<story><title>Hey Paypal, why do you need access to my microphone, camera and photos?</title><url>http://thepcspy.com/read/paypal-permissions-microphone-camera-photos/</url></story><parent_chain><item><author>jessaustin</author><text>This is great stuff. I kind of wish they would hire you to run this. Another idea I&amp;#x27;ve had would be for the user to be able to install an app without giving it the perms it &amp;quot;requires&amp;quot; (perhaps by unchecking some boxes in the dialog). Then apps would be responsible for handling a &amp;quot;no you can&amp;#x27;t see the contact DB&amp;quot; API response. Or they could crash I guess. The point is that users could effectively renegotiate with apps, e.g. &amp;quot;yes I&amp;#x27;d like to use NFC to pay, no I don&amp;#x27;t want you to be able to record everything that&amp;#x27;s going on around my phone&amp;quot;.</text></item><item><author>Someone1234</author><text>As a long term Android user and a mostly happy one at that, let me just say that Android&amp;#x27;s permissions are terrible and basically not fit for purpose.&lt;p&gt;I&amp;#x27;m going to ignore third party solutions that require root, because those aren&amp;#x27;t part of the equation for 95%+ of Android users.&lt;p&gt;Android should have three levels of permissions: Implied (i.e. all apps get these), explicit (at installation), and prompted (user is asked at runtime).&lt;p&gt;- Implied (&amp;quot;freebies&amp;quot;): internet connectivity, store data, get a unique device ID (per app?), store the app&amp;#x27;s own accounts within the accounts API.&lt;p&gt;- Explicit (installation): Run in background, use GPS, use the camera, use the microphone, etc.&lt;p&gt;- Prompted (&amp;quot;personal information&amp;quot;&amp;#x2F;&amp;quot;cost you money&amp;quot;): Access your cellphone number, access your contact list, access your calendar, access your email, read&amp;#x2F;send texts, make calls, etc.&lt;p&gt;Users in the current Android ecosystem learn to ignore permissions pretty quick as most are for trivial stuff (e.g. internet access, store data on the SD card, store an account, etc).&lt;p&gt;Worse still a lot of users will skip apps that ask for too many permissions which is bad for both the app developer AND users. Most developers want to offer functionality (e.g. share to contacts) but don&amp;#x27;t want to do so at the cost of losing users (&amp;quot;Why is this asking to see my contact list?&amp;quot;).&lt;p&gt;Android needs to drop a bunch of &amp;quot;silly&amp;quot; permissions that have no inherent cost to the user. They&amp;#x27;re clearly created by an engineer who just wanted to slap permissions on every kind of API for no good reason. It benefits nobody.&lt;p&gt;They then need to take permissions which have a cost (either literally or to user privacy) and set them up rationally so they&amp;#x27;re either something you get when installing OR something you&amp;#x27;ll be prompted for.&lt;p&gt;Lastly Android needs to add a description field to the permissions manifest where the developer can put in a short explanation for why they need permission XYZ. Limit it to 128 characters if you wish. The app store can display these.&lt;p&gt;I install less apps on Android largely because many ask for too many permissions. If Google makes it really easy for me to protect my personal information (e.g. prompts) I&amp;#x27;ll literally spend more money on their store because I&amp;#x27;ll feel more safe to do so. As a developer I&amp;#x27;ll also offer more functionality to my apps as there is no permission &amp;quot;cost.&amp;quot;</text></item></parent_chain><comment><author>TheLoneWolfling</author><text>Actually, you&amp;#x27;d want three settings:&lt;p&gt;Yes, No, and spoof. Otherwise far too many apps would just go &amp;quot;I won&amp;#x27;t work until you enable the settings I ask for&amp;quot; - and then we&amp;#x27;re right back at the current situation.</text></comment>
<story><title>Hey Paypal, why do you need access to my microphone, camera and photos?</title><url>http://thepcspy.com/read/paypal-permissions-microphone-camera-photos/</url></story><parent_chain><item><author>jessaustin</author><text>This is great stuff. I kind of wish they would hire you to run this. Another idea I&amp;#x27;ve had would be for the user to be able to install an app without giving it the perms it &amp;quot;requires&amp;quot; (perhaps by unchecking some boxes in the dialog). Then apps would be responsible for handling a &amp;quot;no you can&amp;#x27;t see the contact DB&amp;quot; API response. Or they could crash I guess. The point is that users could effectively renegotiate with apps, e.g. &amp;quot;yes I&amp;#x27;d like to use NFC to pay, no I don&amp;#x27;t want you to be able to record everything that&amp;#x27;s going on around my phone&amp;quot;.</text></item><item><author>Someone1234</author><text>As a long term Android user and a mostly happy one at that, let me just say that Android&amp;#x27;s permissions are terrible and basically not fit for purpose.&lt;p&gt;I&amp;#x27;m going to ignore third party solutions that require root, because those aren&amp;#x27;t part of the equation for 95%+ of Android users.&lt;p&gt;Android should have three levels of permissions: Implied (i.e. all apps get these), explicit (at installation), and prompted (user is asked at runtime).&lt;p&gt;- Implied (&amp;quot;freebies&amp;quot;): internet connectivity, store data, get a unique device ID (per app?), store the app&amp;#x27;s own accounts within the accounts API.&lt;p&gt;- Explicit (installation): Run in background, use GPS, use the camera, use the microphone, etc.&lt;p&gt;- Prompted (&amp;quot;personal information&amp;quot;&amp;#x2F;&amp;quot;cost you money&amp;quot;): Access your cellphone number, access your contact list, access your calendar, access your email, read&amp;#x2F;send texts, make calls, etc.&lt;p&gt;Users in the current Android ecosystem learn to ignore permissions pretty quick as most are for trivial stuff (e.g. internet access, store data on the SD card, store an account, etc).&lt;p&gt;Worse still a lot of users will skip apps that ask for too many permissions which is bad for both the app developer AND users. Most developers want to offer functionality (e.g. share to contacts) but don&amp;#x27;t want to do so at the cost of losing users (&amp;quot;Why is this asking to see my contact list?&amp;quot;).&lt;p&gt;Android needs to drop a bunch of &amp;quot;silly&amp;quot; permissions that have no inherent cost to the user. They&amp;#x27;re clearly created by an engineer who just wanted to slap permissions on every kind of API for no good reason. It benefits nobody.&lt;p&gt;They then need to take permissions which have a cost (either literally or to user privacy) and set them up rationally so they&amp;#x27;re either something you get when installing OR something you&amp;#x27;ll be prompted for.&lt;p&gt;Lastly Android needs to add a description field to the permissions manifest where the developer can put in a short explanation for why they need permission XYZ. Limit it to 128 characters if you wish. The app store can display these.&lt;p&gt;I install less apps on Android largely because many ask for too many permissions. If Google makes it really easy for me to protect my personal information (e.g. prompts) I&amp;#x27;ll literally spend more money on their store because I&amp;#x27;ll feel more safe to do so. As a developer I&amp;#x27;ll also offer more functionality to my apps as there is no permission &amp;quot;cost.&amp;quot;</text></item></parent_chain><comment><author>ptaffs</author><text>i completely agree. to avoid crashes the OS could return innocuous zeros, for example, the contacts has no entries, silence on the mic, zero for location, no connection on a network interface. To level the playing field, the vendor should be able to know i declined the request and not provide me the software, that&amp;#x27;s if their business model is based on advertising or data collection defeated by my choice.</text></comment>