Imaging a messaging app. It needs permission to read and write to your text messages - not so bad.
Maybe there's a feature where you can quick-reply from the message notification. Now it needs permission to draw over other apps.
Maybe it's smart enough to not DING! during a phone call. Now it needs permission to "make and manage phone calls".
Maybe there's a feature where it suggests a "here's my location" response when somebody texts you "where are you?". Now it needs permission to access your location.
Contact integration? Camera integration? Access storage? These are all things that a messaging app might reasonably want to do. But seeing a big list of permissions, including things like "draw over other apps" and "make and manage phone calls" is scary to an end user. Especially for an app that's only supposed to be handling SMS.
OSes should allow me to create a sandbox for an app, so I can grant them access (and the app will not "break"), while still being secure.
There's another way: the app could instead use Android's Intent system to request a file chooser. This switches to a separate app which already has access to the filesystem (like the built-in Gallery app), which after the user has chosen the file, returns something which allows the original app access to just that file. This mechanism exists since the first version of Android.
If a photo management app needs access to your photos, you should be able to give it access to your photo library.
A better solution (imho) is to make the app think it has access, while in reality its access is limited to a sandbox.
Android should add the option for temporary data access. I would prefer turning on the access temporarily to send 1 photo, then turning it off a few minutes later.
https://developer.android.com/training/articles/security-tip...
See: https://developer.android.com/reference/android/Manifest.per...
If you don't mind sharing, what app are you referring to?
The file system itself should be well protected (on a non-rooted phone) as to prevent any unauthorized access to important data. Any app can only do whatever on the SD card if you give it permission to do so, but on the OS file system itself there isn't much they can do (again, on a non-rooted phone).
https://developer.android.com/training/secure-file-sharing/r...
Linux can also allow limited access to select filesystem data within a chroot() - this is done with a "bind mount."
Why these two security features were not designed around all Android apps from the beginning is beyond me.
OpenBSD is one of the best on that front, but it is a defense-in-depth mechanism, not something designed to run known-malicious code.
At least you can turn it off later.
iOS has a framework to take actions directly from notifications without requesting permission.
Maybe it's smart enough to not DING! during a phone call. Now it needs permission to "make and manage phone calls".
Or that could be provided by the operating system without needing the feature....
Maybe there's a feature where it suggests a "here's my location" response when somebody texts you "where are you?". Now it needs permission to access your location.
Fair enough.
Contact integration? Camera integration? Access storage?
Why would it need to access storage outside of its own sandbox?
To allow you to send and receive attachments.
Name any one permission, I'm pretty sure I'll find a reasonable case for it to be used in a messenger app.
However, a pretty strong case can be made that current permissions allow for way too much. For instance, I should be able to send attachment by picking them through another (OS or third-party) file picker, so that the app only gets temporary, read-only access to the selected file. Similarly, for saving attachments the app needs only a virtualized location with write access.
Then again I wouldn’t be surprised if google had botched this. They did it wrong for Google Drive apps, and as a result any app that wants to do something as outlandish as, say, opening a file requires read access to all files on your entire google drive, just to display a file picker.
Sometimes I wonder if anyone at Google actually thinks about these things, like, at all. How does this happen? What are those meetings like? Surely someone noticed? Ho do they think about “trust”? It never ceases to amaze me.
Really, the problem is that all of that gets ridiculously complicated for an average smartphone users, which makes it trivial for app developers to "bribe" users by having the app essentially tell "give us permissions or else it won't work".
I'm all for aggressively delisting applications that refuse to work when non-essential permissions were not given. Something like PlayStore GDPR, only for permissions.
The native file picker on iOS works with iCloud and third party storage providers like Dropbox, OneDrive, Google Drive, and Box. Any storage provider can integrate with it including apps that store everything locally.
There's another point in favor of requiring it. The only downside I can see is that the people who most need to be scared by it would not be.
Wouldn't it make sense to have temporary permissions? In Linux and Windows you have to sudo/admin also for one single action or a set of actions. You don't give a program access rights for eternity.
Maybe I want to use some app's location service only very rarely and I fear that it has some surveillance features integrated. If I'm ok sharing my location right now, I might not be ok sharing it always. It would be good to have the ability to give it the permission once, until a system restart, or for a limited timeframe.
The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user.
Is this available via a non-root API? There are those blackmailing applications that refuse to do their core functionality when a certain unrelated permission is denied (the hell you need my location, music streaming app!). If Android fed them generic data, they would quickly learn to detect it - but not if data is controlled by other Apps or the user himself.
The most memorable example was trying to take a picture and the camera app telling me it needed permission to make phone calls. I still can't think of a single valid reason why a camera would need to make phone calls, so I refused, and blam, no pictures for me.
Why not just allow them to disable specific perms on install and provide stubbed generic data to the app if it uses those perms?