Comment by pilif | Hacker News Reader

Comment by pilif | Hacker News Reader

Parent Full thread

Android needs to fix the way the permission system works. As it stands now, all permissions are asked upfront at installation time where the user has no data available to make an informed decision.

Also, the fact that apps only auto-update when the permissions required don't change produces all the incentive for app developers to just ask for everything. After all, most conscious users will find something they object to at install time anyways and thus might not install and most people don't read the dialog anyways, so not much to lose.

But even when android changes to ask for permissions as they are required (which could be done in a backwards compatible way by not throwing exceptions but just pretending that whatever API call you just made has succeeded, but then doing mothing or returning meaningless/no data), this still would not help with a malicious app asking nicely with a legitimate reason ("let me access your SMS to read the login token") and then using that permission for illegitimate uses ("let me upload all your SMS to my server").

Even with all these permissions, it still boils down to trust and where on the desktop world, this trust was rarely abused, in the mobile world between all the built-in adware and social integrations, that trust is badly hurt.

I'm assuming it's deliberate; training most users into clicking through warnings to expose the maximum personal data by default.

also, give the user the ability to refuse some permissions. There is no way i'll give any app access to my SMS. As the article stated not even my closest friend or my girlfriend have access to my SMS.

I agree with you, SMS is a much private matter, but you're sadly mistaken. SMS are not encrypted nor secure communication. Your carrier can read them, and so do the relevant part of the corporate surveillance apparatus along with all you do with your mobile phone / smartphone. And so do government agencies.

SMS are sort of the same issue as clear text email, probably a bit worse.

Facebook can't access them though. This is a strange concept to some people, but an insecure method of communication can still be secure against some parties. One of the best examples is RC4 - the NSA and GCHQ are reading everything you send/receive encrypted with RC4, but likely nobody else, at least for now (although that could change at any time; another reason to eliminate it everywhere).

Moreover, legal protections exist even where technological protections do not; just because the police have the ability to intercept text messages doesn't mean they have the right to do so without a warrant (and somewhat similarly for carriers). Once you voluntarily give the police — or carriers — permission to read your text messages, all bets are off.

This is a must have until they can figure a better way to give selective permissions.

If someone comes to fix my house, I don't give them a free entry for lifetime just for convenience.

I really know nothing about how android works so excuse me if this is a stupid/impossible idea, but I wonder if someone could make an app-vetting app.

The issue seems to be that you have to give these applications their permissions so they can function, but you really have no way of knowing how those permissions are being used. So you end up just allowing everything and being at the mercy of developers or you act completely suspicious, don't install any app asking for strange permissions and may even fall into these wild accusations that giving Facebook permission to view your SMS messages is like signing over your soul to the devil.

So again, I'm really out of my game here, but I wonder if you could create an app-vetting app for android that monitors and logs internal requests for data (assuming android uses some sort of internal api to handle this) so you could see what apps are making what requests and how much data they're grabbing. And then monitor outbound network traffic to see what put and post requests are coming from the app, how much data is being transferred and where they're being delivered.

Then you would know how much of your data is actually being used by an app and how much of that data is being sent to Facebook. Granted, I'm sure apps like Facebook's are constantly sending themselves data from your phone but the things to look for are the data being sent when the app isn't active or when the request varies an objectively significant amount from the baseline requests.

If this can be figured out, you could then create a database of the results for every app logged and have a security ratings guide for the android marketplace.

If this is impossible, impractical or just plain stupid, I apologize, but it seems like something that SHOULD be possible, so I just figured I'd throw it out there.

Auto-updating without asking if the user is okay with the new permissions? How should this work?

Ask Apple. They seem to have solved this problem quite a while ago.

The iOS implementation allows rejection of individual permissions, doesnt prevent install, and allows the developer the freedom to choose the best possible time to ask. See https://medium.com/p/96fa4eb54f2c

Well, you're right, but Apple's model is fundamentally different. I don't think Android will switch to such a model in the (near) future. That would mean a lot of things have to be changed, and hundreds of thousands of apps would break. So we can safely assume Android will stay with its current system. Thus there is only one possibility left: improve the current system. Rejection of individual permissions would definitely the most powerful improvement, while still being easy to implement.

If permissions could be granted not ahead of time, but rather when they're needed, you could simply update the application and just ask for permission when the new functioanlity was actually used.

That's Apple's system, right? Android does have a different one. Fortunately or unfortunately, I'm not really sure. Android's system definitely has advantages as well. But it goes without saying that there are serious issues that must be fixed.

It shouldn't, ever.

If Android had a better permissions model, you could allow autoupdates with new permissions disabled unless the user then chooses to enable them. That said, anyone who is serious about security has autoupdates off anyway.

Reply on news.ycombinator.com