Hot answers tagged permissions
18
The Chrome page in the app store says this about the new permissions:
This version requests two new permissions, Camera and Modify Audio Settings, to support WebRTC, an experimental feature under development.
WebRTC itself is designed to expose your camera and mic to the browser, so that web-apps can implement video-conferencing and other multimedia ...
15
No. Without a custom ROM it's an all-or-nothing affair. Which is part of the reason Google encourages developers to ensure that they're asking for the absolute minimum permissions required for the app to work.
Short of getting the app code and modifying it, you either need to accept the access request or not use the app.
15
Usually apps require internet access for ads, analytical data, or for sending bug reports/stack traces back to the developer.
Other reasons might include using Google's licensing servers to validate legitimate copies of apps with Android market purchases (Google's licensing servers use the CHECK_LICENSE permission). Similarly, some developers produce their ...
14
Once upon a time, there is a walled city with a large, closed gate bound by magical lock that can only be opened with a magical sword. According to the cityfolk's traditions, anyone who brings the magic sword and unlocked the magical gate is destined to be the lord of the city.
One day, a young hero comes to the city, bringing with him the magical sword he ...
13
Whisper Systems has come out with a custom ROM that has this exact feature: http://www.whispersys.com/permissions.html. As DarthNoodles mentions, it has to be done at the system level rather than the app level, which is how it is implemented in WhisperCore. The current version isn't able to block all of the permissions available on Android, but they are ...
12
Think about the scope of the app. If the app is a tipping calculator, then does it really need access to your phone contacts?
But don't fret over all permissions. A lot of apps ask for internet access and may not seem like they need it. This is usually for advertisements or for sending remote tracelogs to the developer.
Read what other people are ...
11
CyanogenMod 7 supports this. It activated by going to Settings->CyanogenMod Settings->Applications and checking "Permission management" as of the most recent build. You can then allow and disallow permissions by choosing an app from the app management list (Settings->Applications->Manage applications). There is an article on endgaget with a ...
11
In short, GitHub is using the internal Account System manager to store your GitHub credentials. This works the exact same was as adding a Google account or an Exchange account. Essentially, you are logging in with your credentials and they are stored in the Account Manager, which prevents you from having to re-enter these credentials again in the future.
...
10
Use market applications like Permission Watchdog or Permissions. Also, there are several others.
10
The permissions are entered by the developer, yes. But the Android OS only grants those specific permissions, and no others. Therefore an app could try to do something it wasn't allowed to, but it would fail (barring a security exploit). See http://developer.android.com/guide/topics/security/security.html#permissions for more details.
10
There is always the possibility of a vulnerability in some app that could cause your computer/phone to be hacked. Browsers are notorious for having bugs that allow the computer to be infected with a virus simply by viewing a page. In fact, one method to jailbreak an early Apple iOS device was to simply browse to a page that delivered a payload via a bug in ...
9
CyanogenMod 7.1 has exactly this feature, but without faking data, only failing, if the app accesses the API. Proposition for faking the IMEI was rejected. Faking other data, like contacts, is currently under discussion.
9
As Goggles is an app that you've said you're curious about, here are the permissions it asks for(copied from the Market web page):
This application has access to the following:
Your accounts
Google App Engine
Allows applications to sign in to Google App Engine using the account(s)
stored on this phone.
access other Google services
Allows ...
8
How it currently CAN be done
During my morning routine reading my RSS feeds, I stumbled on a review at N-Droid, discussing an app named APEFS. This app is developed by German students (hence its description on the Playstore is in German, even if you set the language to English). But for our non-German readers, a short description here:
Basically, APEFS is ...
7
Not an absolute solution to your problem, but there is an app in the android market which caters to your needs. It also necessarily requires better knowledge about permissions and also a rooted device.
Permissions Denied is an app which allows you to effectively control the permissions that apps which are installed onto your phone, via the market or some ...
7
Android apps can only send SMS if they have the SEND_SMS permission, there are a few permission viewers on the market:
S2 Permission Checker
Permission Viewer
to prevent installing rogue applications, you might want to be more cautious when installing applications and check their permissions they required before installing. If you install apps from the ...
6
SD cards generally use the FAT file system, which does not allow for filesystem permissions. This means that the Android OS would have to manage a custom list of files, their permissions, a mapping of apps to files/folders, etc. in order to prevent apps from accessing the whole card. This would be a terrible mess. Not only complicated, but it would ...
6
Google does do occasional audits. There were apparently some wallpaper apps recently that were doing nefarious stuff and were pulled from the Market and any phones they'd been installed on.
It's imperative that users pay attention to the permissions that are being requested (Why would a wallpaper need to know "Phone state" or my Contacts?) and simply not ...
6
There is a Privacy Blocker (paid) and Privacy Inspector (free) applications. Privacy Blocker does a static analysis of applications for sensitive API calls and rewrites these calls into stub ones which return fake data. As a result a new .apk with rewritten application is generated and installed. Privacy Inspector is an app which only reports the use of ...
6
There is an App Shield application. It essentially repackages .apk with permissions removed from manifest. Brilliant idea for stock, non rooted phones. Subject to crashes (force closes), though, as with current CyanogenMod approach.
6
Many ad publishers use this permission to get the Phone ID for all sorts of tracking purposes. There are other ways to get a unique ID, but unfortunately they are buggy in older Android versions (the story is more complicated, see e.g. http://stackoverflow.com/questions/2785485/is-there-a-unique-android-device-id or ...
6
I agree with the other answers given, but want to give a developer's perspective. It's important to look at permissions, but it's important not to assume malicious intent on the part of developers, as way more often than not, the permission is necessary, or used for helpful things that aren't apparent (like the log reporting that Bryan mentioned). There are ...
6
If have to disagree with Sparx, if you change the CPU frequency via the supported methods that every modern CPU provides, changing it, even in a fast sequence, doesn't affect stability. I would even rule out hardware damage, because of the sophisticated security mechanisms in modern CPUs (overheat protection, etc.).
Why can only root set the frequency and ...
6
Why currently this can't be done
When a developer performs the upload of his application to Google Play, the application manifest file gets read to a database, from where the search for apps is performed.
To allow searching for applications based on their permissions, one would have to access the database and collect data that concerns the ...
6
Your app doesn't do Oauth/OpenId, instead it uses Android's integrated auth model via a special permission:
YOUR ACCOUNTS
USE THE AUTHENTICATION CREDENTIALS OF AN ACCOUNT
Allows the app to request authentication tokens.
ColorNote, for example, doesn't need this permission and thus must get an auth token via the browser. It ends up in the list in the link ...
6
LBE works on JellyBean -- just not the version you install from the Playstore. The boot-loop problem is a known issue (so nobody can understand why the developer did not even place a note on the app's playstore page).
On XDA you can find multiple threads discussing this issue, and at least one of them also holds modified versions of LBE to download. Take ...
5
Security
Consider whether each app will really need the feature, and how your personal privacy could be potentially compromised by a subversive app. If an app requires a username and password, and it requires internet access, is it trustworthy? Most apps are going to be on the up-and-up, but if you are trying something new from an unknown source, be ...
5
Which actual files delegate
permissions?
There is typically a "superuser" application that is included in rooting processes. This application is the gatekeeper/controller of which applications get root access. Any time an application asks for root access, this application will pop up and ask you to either approve or deny the request.
Are all ...
Only top voted, non community-wiki answers of a minimum length are eligible
