Hacker News Reader

Comment by tferris | Hacker News Reader

Android has this feature for years or call it a very granular and understandable permission system for apps.

(Don't want to start a flame war and I am not really an Android fan)

Android's permissions model doesn't work at all. Every app asks for a ton of permissions at install time. You can't install the app without saying yes, and every app asks for far more than it needs.

In theory, it is good, but in practice, it's broken.

The iOS way installs the app, but denies access to the resource.

Funny – if I see an Android app requesting a permission that I'm not comfortable with, I just don't install it.

How do you expect this to work otherwise?

On iOS if you want to use Facebook but don’t want to grant it permission to access your location, you can still install and use the app and just deny it when the permission is requested.

It didn't do jack for addressbook stealing apps though.

You are representing it as though Apple asks for user's permission for every sensitive resource.

I am with you in not installing apps asking for too many permissions.

But since you're asking: I expect the permissions to be more granular.

And I would like to be able to revoke some of them if the developer allows it.

iOS does this much better -- I decide on a whim whether or not I'm going to let application X know my location today.

That's a bit hyperbolic. My android apps don't ask for permissions they don't need nor do many others.

I think the android permission system is sane and reasonably functional. It's the users responsibility to read the requested permissions at install time and make a call.

There could be improvements here of course. I'd like to see a two tiered approach where developers could mark which permissions are optional and users could decide which to grant the on the first or each time these permissions are used in addition to the current method. I'd also like to see a requirement for devs to provide an explination of what each requested permission is needed for that could display on the market.

Hopefully these types of controls will continue to evolve on all platforms.

> I'd like to see a two tiered approach where developers could mark which permissions are optional and users could decide which to grant the on the first or each time these permissions are used in addition to the current method.

This would be SO useful!

I have an app that I want to be able to collect crash reports for. This means I need the "READ_LOG" permission. Thing is, the log CAN have other potentially private information in it, so there's a scary warning for that permission.

If I could ask for READ_LOG permission at run-time, and Android would pop up a box saying "This app is requesting access to the log to: 'create a complete crash report and send it to the developer'" or some such, then only the very few people who are actually sending me a crash report would ever have to "reveal" their log data to my app.

Funny that's one of the cases where I'd envisioned using such a feature. I wrote a private logging mechanism into my apps to capture the data I write to log seperatly so my support request option can include some just-for-this-app logs without a scary permission req but I'd much rather do it the way you suggest.

Another situation I've got is I'd like to use the the permission to act as your Google account to optionally grab some user detail from <some Google service>, but I don't want to scare off users with this permission.

The other feature on my permission wish list is some permission specific options like internet access to [urlmask1,urlmask2,...] or log read access to logs from my app only, errors and warnings.

> I'd like to use the the permission to act as your Google account

Oddly; even when you (the dev) ask for this; Google prompts you (the user) at access-time to approve/deny account access permissions (similar to Google's OAuth prompts on the web). Seems that would remove the need to ask for the permission at install time as well.

I am not familiar with Android, but can you launch a 'send log app' stored inside you app that has its own security declarations? Or would that trigger a dialog asking for permission at install time?

While I agree this would often be useful, I think READ_LOG permission for a crash report is a bad example. That's the sort of thing that could be dealt with using an OS-level crash handler (with a prompt about whether or not you want to send logs to the developer of the app).

While showing which permissions are used is great, it's not a cure-all because they're all or nothing permissions. My background is in network security, I consider myself a security-conscious person, but I am continually guilty of tapping INSTALL immediately without expanding the permissions list.

The SMS permission in Android seems the most egregious to me. For example, an Android app you install requires SMS permission. However, in Android as it stands right now, the app does not need to notify a user when it sends an SMS - there's no requirement (nay, not even a widget to pop open and require the user to "Send" the way you see on other platforms like iOS--you've got to build this into your client yourself) to do this. So, you install a third party SMS client thinking you'll use it to send SMSes, but the app can send SMSes on its own, without you even seeing them. See also: http://www.cs.ncsu.edu/faculty/jiang/RogueSPPush/

Personally, while not perfect, I like Blackberry's model here (Cyanogenmod has implemented something similar) - the user can block out certain functions, knowing full well that the app will break - but can then decide to re-enable them if needed or once their trust level is raised.

I definitely agree that many of the permissions are far too broad. I'd like to see send SMS silently separate from send SMS with user approval.

I guess what I'm advocating here is a combined approach

- up front permission notification of android, but more fine grained

- activity alert approve/deny from ios

- selective permission blocks from bb except the developer can specify which permissions are optional so the apps don't crash when you disable random permissions, they just refuse to start with a clear message.

- parameters for some permissions to further narrow the scope like URL masks that you'll access over the internet instead of asking for full net access, etc.

Side question about ios I wonder about. If you buy an app and install it, but then find it needs to use some permission you're not comfortable with can you get your money back or are you just out of.luck?

Apple tends to err on the side of the user for refund requests, so most likely. You might have a hard time arguing that you didn't understand that the app would need those permissions, though, as any app that requires either location or address book permissions is likely to be fairly obvious.

This is a clear marketing opportunity for the Android platform, of course since no one really governs its course, it's completely being missed. I suppose cheaper/more features/hotter phones is the way they want to go.

I'm also surprised Microsoft hasn't taken advantage of this in marketing Windows Phone since it has a capabilities model similar to Android.

WP7 is even more secure when it comes to contact info -- you can only access contacts from an app via UI control, and then you can only return email/phone number from one person at a time (whichever the user has selected).

Mango added the ability to query contact and calendar data without the chooser UI. However it does require a declared capability in the app manifest.

BlackBerry OS also had a granular approach to permissions, much like Android.

iOS seems to only care about your location when it comes to permissions which worries me a little.

That’s not perfect either.

It’s granular from the developer point of view, but it’s not for the user: when you install an app you either grant it all the permissions it requires (before you have a chance to actually run the app and see what it does) or you don’t install it at all.

With the iOS model (asking permissions when the app uses them) I can install an app, deny it permission to use my location and it will still work for everything else.

Also, how would that solve the problem if the Android developers forgot to add the ”read contacts” permission in the SDK? They would still have to update the software to add it.

If they forgot to add "read contacts" in their application manifest, then the code that tried to read the contacts would ALWAYS fail. Even on the simulator, which is rooted.

It would be nice to allow or deny an app "optional" permissions (selected as optional BY the app) at run-time. It would NOT be nice for users to be able to do this willy-nilly. With the dozens of possible permissions, you'd have millions of potential combinations a particular user could enable or disable, and you'd need to be sure your app worked with any combination.

But worse than that is the fact that a lot of apps are monetized by ads, and disabling "INTERNET" permission would prevent ads from downloading. If I'm trying to make a living off of my app, I don't want to make it easy for people to get it for free. Some people will anyway, of course, but no need to make it easy.

> If they forgot to add "read contacts" in their application manifest, then the code that tried to read the contacts would ALWAYS fail. Even on the simulator, which is rooted.

I meant the Android OS developers (which is what happened with iOS here), not the 3rd party developers.

They didn't forget. [1]

    String	READ_CONTACTS	Allows an application to read the user's contacts data.
    String	WRITE_CONTACTS	Allows an application to write (but not read) the user's contacts data.

So yes, if they HAD forgotten, then Android would have the same security hole. But it doesn't, because they took security seriously.

[1] http://developer.android.com/reference/android/Manifest.perm...

Reply on news.ycombinator.com