Androids permission model up to lollipop is flawed in the sense of usability, and they are moving towards context driven permission request model. Let us review the current situation again:
- You as a normal user are looking for an application and after searching the google play, you finally find it.
- As happy as you can be you click install, and then there are random pages asking for things like EULA, permissions, installation mode, (random stuff huh?) we're used to clicking next, next, finish until the application's installed. (Seriously, No one ever reads those pages!)
- Once you look back, you realize that the application asked for 2 pages worth of permissions and you allowed it while you were excited about trying it out.
You may be a security conscious user (just like all of us) who cares about these things, You do see the application is asking for access to your SMS and GPS and Contacts while its functionality is as simple as a 4 digit calculator. Is there something you can do about it? NO!!!
You either have to forget about the application or just give it all the permissions.
If you haven't seen yet how this model is wrong, let me make it clear.
- You are installing the application and want to try it out so naturally you want to get everything out of your way to achieve this goal.
- You haven't installed the application yet so you don't really know what features it has and what permissions it may need.
This is not the best time to ask you to give it permissions.
Up to Lollipop:
Google Play’s permission details screen will tell you everything an app may request access to. It won’t really tell you why an app may want to access something, though.
But in Marshmallow
Apps designed for Android Marshmallow will ask you for permission the first time it wants to access something.
The more Usable implementation is to ask you to give permissions while the feature is being used. Suppose you open the skype application, try to start call and it asks you for microphone permission...seems right. Then you want to switch to a video call and it asks you for camera access.
Now if an application asks you for access to the camera out of nowhere you can decline it. And also if you're worried about skype capturing your video while its not running in the foreground you can revoke this permission and give it back when you want to make a call.
I refer you to Scott Hanselman's AWESOME Podcast with Google's Adrienne Porter Felt about Designing Usable Security at (13:00) she talks about android permission model.
A good end goal would be for people not have to think about security in order to remain secure.
The model is flawed, switch to another platform, wait for it to get fixed but meanwhile my personal advice is:
- Don't do your banking and other critical stuff on a device where a lot of random applications are installed.
- Cancel the installation if the application is not from "well known" publishers and is asking for permissions you think it doesn't need or is too much.
- If possible, contact the publisher and ask for clarifications about their applications permissions.