teach a tech-savvy person to use a "smart" telephone

January 4, 2018 8:43 PM

I just got my first "smart" telephone this year, and I'm completely baffled by the permissions. Is there an explanation of Android permissions written for a security and privacy conscious, technologically literate audience?

Sometimes I don't understand what the permissions mean. For example, the "Contacts" application needs "Storage" permission in order to save a new telephone number. This seemed reasonable until I noticed that the "QuickMemo+" application could store new notes without the "Storage" permission. So I guess "Storage" means something other than being able to write to the file system?

Sometimes the permissions seem too coarse-grained. For example, it'd be nice if the "Voice Recorder" application could only access my microphone when I had it open on my screen. Instead, I can only grant or deny it the access. So I granted it, and now I think it's allowed to run in the background and eavesdrop on all my conversations.

Sometimes, the permissions seem unrelated to the operation at hand. In order to store a new telephone number in the "Contacts" application, I need to grant it the "Calendar" permission. In order to browse for new applications to install, the "Google Play Store" wants the "Phone", "Text", and "Contacts" permissions. What?

I'm looking for two things:

1. An explanation of Android permissions that is neither an API reference for developers nor completely dumbed down.
2. Some guidance on how to make the inevitable compromises, assuming I care about security and privacy but also want to send email from my telephone.

Hope me, please?

posted by d. z. wang to Technology (5 answers total)

Android Apps all get their own individual storage areas which are sealed off from each other. The "Storage" permission is for access to the shared storage area - the bit you see as a usb drive when you plug your phone into your laptop.

If you want a slightly more in depth guide, then the developer guidelines are where I’d start: https://developer.android.com/guide/topics/permissions/requesting.html#normal-dangerous

But the essentials are: Android permissions are split into Normal and Dangerous sets. All apps are granted "Normal" permissions automatically without querying the user - these are ones which are not viewed as affecting the user’s privacy. "Dangerous" permissions require confirmation from the user and are split into groups - if an app receives permissions for one within a group then further requests within that group will be given automatically.
posted by pharm at 1:21 AM on January 5, 2018 [1 favorite]

Unfortunately, there's also a third part to your question - why any given app would be requesting any given permission, the answer to which is sometimes obvious, and sometimes requires some guesswork, even if there were a clear explanation of what each permission does. Sadly, apps don't only request permissions the instant they try to use them; it looks like they can make that request at any time, and sometimes it's obvious that developers pine for the days where permissions had to be blanket-granted at install and make their app check for every permission it could possibly need at launch. (And as a technical communication professional, they don't explain why they want those permissions nearly as often as I'd like!)

To more specifically answer at least one of your questions, a lot of apps ask for the Contacts permission if they're going to interact with your Google account in any way, since on some versions of Android that permission is required for it to see the list of Google accounts registered on the phone. Presumably that's (at least the biggest part of) the reason why the Play Store wants it. I'd guess that the Contacts application wants Calendar permissions because it auto-fills birthdays for you. And, like pharm said, QuickMemo+ most likely only shares notes to its own private app storage, whereas Contacts wants to save information to system storage which is shared with other apps.

One nice feature is that, since it sounds like you're on Android 6.0 or higher where permissions are requested at runtime, you can go to Settings -> Apps -> [any given app] -> Permissions to grant or revoke any given permission at any time, so you could, for instance, revoke the Voice Recorder app's Microphone permission when you weren't using it. You can also go to Settings -> Apps -> App Permissions to see a list of permissions along with each app that has requested it, and they can be toggled on and off from there as well.

I hope some of this is helpful.
posted by Kortney at 6:14 AM on January 5, 2018 [3 favorites]

I read somewhere recently (can't find the link, sorry) that many apps require the Phone permission so they can save state and/or pause what they are doing if you get an incoming phone call. That may explain the Play Store needing that permission.
posted by Rock Steady at 9:05 AM on January 5, 2018

Phone permission gives the app the ability to read your phone number and imei. Which is pretty annoying since damn near every app that does anything wants it either because it uses Play Services or uses the IMEI as a licensing identifier.

The Play Store has the Phone permission so it can read the IMEI and has the SMS permission so that it can automate the Google account phone number verification thing, rather than having you type the code in by hand.

I thought the latest couple of stock versions of Android had more verbiage about what each permission actually does, but I've been using third party ROMs for a while now so I forget.
posted by wierdo at 4:43 AM on January 6, 2018

Another thing to note is that the app developer codes the permission requests into their app -- so if they're being sloppy, or used to have a feature that required a certain permission but now don't, etc, those would be additional reasons for the app to require you to grant a permission that it may not actually use.
posted by anotherthink at 9:44 AM on January 8, 2018