[Groxx]

While it is much less of a concern with runtime permissions that are optional.... yeah, I greatly dislike this too.

In particular because not everything is a runtime permission. E.g. I like to know that [apk X] has no internet or file permissions at all - it rules out nearly all practical ways to leak your information. And google just keeps taking more and more steps to hide that information from me.

[chias]

My biggest pet peeve is optional runtime permissions that are not optional.

I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again.

I have yet to find any geolocation functionality in the app.

EDIT: Please see epukaza's comment below. There is a legitimate reason for this permission, which his comment explains.

[epukaza]

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

[unglaublich]

With the proper permission set (neverForLocation), the OS shouldn't ask for geo-location permission. So the app seems malconfigured, or it's actually doing something with the Bluetooth beacons that it can't do otherwise.

https://developer.android.com/guide/topics/connectivity/blue...

[xyzzy123]

That permission is pretty new, so the app might not have been updated for it.

[gene91]

What you said sounds plausible and I believe it.

Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

[dlsa]

Trust is earnt. I can reasonably have a default level of low trust for practically any app. This isn’t some blind anger stance. Its not blanket mistrust or some kind of ignorance. It is healthy scepticism. Totally reasonable in today's environment.

Plenty of app developers have muddied the water enough that apps should have a lower level of trust given to them. Stealing data is a reasonable fear now. It is not reasonable to assert otherwise.

It is therefore reasonable for a person to wonder why geolocation is requested but then be suspicious why it doesn't seem to need it. Regardless of the underlying technical reason. Those technical reasons are part of informed consent. If I don't have informed consent, do I really have consent?

Its also not a sad state at all. Its healthy. Its part of the modern landscape that someone can be suspicious and rightly so. If not, you're setting people up for misfortune. Is there some reason you want people to blindly trust like this? That seems almost abusive to me.

[wakeupcall]

I don't know about others, but thanks to a combination of protocols, google and law-enforcement my trust on phones and anything connected to it is basically zero, despite being quite secure on a technical level.

[Schroedingersat]

> Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

This is almost all apps. Your default assumption should be that anything on the big app stores is being as malicious as they can get away with -- especially if it is a forced install leveraging some product you have already purchased that could easily be sent over a standard protocol.

[hansvm]

The Canon printer configuration app has the same sort of soft geo-permission lock. Sniff the network traffic right as you enable it, and you'll see your data happily find its way to their servers.

_Maybe_ the app is fine, but in the cases I've checked big corporations abusing your privacy is the norm.

[mrjin]

Trust is earned not granted. You don't trust a random stranger walks by, why should anyone trust apps created by some random organizations? Especially given some calculator and similar apps came with a privacy statement, how much trust do you believe we should have in apps on our phones?

[Sakos]

It's sad that so many apps can't be trusted, leading to a lack of trust in apps in general. But that's not our problem.

[chias]

I could not agree more.

[chias]

Ah, that would make sense. It is indeed a bluetooth connection and it scans for any nearby devices. Thank you for clarifying that, I appreciate it, and I feel a lot better about the app!

[tlavoie]

Can you tell if that's all it does? I don't know what all geolocation covers in Android terms, but it would certainly be a superset of just scanning for BlueTooth.

I would be curious if it does any or all of:

- Fetching GPS coordinates, which are typically to many decimal places. - Making API requests to external servers that you don't own.

A tool like MobSF (https://mobsf.github.io) might be very enlightening to understand what a given app does, or at least can do. I've tinkered a bit with an iOS app in it, but not Android so far.

Also, proxying your device through Burp Suite or ZAP could also be interesting to see what traffic occurs, especially if the developers weren't picky about valid TLS certificates.

[nybble41]

> The app needs the geolocation permission to access the bluetooth radio and scan for devices.

Sure, but why does the app need to be able to scan for any and all Bluetooth devices? There should be an entry in the manifest describing the kind(s) of devices the app wants to interact with, and only those devices should appear in the scan. Naturally the list would need to be reviewed to verify that the selected devices are related to the app, and presented to the user in the app store along with all other requested permissions.

In this particular case the same company designed both the app and the device it's connecting to, so for all we know the device could have an embedded GPS receiver to provide the app with much more detailed location information than it could get from Bluetooth alone. It could also just relay its own Bluetooth scan results. However, the app at least couldn't easily get location data from Bluetooth scans when the device isn't in range.

[MrDresden]

This permission structure has now been split up in latest versions of Android to avoid this kinds of confusion.

[dlsa]

The fact you couldn't find that reason yourself implies you could not have made an informed choice. You were effectively compelled. That isn’t permission consent. That was permission coercion. Being forced to consent isn't ethical.

[UkrainianJew]

They obviously want to collect the "CO2 readings at location" data and sell it to the highest bidder.

Why do they refuse to opt you out of being an unpaid drone generating $0.02 worth of data for them after you paid them $250? Because they can, since we don't have any laws forbidding it.

[covermydonkey]

A colleague of mine discovered his air monitoring device companion app was uploading to their website along with a map pin on his precise address. He wasn't too happy about that

[aaaaaaaaata]

"This dirtbag cares about the quality of his air! Get him!"

[aendruk]

At the risk of getting off topic… For anyone now curious about CO₂ monitors, I’ve been running an imitation of this setup and have no complaints:

https://github.com/larsp/co2monitor

Adafruit’s SCD-30 is also nice and pairs well with a Pi Zero W.

[wonderbore]

The geolocation information is not for you, it’s just sent along the rest of your information.

[bscphil]

> E.g. I like to know that [apk X] has no internet

As far as I know (please correct if this is wrong), there's no such thing as an app with no Internet permissions. All apps can access the Internet without permission, and only additional uses of the Internet (e.g. seeing your WiFi AP name) require special permission.

AFAIK the "Internet" permission many apps requested was actually for this more advanced usage - just to hit a REST endpoint or something required no permission at all.

[daveoc64]

The internet permission is separate, and without it an app can't connect to the network:

https://developer.android.com/reference/android/Manifest.per...

It's so commonly requested though, that virtually every app does have it.

[Groxx]

(extremely) commonly requested, and granted implicitly for I-don't-know-how-long-but-it-is-a-long-time.

But for quite a while you could still read the permissions list in the play store, and see if it used it. And adding the permission would still give you a warning on upgrade (outside the play store anyway). Both of those (I believe) are gone nowadays.

It's obviously going to be requested by most, but its absence can be extremely relevant, e.g. https://play.google.com/store/apps/details?id=keepass2androi...

[mdp2021]

> please correct if this is wrong

It is wrong. Internet permission is made of INTERNET and ACCESS_NETWORK_STATE, which are "normal"-level permissions to be specified in the Manifest. Without them, no Internet. Correctly: there are plentiful applications that do not need it.

[toast0]

Google play stopped showing the internet permission ages ago, but it exists.