Hacker News Reader

Comment by 1718627440 | Hacker News Reader

Apps can know whether you granted permission?? That sounds like a security flaw.

This is basically required for clueless (and even not so clueless) users.

If there's a chat app I installed 3 years ago, with no intention of giving it camera access, and I suddenly need to use that app for a video call, I don't want to be stuck debugging broken camera issues for two hours. I'd much rather have the app tell me that it doesn't have camera access.

The OS could tell you instead. If it is a camera app, the OS could tell you on install, that you can't start the app without given camera access, because that's what the app is.

> This is basically required for clueless (and even not so clueless) users.

I can actually confess that this hit me. Almost nothing on my phone has permission to use my camera, including my web browser (why???). I assume this was done in a fit of pique upon discovering that the setting even existed.

Roll on (god knows how many years later) and I cannot get into the gym with the link I was emailed to have my browser read a QR because my browser is just a grey screen. It was only when the member of staff suggested permissions that I realised what was going on.

I'm the problem, it's me

This is fair for permissions. But for notifications, the app shouldn't need to know. It can just send them into the void for all the app cares. If the notification doesn't work then it should never break critical app functionality and apps should be built with the assumption that users will never see/interact with notifications.

They can, but there's an OS option that basically is "I'm going to say yes, but then effectively do no". Basically it'll pretend to the application that a permission is granted, but then just keep returning empty information or doing nothing with it. So notification perms would then be seen as enabled, but nothing is actually being send to the user.

Unfortunately Google isn't really exposing this to users, so you need something like App Ops or adb to set it up.

Yes, and they’re bound to abuse it.

There’s a similar thing going on with emails. Dozens of services ”decide” that you need to update your email address, because ”they can’t reach you”. Many of them even stop sending you emails you explicitly subscribed to, perhaps to maintain an archive, ”because you don’t seem to open them”.

No, dear Linkedin and others, you’re reaching me just fine, and it’s none of your business whether, when and where I open them. Maybe I just read my emails offline and strip your tracking links (and avoid clicking on links in emails in general).

Inexplicably LinkedIn’s UX for changing the old email address, the one they cannot reach you at (!), to a new email address, starts with confirming your current email address (THE ONE THEY CANNOT REACH YOU AT). Brilliant.

Of course, that way they can so they can refuse to work until you uninstall or give in to their demands. There are other operating systems that present fake data at least.

Yep. Just today I had a tram/bus ticket purchase app refuse to work unless I grant it Phone access.

Reply on news.ycombinator.com