Hacker News new | ask | show | jobs
by beninsydney 1447 days ago
It's unfortunate that regulators have largely overlooked privacy in smartphone apps amidst all the other concerns they have over such platforms.
3 comments

The permissions list on the play store was completely useless from a privacy standpoint. Even power users could to just about nothing with the info.

The situation now where you approve or reject permissions as they are used in the app is vastly better than the original android model of being shown a wall of text with the options to either give away all of your data and security or not install the app.

I used them as a signal of the developer's intentions. An app that asked for too many that I couldn't logically relate to the app's features was a red flag.

There was no reason to remove them from the store page. In general, there's no reason to remove additional information, that too info which was already hidden behind an obscure button that only a few power users ever checked. The dynamic permission model is the better runtime one but there's no good-faith justification at all to delete information about permissions. The latter is like the documentation for a feature and removing it is like hiding documentation.

The permissions list allowed you to make a better-informed decision before you download the app, even though you can't change what permissions an app requires you could shop around for apps without specific permissions. This was never incompatible with ad-hoc approving or rejecting permissions either.
This only works for utility apps which are really the minority of apps that users install. There is only one app to access my bank account, there is only one app to stream netflix on, there is only one app to access government services on.

Outside of flashlight and QR scanner apps, there is basically nothing the user can action aside from completely rejecting the wider service over some ambiguity in the permissions list.

Aside from utilities many games have lots of similar competing products where you can differentiate on permissions/ads/in-app purchases/etc: crossword puzzles, sudokus, games for younger kids like dress up or coloring in stuff.
> The permissions list on the play store was completely useless from a privacy standpoint. Even power users could to just about nothing with the info.

This is not true. I avoid apps that require unreasonable permissions. I don't expect regular users to know what is reasonable or not, but hiding this information would definitely make installation process less convenient for me. Then again, I no longer use Google Play store and I install very few apps anyway, so maybe I'm not exactly their target user.

you bet I'd never install a TODO app that needs to read my phone contacts in the past. It's not even possible to see if apps have in-app purchases anymore on Google Play.

It was only useless for you, I don't have time or KB to waste on my data plan.

I remember the situation where Google used to bundle permissions in illogical ways. it's been too long to remember specifics but it essentially meant an app had to request the ability to access unnecessary things and required the dev to explain in the release notes as to why.
Usually they weren't illogical but they were hard to understand for the user. Bluetooth scanning for example requires the location permission for example, which seems illogical until you find out that advertisers worked out they could put bluetooth beacons all over the place and track the users location by checking which beacons are in range.

So apps have to request all these scary permissions so they can do regular things. But there is really no alternative.

One example I remember is that music players used to require reading the phone status in order to be able to pause playback during a call. I think these days you can mostly get by using the audio focus APIs instead, but historically that wasn't the case.
The regulators want your data. For your protection.
GDPR applies to this.
GDPR is nowhere near enforced enough.
That is the sad truth.