1

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a simple app about snow plowing schedules would need any of these. I'm fairly new to android but I have installed a bunch of apps and have never been warned like this. The app is https://www.stpaul.gov/departments/public-works/street-maintenance/snow-emergency-information/saint-paul-winter-snow

I checked out http://lifehacker.com/5991099/why-does-this-android-app-need-so-many-permissions and the upshot of articles like this is: track each permission to an actual feature of the app. This app doesn't seem to have a feature that would require access to accounts. My question is: how to proceed?

a) take it under advisement and use the app.

b) avoid this app

c) make a scene, contact the city and demand answers.

I'm asking because I truly don't know if this is just something we live with? are these warnings so common that I will become enured to them?

Improve this question
2
  • 1
    As a long time android user, that's really unusual. When an app asks for permissions that it should not need, I simply do not install. I would also send a note to the city regarding your decision to not install it.
    – schroeder ♦
    Commented Feb 2, 2016 at 23:18
  • 1
    We had a similar issue with our app. A lot of request permissions it didn't need which really rubbed our customers the wrong way. Yet the app had no functionality to take advantage of those permissions. Turns out a dev accidentally declared them in the manifest file. To no surprise after a bit of investigating we found out he was really under experienced for the job. And included it as part as a tutorial he was following. I wouldn't make a scene. But I would let them know to look into it. developer.android.com/guide/topics/manifest/…
    – Bacon Brad
    Commented Feb 2, 2016 at 23:30

1 Answer 1

Reset to default
2

Androids permission model up to lollipop is flawed in the sense of usability, and they are moving towards context driven permission request model. Let us review the current situation again:

  1. You as a normal user are looking for an application and after searching the google play, you finally find it.
  2. As happy as you can be you click install, and then there are random pages asking for things like EULA, permissions, installation mode, (random stuff huh?) we're used to clicking next, next, finish until the application's installed. (Seriously, No one ever reads those pages!)
  3. Once you look back, you realize that the application asked for 2 pages worth of permissions and you allowed it while you were excited about trying it out.

OR

You may be a security conscious user (just like all of us) who cares about these things, You do see the application is asking for access to your SMS and GPS and Contacts while its functionality is as simple as a 4 digit calculator. Is there something you can do about it? NO!!!

You either have to forget about the application or just give it all the permissions.

If you haven't seen yet how this model is wrong, let me make it clear.

  • You are installing the application and want to try it out so naturally you want to get everything out of your way to achieve this goal.
  • You haven't installed the application yet so you don't really know what features it has and what permissions it may need.

This is not the best time to ask you to give it permissions.

Up to Lollipop:

Google Play’s permission details screen will tell you everything an app may request access to. It won’t really tell you why an app may want to access something, though.

But in Marshmallow

Apps designed for Android Marshmallow will ask you for permission the first time it wants to access something.

The more Usable implementation is to ask you to give permissions while the feature is being used. Suppose you open the skype application, try to start call and it asks you for microphone permission...seems right. Then you want to switch to a video call and it asks you for camera access.

Now if an application asks you for access to the camera out of nowhere you can decline it. And also if you're worried about skype capturing your video while its not running in the foreground you can revoke this permission and give it back when you want to make a call.

I refer you to Scott Hanselman's AWESOME Podcast with Google's Adrienne Porter Felt about Designing Usable Security at (13:00) she talks about android permission model.

A good end goal would be for people not have to think about security in order to remain secure.

tl;dr

The model is flawed, switch to another platform, wait for it to get fixed but meanwhile my personal advice is:

  • Don't do your banking and other critical stuff on a device where a lot of random applications are installed.
  • Cancel the installation if the application is not from "well known" publishers and is asking for permissions you think it doesn't need or is too much.
  • If possible, contact the publisher and ask for clarifications about their applications permissions.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .