Hi, I just have a suggestion for the management of the rights for applications in Google Play for android. I am not sure it is the right place, but it is the most adapted regarding what I have found available. If it should be somewhere else, please tell me.
Many times we find apps which need rights for reasons that we do not know (e.g. an offline game which ask to access the Web or which need contact info). The point is that it is trivial that some apps need these rights (an online game without Web access or a contact manager without contact info would be quite useless), while others should clearly not need it, and obviously there is also the full range of "need it sometime, under certain circumstances" in between. Consequently, no rights is intrinsically "good" or "bad", so we cannot judge an app regarding the rights it requests. So we need to go further in details in the reading to know if it actually needs it or not. But we cannot go too far with the current system: once we know that the contact manager app need also to access internet while nothing is said in the description why it should do so, should we consider to forget this app because it asks something we think it should not? Then a lot of apps would be dropped, including good ones, so it is too much restrictive. Should we ignore this Web access and just take the app? Well, then do not look at the rights from the start and accept everything, but regarding the privacy... The problem here is that the user cannot go further. Maybe the app just need to access the Web to import contact info from a website? Then it would be useful if we want to use this feature. But what if it actually share regularly some personal information that we do not want it to share? We cannot go in the code to know that, while this is the only solution if the description does not provide any info about that (supposing we trust in it). Actually, the point is that a lot of rights are justified for a ponctual use (e.g. the contact manager which import a list of contacts from a website), not continuously. But the user does not have any control on that. It would be nice to have the possibility to grant some rights automatically (as it does now) and others only with manual acceptance, for instance displaying a message like "The app A need the following rights to perform the action B: access the Web, contact info. Do you allow it? Yes/No". With that, we can identify when the "not obvious" rights are used and decide if the app should be kept or dropped. We could have the auto-accept by default (usual behaviour) and for people who look at the details, let them switch to the manual-accept for each right. This way, no burden is added by default to the user, who decides when the extra effort should be spent. Of course this is not enough to have a deep control on this kind of thing, but at least it seems to me that it does not increase the burden on the user by default, so he cannot complains, while it provides a deeper control on the app rights management. What could be criticized is more regarding the app developers, who want to ensure they have the rights and not let the user do it manually (I will not ask why, let assume there is good reason for that). In such a case, maybe add an attribute in the manifest to say that, for a given permission, auto must be ensured, so the app does not install if the user does not accept to grant an auto access on this right. I think that this way we consider more or less everyone, keeping the possibility for the developers to force the same behavior that what we have now and providing more control to the user without adding any burden. Then, the problem could come from intermediaries, but I do not have information on this point. -- You received this message because you are subscribed to the Google Groups "Android Security Discussions" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/android-security-discuss?hl=en. For more options, visit https://groups.google.com/groups/opt_out.
