Comment by hiby007 | Hacker News Reader

Comment by hiby007 | Hacker News Reader

I am an regular Flipkart User, and I do not like this behaviour, Flipkart is forcing me to move to an mobile app, just to have better control and tracking.

They have already stopped supporting the mobile website, and it simply instructs you to download the app to continue.

This is the moment I have completely stopped using flipkart and moved to amazon.in

I like website more than app, both gets the job done, where as In an mobile app I have to give various permission which is not required for a simple E-Commerce website (which suggest the are just doing it for the data)

See the list of permission used by the app below.

  Device & app history
  retrieve running apps
  read sensitive log data
  Identity
  find accounts on the device
  Location
  approximate location (network-based)
  precise location (GPS and network-based)
  Photos/Media/Files
  read the contents of your USB storage
  modify or delete the contents of your USB storage
  Camera
  take pictures and videos
  Wi-Fi connection information
  view Wi-Fi connections
  Device ID & call information
  read phone status and identity
  Other
  receive data from Internet
  use accounts on the device
  view network connections
  full network access
  control flashlight
  prevent device from sleeping
  read Google service configuration

It's already past time that Android had (out-of-the-box) a "don't grant access but make the application think I did"-checkbox.

Essentially, showing fake data to the app if you pick this (eg: no photos, fake contacts, etc).

AFAIK, there are some android apps (and cyanogen) that add this features, but it really needs to be worked on upstream.

This is doubly useful for google, since they can always keep their own apps as "superprivilidged" on google-sponsored phones.

I lost my hope when they removed the "access to the Internet" permission from the list of privileges. Now you take for granted that all apps will try to do that.

I use AFWall+ and CyanogenMod's Privacy Guard to control everything, but it's sad that the data of most people I know may be stolen without their knowledge after they install yet another Subway Surfers-type game or "vintage photo effects" app.

CyanogenMOD's PrivacyGuard is pretty close to this, I don't use stock android anymore due to this.

Xiaomi's MiUI has also had this feature for quite some time. They call it the Permission Manager - http://www.androidbeat.com/2014/08/use-permissions-manager-m....

That would be horrible for normal developers.

People would use it all the time, and then complain that the app doesn't work.

The actual problem is the "all or nothing" security model that needs to be replaced with contextual permissions (like "This app wants to access your photos right now. Allow?", see iOS).

The "all or nothing" model defeats its own purpose by effectively leaving no choice for the user.

It'll be better if there are checkboxes next to each permission, and if the user doesn't grant a certain permission, the app can know.

Older apps targeting older API levels will receive fake data, whereas newer apps will be able to know whether they were actually granted the permission or not.

This would prevent apps (and app developers) from being left in the dark, and would also kill the "all or nothing" permissions model currently in place.

"Sorry, but please reenable GPS so SuperFlashlight can function."

Nah.

Android starting from 4.4 does have a privacy feature that allows you to control what data out of permissions a particular app can access, on my phone I have turned everything off for everything. P.S. I don't have any google app

* It's already past time that Android had (out-of-the-box) a "don't grant access but make the application think I did"-checkbox.*

The weird thing is, it does. Or, rather, it's hidden-in-the-box. There's an app called App Ops that can be enabled if you have root access that limits permissions to installed apps - I'm actually not sure if it sends fake data instead but I'm yet to have an app crash from it. But without root it's not usable. Sigh.

I've never used Flipkart as I'm not in India, but just browsing to their website seems to work on Firefox on Android. I just check the "Request Desktop Site". It's a bit janky but doesn't seem unusable.

Though I agree, taking business elsewhere is a better response to this kind of privacy-invasion. (And Google should shoulder a ton of the blame here, as they not only allow but encourage this kind of shit.)

"See the list of permission used by the app below"

The permissions demanded by android apps have moved from alarming to out and out clownish.

Imagine consenting to this:

"modify or delete the contents of your USB storage"

they are asking you to backdoor your own device.

What the freaking hell. Android permissions are jacked up.

Oh, don't worry, it gets worse:

* Android does not let you selectively grant permissions (unlike iOS)

* Android expects you to give an app all permissions at once at install time, carte blanche (unlike iOS)

* Doing certain very basic things often requires a broad permission - for example, checking if music is playing so the app can mute itself? "Read phone state" - which includes the phone number you're calling

* Google are actively making this worse by making Android permissions broader on Google Play - rather than accept something very specific, you now accept an entire category!

Potentially even worse, Google had an excellent per application permissions system they were working on in Android 4.2 & 4.3 called App Ops that worked similarly to iOS, but that project appears to have now been cancelled: http://techcrunch.com/2013/07/26/android-app-ops/

Do these problems exists on rooted devices also? Is there any work around or some tweak?

Cyanogenmod still includes the app ops.

Thanks for creeping me out, Google. https://news.ycombinator.com/item?id=9430839

I'm really interested in expanding my mobile development into more Android but stuff like this sounds awful. I hate the idea of offering say, GPS or datastorage to a customer but not letting them opt-in to it.

The above concerns would never bother (coz they are not aware) average population , which is more than 95% I guess. Rest is something Fipkart may be willing to trade off.

I guess it will be damn interesting to see how this pans out for Flipkart. FWIS, Flipkart is very unhappy that it wasn't allowed to control (yes control!) the market over web with its Airtel Zero plans. Read more about Net Neutrality [1] events in India lately.

Amazon India is certainly a serious threat to them. On a closed platform (like that of Android which is major in India) they probably have a lot more control and tracking (as someone mentioned it above). I guess it would make a lot of sense for FK to tap the naivete of Indian market and pull them all away from the web.

It's all politics written all over it!

[1] http://techcrunch.com/2015/04/13/flipkart-airtelzero/

Regarding the list of permission, my reaction was no wonder. Just couple of days ago, I got this news that Flipkart is going to start something in advertisement domain. They( and almost every other internet company?) want as much data as they can gather.

just deleted flipkart app

Reply on news.ycombinator.com