1

I was reading a review for a game on the play store where someone gave a bad review saying that the game looked cool but it required access to photos, media and such which encouraged the user to uninstall rapidly. The developers replied to this person saying that they valued users privacy and what not but they didn't have a choice because they needed that to actually save the progress. This totally makes sense that they would require access to internal or external memory to save.

I was reading that some games also require access to phone call so that they could pause the game when you get a call which also makes sense. But the displayed message for the user is that the app will have access to your calls, can make calls (which could cost you money) which is a red flag for some users.

I'm guessing that most games don't use permission in a malicious way but to prevent any why aren't permissions more restrictives/specific ? I'm assuming that the vast majority of games use file permission just to save and nothing else, why not make a save permission ? I also assume that having more restrictive permission might increase the number of required permission for some game which could potentially be annoying for the majority of user.

  • Or, the developer could be proactive and explain in detail the needed permissions. Some apps do this well and it seems to require little effort (see Easy Voice Recorder); the majority DO NOT, leaving the user to risk awarding the permission anyway. The additional effort, in my case, allows my feeling better about the app, the care placed into it, and the professionalism of the developer. – wbogacz Jun 20 at 13:41
  • I don't think there's an answer for this as it is too subjective. What would you consider restrictive? Eg. Would you consider an app being able to autoplay sound require to have a "sound" permission? – SSS Jun 20 at 13:43
  • @wbogacz I agree with u but for someone who is sceptic even if you, as a developpers, explain what you need in detail the reality is that in theory you could access anything on my phone so that's better of course but in no way safe. – Tapaka Jun 20 at 14:15
  • @SSS Well for example there is a permission for camera (flashlight + camera) and a flashlight permission. So at some point someone said "needing the flashlight doesn't mean you need the camera", why no one said "needing to save stuff doesn't mean you need access to every data on our users phone, thats overkill and not safe". You're right though this might be too subjective. – Tapaka Jun 20 at 14:15
3

As an Android developer, this is an especially frustrating aspect about delivering apps into mass market.

The wording on permission models have caused great grief, as you have pointed out, but it has gotten better. In fact, prior to Android 5.1.1 (API 22) apps were required to request all of their permissions up-front, at install time.

Now, permissions are generally requested when they are needed - i.e., when a protected API is accessed at runtime - allowing developers in-app time to explain their intentions.

If the developer of an application were respecting the spirit of permissions enough, their applications would, ideally, still function without being granted a particular permissions.

Obviously, if you deny a photo app access to, say, the Pictures directory, the app experience might not be stellar. However, an app should still continue to function - that is, without crashing - regardless of granted permissions.

Also, as others have pointed out in the comments, developers and publishers are encouraged to provide meaningful insight into why their app needs the permissions it is requesting.

Now, focusing on your main concern:

. . .why aren't permissions more restrictives/specific ?

They are becoming more restrictive/specific. For example, Google has introduced Scoped Directory Access.

Apps such as photo apps usually just need access to specific directories in external storage, such as the Pictures directory. Existing approaches to accessing external storage aren't designed to easily provide targeted directory access for these types of apps. For example:

  • Requesting READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE in your manifest allows access to all public directories on external storage, which might be more access than what your app needs.

Note the bullet point - relating to the game you mention, the developers could leverage scoped directory access models to fine-tune their permission requests. That, in tandem with clear and concise permission explanations, would strengthen trust for app's users.

Why haven't they, as well as many other apps out there, already utilized this feature? Well, the scoped directory APIs become available in Android 7.0 - meaning only devices running Android 7.0+ can actually use it. It is often simply a matter of prioritization for developers on whether or not to implement different behavior on different devices. Personally, I believe in doing what's best for the platform, but I digress. Feel free to reach out to the app's support channels requesting changes or deeper explanations for their permission requests.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.