Android's Permissions Gap

[elsiegee40]

Interesting article from the Guardian. Having uninstalled the facebook app myself ( http://www.edugeek.net/forums/e-safety/129237-facebook-app-privacy-changes.html) from my android tablet as I didn't like what I saw, this has made me start to rethink my next phone which was going to be android replacing iPhone, but may not be now. I want the choice over what has access to my stuff!

 

Android's permissions gap: why has it fallen so far behind Apple's iOS? | Technology | theguardian.com

Edited December 26, 2013 by elsiegee40

[john]

You could always move to the "dark" side and enjoy a nice Windows phone

[Arthur]

I want the choice over what has access to my stuff!

You could install App Ops X (which still works on 4.4.2 because it includes its own version of App Ops) or XPrivacy. As mentioned in the article, there's also the Privacy Guard app in CyanogenMod (and other CM-based ROMs).

 

Having uninstalled the Facebook app myself from my Android tablet as I didn't like what I saw

Google clearly has some work to do, because as your thread regarding the Facebook app demonstrates, most users don't fully understand what the permissions are for and consequently overreact; and app developers can't be more explicit with the permissions they need.

 

Why is the Facebook app requesting permission to access features on my Android?

If you install the Facebook app on your Android, your phone or tablet should let you know that the app is asking for your permission to access information or use features from your Android. Almost all apps need certain permissions to run on Android, and we use these permissions to run features in the app. Keep in mind that Android controls the way the permissions are named, and the way they’re named doesn’t necessarily reflect the way the Facebook app uses them.

 

We realize that some of these permissions sound scary, so we’d like to provide more info about how we use them. Below, you'll find a list of some of the permissions we request for the Facebook app, as well as an example of how we use each one. Keep in mind that this list doesn't include all of the Android permissions we request or all of our uses of those permissions. (Source)

 

I work at Facebook, more specifically, I've spent a considerable chunk of my time working on our Android app and the Android permissions we request. (I also worked on that same problem before I joined Facebook).

 

The description that includes the words "send emails ... without owners knowledge" comes from Android itself and applies to the WRITE_CALENDAR permission. This permission is needed by any application that wants to create a calendar feed in the unified Android calendar storage, and create/modify events in it.

 

In particular, the Facebook app would like to give you the option to import your Facebook events (that you created or you were invited by your friends to) so that you can see them side-by-side with your other calendars like Google Calendar, corporate Exchange accounts and so on. The rationale for this is that it will make the planning of your day easier as you will be able to see all your agendas at the same time.

 

Unfortunately, the way this specific Android permission works is that it also allows apps that create or modify an event to send event invites and updates to the attendees by email automatically using the your email account on the device. We don't need to do this, as we have other channels of communication with all the attendees of Facebook events - we have the email they provided to us when creating their Facebook accounts, we can directly update the event in their feed, we can send them a push notification in their app, we can send them an SMS from our system if they have given us their phone number. However, there is no way for us to explain this to Android and to exclude that specific functionality from the permission.

 

As for the READ_SMS permission, we require that so we can automatically intercept login approvals SMS messages for people that have turned 2-factor authentication for their accounts, or for phone confirmation messages when you add a phone number to your Facebook account. Unfortunately, the Android permissions system does not allow us to specify that we would like to be able to read only SMS messages from a specific number (plus that wouldn't scale well because the list of numbers varies per country, but that's a separate issue).

 

It's also worth noting that we would love to be able to ask only for the permissions we need for the specific features particular users use. For example if you don't use Facebook events or you don't want to see them in your device calendar we would prefer to not request the WRITE_CALENDAR calendar; or if you don't have login approvals and don't add a phone number, we don't ask for READ_SMS. However, Android does not allow permission requests on demand; we have to request all permissions that cover each feature at install time, and the users can only grant or deny all of them and have no control over individual permissions. (Source).

[MordyT]

Additional privacy programs...

 

Xposed AppOPs brings back app ops on 4.4.2

 

LBE privacy guard.