Hacker News Reader

Comment by zalzane | Hacker News Reader

Why is it even possible for this to happen? Did someone really think it was a bright idea to provide an API to access people's personal data, and if so, why doesn't the phone tell them that before letting them install the app?

On top of all of that, why wouldn't the phone provide a setting to restrict all personal/identifying information from being accessed by the app?

View on HN

Address book access is a permission just like anything else (internet access, for example), so it can fly under the radar. Android has been trying to make things like "send text messages" stand out a tad more than "write to local storage", but they may need to go even further.

This is my personal favorite app permission that you can request: http://developer.android.com/reference/android/Manifest.perm...

Wow. I wonder what the use-case for that is?

An app that lets you brick your phone remotely if it gets stolen maybe? Depends on how it works.

Enterprise anti-theft tools.

It most likely does warn users but most people just click 'Accept' on all those "ABC application wants access to X, Y and Z" warnings.

Right, this form of security is completely ineffective. It’s just like Vista’s Universal Access Control modals: after being shown the first few of the day, you would stop reading them. I suspect EULAs are written to exploit this phenomenon: no-one reads EULAs because they go on forever, so you can bury all kinds of outrageous conditions in there.

All of the smartphones I have used ask you before allowing access to your contacts. But many apps want to use these for legitimate purposes -- for example, Vine uses them to find people you're already friends with.

It's all about trusting what that company is saying "now".

They can change later and spam your list or use it for some other purpose. You can shame them publicly if you find it out. But then, it's already too late by that time.

That sort of API is necessary for, say, an alternate text messaging app.

Reply on news.ycombinator.com