• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

app overkill

K

keilian

Lurker
This is gonna be a minor rant probably the wrong place.

Have you looked at permissions alot of these apps ask when installing?

Permission. Storage.
Ok I can see that, save files etc.

Permission. GPS.
So... the app needs to know where I am all the time? Why?

Permission. 'services that cost you money' ??? the sub quote for that one is 'directly call phone numbers.'
Really? So, the program is going to call me now? or call my friends? OR, a 1900 number when I am not looking?

permissions: Network communications. WHY does an app... in this case a game, need 'full internet access'? what if I leave wireless range does the app not work?

Permissions. "network communication'. sub quote 'google play billing service'.
Again, WHY? if the App is free... why does it need access to your banking?


Lets check a different app.

Permissons: System tools.
So it has permissions to mess with the OS without you knowing?

Permissions: phone calls: allows it to record your phone number and phone serial number.

Again, WHY do apps need these things? The above permissions were pulled from two games... both 'top free' games.

Just some of the others that i've browsed in the last 5 minutes.
"read your personal contacts. read your personal information. edit your contacts. modify to boot on start... 'acces extra location provide commands"

Alot of these are from simple games, either free to play or 'microtransactions'. Why does a GPS have to know your exact location, for, say *glances at phone* a lie detector app? Why are we giving a game of solitare, permission to adjust our contact list and make phone calls on us.



what has happened to the phone universe, that devs can just slap whatever they want into the program, and even though it pops up saying 'this program will do this' in clear, bold terms (unlike most PC softwares with their pages and pages of legalese contracts), we ignore these warnings and let people datamine and hack us to their hearts content.. LEGALLY. OH my bank account got stolen from. Well you installed program (insert name here) and you allowed it access to your google bank which turned around and they drained you... is legal, unscrupulous but legal, you accepted terms of service.

Yes I know all companys data mine. Yes I know games I download on my computer are probably just as bad (especially nowadays) at keeping track of every little thing I do. I know big brother is out there 'watching'... as is the idea from the famous book. But are we, as a society, so, adjectly stupid as to ignore it when its shoved under our noses?
 
Depends on the apps.

GPS: It doesn't need to know where you are all the time, but there may be a feature that needs this. Take for example Facebook, Instagram, Tweeter and Foursquare. These apps have a checkin feature which needs GPS access. Its part of their feature set.

Services that cost you money: A dialer app for example (like exDialer). You use it to make phone calls. So obviously it needs this permission.

Network access/Google Play billing: a game? Lets see, Glu games. You can buy credits/coins so you can buy more powerups or whatnot. Or wait, Asphalt 7. You can save your progress to Gameloft servers so you can retrieve the save game on any device you own. Some games need these.

Read personal contacts: As an example, Subway Surfer. It can check your Facebook contacts synced to your phone (hence the permission) so it can find if they play the game too, so you can have a leaderboard for friendly competition on who has the highest score.

Does the lie detector app has ads? If so, did the page say it uses Google Admob? Because if it does, the location service is so that it will give you ads relevant to your area. For example, I get Lazada ads, a local store in my country that sells electronics. Someone in Britain for example won't see those ads.

You must take the permissions in context with what the app does. For example, a flashlight app that does not have ads does not need contact information.
 
I just switched from an Apply iPhone, buying a new Galaxy with Droid SW. Like it so far, until I started to download the basic Apps that I like to use, and started looking at the permissions. I'm sorry, but I agree with the earlier complaints, and I have seen similar comments being blown off in web searches I have been doing. I have a smart phone to be a useful tool. I expect the permissions of Apps that I download to be appropriate for the App to function and serve its purpose. I don't believe that Chase Bank or online brokers, or many of the other Apps to gain mobile online access should require permissions like those in RED below from Chase Bank:

  • Your location approximate location (network-based)
    Allows the app to get your approximate location. This location is derived by location services using network location sources such as cell towers and Wi-Fi. These location services must be turned on and available to your device for the app to use them. Apps may use this to determine approximately where you are.
    precise location (GPS and network-based)
    Allows the app to get your precise location using the Global Positioning System (GPS) or network location sources such as cell towers and Wi-Fi. These location services must be turned on and available to your device for the app to use them. Apps may use this to determine where you are, and may consume additional battery power.
  • Network communicationfull network access
    Allows the app to create network sockets and use custom network protocols. The browser and other applications provide means to send data to the internet, so this permission is not required to send data to the internet.
  • Cameratake pictures and videos
    Allows the app to take pictures and videos with the camera. This permission allows the app to use the camera at any time without your confirmation.
  • Your social informationread your contacts
    Allows the app to read data about your contacts stored on your device, including the frequency with which you've called, emailed, or communicated in other ways with specific individuals. This permission allows apps to save your contact data, and malicious apps may share contact data without your knowledge.
  • Read call log
    Allows the app to read your device's call log, including data about incoming and outgoing calls. This permission allows apps to save your call log data, and malicious apps may share call log data without your knowledge.

Hide

  • Network communication view Wi-Fi connections
    Allows the app to view information about Wi-Fi networking, such as whether Wi-Fi is enabled and name of connected Wi-Fi devices.
Or how about this list from Scottrade mobile App:

Network communication
  • full network access
    Allows the app to create network sockets and use custom network protocols. The browser and other applications provide means to send data to the internet, so this permission is not required to send data to the internet.
  • Phone callsdirectly call phone numbers
    Allows the app to call phone numbers without your intervention. This may result in unexpected charges or calls. Note that this doesn't allow the app to call emergency numbers. Malicious apps may cost you money by making calls without your confirmation.
    read phone status and identity
    Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.
  • Storagemodify or delete the contents of your USB storage
    Allows the app to write to the USB storage.

Hide

  • Network communicationview network connections
    Allows the app to view information about network connections such as which networks exist and are connected.
  • System toolstest access to protected storage
    Allows the app to test a permission for USB storage that will be available on future devices.


The web is full of complaints about this issue and not being notified. So, now the App developers are providing notice upfront, which I assume allows them to freely do whatever their permissions state. I'm sorry, but I don't agree with this. Chase Bank, Scottrade, and I suspect alot of other good examples you wouldn't normally assume would want such permissions, have no need or right to the permissions that go beyond what is needed to do the basic online services they are for, especially with a one time covers all activity statement.

If Google Play is not going to mandate and enforce Guidelines or Limitations for Apps to be inline with their function or purpose, then we need an App that will over-ride any other Apps permissions, App by App, forcing notice to the owner of the phone and allowing us to either grant or deny permission.
 
MKennedy said:
we need an App that will over-ride any other Apps permissions, App by App, forcing notice to the owner of the phone and allowing us to either grant or deny permission.
Click to expand...

Look at the likes of Droidwall.

Some of your assumptions about permissions are inaccurate, however. For example,
The browser and other applications provide means to send data to the internet, so this permission is not required to send data to the internet.
Click to expand...

Every Android app runs in its own 'sandbox' and requires explicit permissions for security. They do not, indeed cannot by design, inherit permissions.

The link I provided above is to an article authored by one of the staff here, an active developer himself. It explains exactly what each permission means, and why first impressions (from the description) can be misleading.
 
The statements in RED in my post above are not my assumptions. They are verbatim from the Google Play site for the APPs mentioned, on the permissions tab. Many of the Basic Apps I am talking about require similar excessive rights on Droid, but are restricted on Apple. I just checked on my wife's iPhone, and none of the permissions there identify the need to access my contact list, make phone calls without my permission, or turn on and use my camera without telling me. But alot of the Apps on Google Play that I was looking to download do.

I did look at the info in your link about permissions, but the bottom line is that a good App will notify you of the permissions it will be using. Well, the Apps are notifying us and if we want to use them, we either accept or don't use the App. That is where I am frustrated by all of the responses and failure to step up.

Again, permissions that are really needed for the App to function are okay. The permissions mentioned above are not required for any Apps I would be using, per Google Play itself. But if you accept the permissions in order to download and use the App, you give up any rights to complain. Sorry, but that is BS. The App makers should be forced to identify what they are asking for and NOT required, and the user should then be able to tailor what they want to allow or not. How many people want the camera to go on and take pictures without them knowing about it? Or grab all of their contact list info and use it, again without knowing? If the current trend continues and the industry doesn't self regulate, it will end up getting alot of help.
 
I think some permissions sound "scary" but its how the app uses these permissions thats important. I understand vigilance but tbh i dont worry much. I read reviews before installing an app and thats good enough for me. Maybe im a "sheep", maybe ignorance is bliss :)
 
I must admit I'm puzzled by the red text for network permission. What is the mechanism to allow an app to communicate via the Internet without it?
 
For the Chase bank app:

Allowance to create its own network sockets means its allowed to create its own connection. This makes the connection secure. It doesn't have to do anything with sending data. Its a bank app, so I assume its connecting to the bank's data base. You do want it to have its own network socket for security.

Camera permission, does the app have something to take pictures of bills? Then it needs it. As for confirmation, its just so the app won't ask you if you want to allow it to use the camera everytime you tap it. An example would be like Expense Manager. When I click the camera icon to take a picture of a receipt, I want the camera app to open immediately. I don't want a prompt saying "Expense manager wants to access the camera, allow it?". I want the camera to open immediately. That's what "confirmation" means.

Read contacts or call log: This I give you. I have no idea why a bank app wants to know your contacts.

For the Scottrade:

Phone calls: If the app has a button to directly call some services its going to need this permission. For example, my carrier's app has a "call customer service" button, so it needs this permission.

The main problem I see is that Google only provides a few permissions but there are a lot of specific functions that need to be addressed. I just think permissions should be made to be more specific to be more restrictive.
 
For the Chase bank app:

Allowance to create its own network sockets means its allowed to create its own connection. This makes the connection secure. It doesn't have to do anything with sending data. Its a bank app, so I assume its connecting to the bank's data base. You do want it to have its own network socket for security.

Camera permission, does the app have something to take pictures of bills? Then it needs it. As for confirmation, its just so the app won't ask you if you want to allow it to use the camera everytime you tap it. An example would be like Expense Manager. When I click the camera icon to take a picture of a receipt, I want the camera app to open immediately. I don't want a prompt saying "Expense manager wants to access the camera, allow it?". I want the camera to open immediately. That's what "confirmation" means.

Read contacts or call log: This I give you. I have no idea why a bank app wants to know your contacts.

For the Scottrade:

Phone calls: If the app has a button to directly call some services its going to need this permission. For example, my carrier's app has a "call customer service" button, so it needs this permission.

The main problem I see is that Google only provides a few permissions but there are a lot of specific functions that need to be addressed. I just think permissions should be made to be more specific to be more restrictive.
 
Good point Chan, if permission categories were more narrowed down and specific, there could be less confusion/abuse :thumbup:
 
Thanks for the replies, and yes, I agree the permissions need to be specific and describe why they are needed. I still don't see a problem with a having a window asking to accept a picture of a check. That is not something likely to occur so often that you can't process a yes answer.

In any case, acceptance of the terms is a contract and if the terms are too general, it leaves way too much room for the developer to operate within. The context is not clearly defined, so can and will be interpreted differently from each person's point of view.

I'll wait until my next contract is up to see if there are any improvements in permissions, but I want to get good use out of my phone now and refuse to sign up to the terms stated. So, I took back the Galaxy and picked up a new iPhone. Developers may get upset about how much control Apple has with their guidelines, but that is one of the reasons their Customers like them and are so loyal.
 
The main reason i love android is because its so open and modifiable and yeah that probably leaves it open to abuse but ios isnt "safe" either.
I am an android "fan boy" but i have nothing against people who make an intelligent choice to use ios so good luck mate :beer:
 
You must log in or register to reply here.
Back
Top Bottom