2

I'm pretty paranoid with the android apps and if I think an app requires too much, unnecessary permissions, I simply don't install the app. However, I feel like I'm missing out lately.

For example, I prefer to use browser for facebook, and I refuse to update my twitter client that requires excessive permissions.

So how can I distinguish a possibly malicious application from a decent application that requires lots of permissions? When am I safe and when should I be suspicious installing an app?

4

Well, there's a lot of questions in one. Let's handle a few:

If your concern is major applications, such as Facebook, Twitter, etc., from major publishers and services, then as long as you're downloading updates from the Play Store, there's no reason to assume you're downloading a possible malicious application. The apps are all digitally signed and scanned by Google. While malware HAS gotten onto the Play Store, it doesn't get on there as updates to major, legitimate apps. It ends up on there as its own unique app from shady publishers, or updates to apps that got sold to a new publisher, etc. If a major app like Twitter or Facebook wants a new permission, you can feel confident it's for a feature and not malicious.

What that doesn't tell you is whether or not you're comfortable feeling paranoid about how that major publisher intends to use that permission. Some people strongly distrust Facebook, and are unwilling to hand those sorts of permissions to them, even though the app isn't strictly malicious, as it's the company they have an issue with. That's more of a personal judgment call than anything else.

The other priority is to familiarize yourself with what the permissions actually mean (here's a good place to do that from Google), and get a basic understanding of how apps actually function. Some sound scary until you understand why they're necessary. An example was someone I found upset over a keyboard app requiring permission to monitor everything they type, oblivious to the fact that without that permission, it couldn't function as a keyboard. Understanding how apps need to communicate over the network, or be aware of incoming call status in order to pause a game, or being able to review contacts in order to try to suggest new friends based on people you know, or needing access to the camera because they can take photo notes or do video chat, etc., will help you parse which permissions fit within the mission of the app and which ones seem like a stretch to possible data-mining. Google's descriptions tend to focus on the worst-possible scenarios because they have to allow for them. But dialing back and recognizing that, yes, this permission does allow for scenario Z, but it's also the only way they can do scenario A, which is right in line with the goal of the app, will help you figure out when you're being a little paranoid.

  • 1
    Very nice sum-up, +1 for that! As for "familiarizing with permissions and what they mean", may I suggest an additional resource? (Disclosure: That's my site I've set up a.o. to cover for the off-topic "is there an app for X" questions from here :) – Izzy Feb 6 '15 at 17:53
  • Great list. One thing I'd like to see is real-world examples given how how these permissions are used by legitimate apps, possibly in non-obvious ways. Although that might be outside of the scope of your site. – TurboFool Feb 6 '15 at 18:32
  • Not fully beyond it, I could do so in some article (given I find the time). Something like Why do some apps request too many permissions? This article partly covers that when discussing READ_PHONE_STATE (see also Why do so many applications require permission to read the phone state and identity?) – Izzy Feb 6 '15 at 19:19
  • Exactly, yes. Something that helps a user understand real-world needs for some of the more arcane, or seemingly heavy permissions. – TurboFool Feb 6 '15 at 21:43
  • Trouble is, there are too many permissions to take care for – and as the article mentioned in my last comment points out, many of them are not well documented (or documented at all). I partly tried that with the "good cop – bad cop" model. Maybe I should start trying that on the whole list from my first comment – wherever it's possible at all, that is. Still, a hard thing to do for someone who's not a developer (and thus no knowledge of which methods are protected by what permission) … – Izzy Feb 6 '15 at 21:51
0

Be suspicious when the app requires an permission that is not related to what app offer especially things like send SMS/MMS or do calls and be very suspicious if is anything related to things like "show alerts as system level" or "modify global settings" or "interact between users" and be extremely cautios and suspicious about the permission "download files without notification" (like google+).

About the major apps and company's i will say only that they indeed have privacy issues so is all about you feeling ok with that or not , like i don't have facebook at all but you using it on your mobile browser is no different from using their app except that an app give then more access to your system to abuse but your mobile browser already leaks enough data to track and identify you especially if you use chrome mobile and accepts their cookies and most pages today have the nasty facebook widget to track you too if you don't block them so its all about what you choose (to use them or not)

And if you download apks from Internet be extremely careful and download then directly from the their official site or xda-developers and in a connection you believe you are not in danger of man in the middle attacks if you want scan it a good AV can detect some androids malware already ( virustotal will say you that apks that do root have rootkit already)

Obs: The permissioms may look different on your phone but the meaning should be the same

  • Good advice. One thing I'd say about those permissions that seem unrelated to what the app offers: sometimes it's not obvious what the use for the permission is. Facebook Messenger was a good example, with people genuinely clueless why it needed SMS permissions, call permissions, etc., unaware that it optionally could be used AS your SMS app, make calls, and so on. Features that can be used optionally have to have permissions for those features, even if you don't use them. Some apps use SMS for automatically verifying multifactor authentication, or licensing. So needs can be non-obvious. – TurboFool Feb 6 '15 at 18:37
  • Atlassian Confluence requires the "download files without notification" permission. Just noticed this tonight. See comment timestamp for reference on the day / approx time that it required that permission in case they nix it. I found your comment after a search for that specific one, since I hadn't seen it before. Thanks for the tip. – groovenectar Jul 30 at 6:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.