow combinations e.g. if you use app X on Hardware Y you have amazing photo results.
Is there something along those lines that anyone can recommend?
In that no one cares about it unless they're in it.
But... why? I use open camera. It works. It takes pictures. Those pictures look alright, pretty damn good even. I certainly don't look at them and go "well blimey I just can't tell what this picture is meant to be".
Whatsapp ends up destroying the quality when I send them to friends anyway.
Like, maybe if you've got a huge instagram following and a patreon drawing in money based off that or something? I dunno, it's just one of those things I really can't wrap my head around, so long as I've got a picture I'm happy.
It’s because there is a metric shitton of software that goes into the camera app itself, and access to the camera’s hardware does absolutely nothing to enable these features.
IIRC there’s actually some sort of crazy ML shit behind Apple’s native camera app; I would be very curious to see what a raw photo from the same sensor would look like in comparison.
Having said that whatsoever validates the commenter’s point.
Raw format photography (ProRAW specifically) has been officially supported on iPhones since around iOS 14.3 (which was released in late 2020), and plenty of people have reviewed that functionality already.
As for how it would look specifically, it is difficult to give a straightforward answer, because RAW photos require a good amount of manual processing. And the final result of is going to look 100% subjective depending on the person and how they manully processed it. Just like how the same would be the case for RAW photos taken with a DSLR.
[1] https://play.google.com/store/apps/details?id=app.grapheneos...
I don’t want to download a clipboard helper of some kind and find out it’s going to ask for my GPS coordinates.
I want to know ahead of time.
This is a better approach for the goal, because if there's one thing they learned from years of offering the permissions list, it's that users can't convert the concept of "app permissions" into a good mental model of "What data the app can collect on me." They just aren't on average savvy enough. So the Data Safety info answers the question users actually care about without added complexity of pretending the average user is a developer who groks what permissions mean.
An app may have permission to do something (e.g. access your location), but if the app's usage of this feature does not involve your location being sent to the app's server and stored somewhere, it does not need to be disclosed in the privacy labels.
Apple and Google cannot verify what happens with your data when it leaves the device - they rely on the honesty of developers to explain what happens.
That sounds so much easier than just listing the possible permissions it might ask for on the Store Page before I install it.
Now get off my lawn.
As a bonus, the DNS-based adblocking works extremely well. Not perfect, but dramatically better than nothing at all.
The Samsung Gear app is like that, for example. You need it if you want to tweak the settings for their Galaxy Buds headset (the ambient sound level, for example), but on first startup it prompts for what appear to be all the permissions needed for every kind of Samsung device, including things like smartwatches—calendar, contacts, notifications, the works. If you deny any permission the app refuses to start, even though none of that is necessary for the task at hand.
My workaround was to install it and then immediately disable all Internet access (airplane mode), adjust the settings, and then purge the app from the phone before turning the network back on. Fortunately the settings are persistent even without a constant connection to the app. I think that should be sufficient to avoid any unwanted data leakage, but it's a lot of work for relatively minor benefit, and the process must be repeated any time the settings need to be adjusted.
I did not use play store over 3 years and I'm not miss anything.
There are some permissions given to apps without a user prompt, e.g. start at boot. If there are five similar apps with similar functionality and ratings, I'll typically choose the one asking for the least permissions. And if I notice an app looking for excessive permissions (e.g. location) with no good reason why (e.g. a terminal app), that'll give me a clue that there's a ton of data being collected.
Once upon a time, a giant percentage of a device's user base was tech-savvy early adopters. But with billions of devices having been sold, 99%+ of Android users have very little interest in details like permissions.
But when these details are taken away... when I can't see permissions, when apps I use lose features because of new, restrictive Play Store policies, and when Android continues down this road of "privacy" without insight into exactly what my phone is doing... well, if I wanted this, I'd have chosen an Apple device.
Now they aren't even letting you know how much information the app collects until you download and install it.
Everything should be permitted by default, however, the user can choose to return blank, fake or real data.
https://play.google.com/store/apps/datasafety?id=com.google....
I think it's pretty clear that the Google Play Store is something that only Google can control.
Can't be trusted to these idiots / money-hungry project managers / behemoths * delete as appropriate *
Sorry, maybe there is one but I've not investigated and it's .... rant time.
This is, among many other reasons, why I finally dropped Android after the better part of a decade. The constant A/B/C/D/E testing makes every single thing they put out feel like it's a constant state of beta testing. It's to the point where you don't even know what to expect when you do something as fundamental as opening the app store. You'll seemingly have some kind of server-side flag activated one day that gives you a totally new UI in an app you use every day, hiding things or removing features you rely on. Then maybe in another few days it'll be back to how it was.
Not only do they not seem to value their users, they actively punish you for being one of their users, jostling you around between new UIs or even entire services that are always worse than the last.
a lot of us avoid supporting such behavior from corporations because we view it as unethical or immoral and damaging to the sector in general -- regardless of how good the ux/ui may be.
Some of the bad phone UX ideas started on iPhone. Like removing the physical button at the bottom in favor of annoying gestures and no touch ID. And iOS 7 removed all of the borders everywhere, it’s arguably more radical than Google Material, a UI design I also am not really that fond of.
I guess if you mean there’s no A/B testing or it moves slower then probably. But, it definitely moves. That becomes apparent any time you load an app from the App Store that hasn’t been updated in a while and suddenly your phone looks and feels like it did 2 years ago across the whole UI.
And at the very least, these changes come from normal app updates either from the App Store or OS updates. And it's usually a pretty big deal when they change something, and gets a formal announcement months in advance where someone high up gets up in front of the world and pitches why the change is an improvement (not to say it always is). Whereas Google just randomly shunts out new UI updates on a regular basis and enables them for random people. Usually someone posting about their new UI on reddit is the first place you'll hear about the redesigns.
I'm genuinely curious what apps you're talking about here. Everyone does this nonsense. Everything changes all the time. Everything. I don't like it either, but to state that it somehow doesn't happen in the Apple ecosystem seems like a pretty big whopper.
I don't think it was much time later before they moved it to messages.google.com, which i think was in line with their SMS's apps like 5th rebranding, this time from Android Messages to Google Messages.
Originally the app had an overall blue theme, and for individual contacts you could change the color of your conversation with them so each chat thread was themed. This even had the neat effect that it would sync with the web version. However, it only lasted like a week maybe before Google completely redesigned Messages to be all white themed, and killed the chat themes entirely so all message threads were now blue and white to look like the iPhone messages app.
That wasn't a rare experience, and I haven't encountered anything like it since switching to an iPhone.
They have no incentive or resources to do A/B testing or make unnecessary UI changes.
It surely would be so... What could trigger that in an application? Some of us have never seen any such behaviour (fortunately for anybody responsible and huntable). Maybe said applications are web-based, mostly front-end?
How about intelligently designing applications that you yourself want to use? Too hard.
Disclaimer: just thinking, not knowing the costs
Have we done an A/B test for A/B testing where we test A/B testing…
The people who use the apps I make aren't always me. Many of them are very good at things that I know nothing about, but I usually know more about computers than they do. Sometimes the differences are even harder to account for, having different preferences, different ways of thinking, and participating in different cultures.
We are approaching the age of Schrodinger's Apps.
> I would prefer app stores be similar to health warnings on cigarette packets, because predatory data collection and billing practices are so entrenched.
but on the other hand (and just a guess) but likely "conversion rates" were lower with the labels.... so off they go
If anything, it harms the user by preventing them from seeing what permissions apps will access in an easy to read format.
Why did google even decide to do this in the first place? My best guess is it makes users more likely to let an application access permissions after they've gone ahead and installed it, generating more ad $$$ in the process. But is there any other reason?
Permissions like READ_PHONE_STATE make it sound like the app wants to access every phone call you make, when all it really wants to do is pause your music when you answer a phone call.
The combination of runtime permissions for most things, and the de-emphasis of permissions in the Play Store has reduced this as a pain point.
It's also easier to introduce optional features - using things like contacts, location, or Bluetooth if the user wants to give permission at runtime.
> Permissions like READ_PHONE_STATE make it sound like the app wants to access every phone call you make, when all it really wants to do is pause your music when you answer a phone call.
And btw, a huge amount of Apple's "privacy" schtick is pure marketing combined with gatekeeping. Oh no, we couldn't allow users to have the choice where to install an app from, or how to pay for it, because privacy and not because we like our tax.
The second issue is Apple facilitated the modern form of having no privacy - apps with discrete access to all our private data, tracking us in real time, using APIs Apple designed, using an approval process Apple cheaped out on, and they have profited immensely from this state of affairs.
The third issue is Apple is often at odds with consumers, there is an entire Wikipedia article about their litigation from when they fucked people who buy ebooks, tech workers they employed, parents who let their kids play iOS games, people who bought laptops with butterfly keyboards, developers they chose to compete with, they often do things contrary to our interests and rights.
___
¹ The topic, not the actual thing.
² Present & future.
³ Not a typo; an allegory.