Yeah, android tried this initially with the permissions system. But literally every app requested every permission and it became completely useless.
As a user, you have no way of meaningfully using this info.
As a user, you have no way of meaningfully using this info.
Google could have fixed this by allowing the user to give the app mock permissions instead, e.g. empty or randomly-generated storage, fake camera device, randomly-generated contact list, etc. Third-party solutions that allow this have been around for about a decade, but they do not have the reach that Google does.
It might be illustrative that Apple, who usually care a lot about good UX, made this procedure downright painful. When the app is installed it’s fine, but when it tries to use a permissioned resource for the first time that pops up a dialog box. That box is not confirm/deny, but rather sends you to the System Settings window, where you have to find the right category, find the program in that category, select Allow, and then enter your password. It seems like Apple might think the Android permissions system failed in part because they made it too easy to say yes.
Also it might be good to be more specific. E.g. don't ask for all permissions at once, instead if the app starts talking to telemetry.endpoint.com it has to ask for these specific permissions at that point.
Then the user can see, hey this is requesting access to this particular server, that seems fishy, let's not proceed.
The only real solution I can see is only installing plugins from large trusted entities.
They didn't. Google regrouped and renamed the permissions until every normal thing that every application needed became grouped with rare and powerful capabilities.
Except for the ad-based crapware, almost all applications minimize their permissions.
There used to be a period where many android apps would explain in the description why they needed certain permissions. Those days are over.
No. You think it is suspicious and install another theme that doesn't request anything.