Hacker News new | past | comments | ask | show | jobs | submit login
Why aren’t app permissions reflected in app classifications? (medium.com/puzzleboss)
56 points by benologist on Dec 30, 2015 | hide | past | favorite | 27 comments



Google is a search company as well as an ad company. Why can't I search for apps based on the permissions they require? Still? In (almost) 2016?


Because they're an advertising company. And more transparent permissions will get in the way of advertising.


I doubt it is even anything like that, I expect it's just that they know that most of their users will never, ever, use that search feature, so they don't bother with it.


It's just another facet, though. General purpose engines like ElasticSearch can handle that.

For that matter, how many people use site: or filetype: in their Google web searches, and yet those features exist?


I'd assume Google isn't doing it because no one at Google cares enough to implement such a feature. Features like site: and filetype: are over 10 years old, and I'm sure site: predates Google's IPO from when they were still figuring out how to monetize.

Infact, I wonder how many new search operators Google has even added in th epast 10 years.


This is pretty lazy reasoning. This argument is so general it could apply to any company doing anything people don't like.



One of the answers links to https://developer.android.com/google/play/filters.html#uses-... which just says that the API doesn't allow filtering by uses-permission.



I agree children should not be able to install a contact-accessing app.


Or just have an option in the app store where the password needs to be entered whenever an app attempting installation or attempting an update that requires new permissions. You could give a device to a kid and not have to worry about them installing crap or allowing apps to gain extra permissions. Apps that are just simple updates with no changes in permission could still auto-update.


The OS should still allow users to install and run applications without going through an all-or-nothing permission approval process.

The API should just provide the application with blank data for each data source for which permission has not been explicitly granted.

Ex: address book with 0 people for contacts, silence for microphone, black screen for camera, north pole for GPS location, etc.

That way users can opt out of specific functionality of an application which does not provide them with any value while still opting into and utilizing the functionality of an application which does provide them with value.


I do like your idea of feeding null data to the app however I think blacklisting permissions would be better than having to whitelist everything. When I install an app on my phone (versus from my computer), I typically need the app now. Having to go through and whitelist everything would be a pain. Have an option in the OS settings for default, global blacklists that are always applied unless you specifically whitelist for that app.

Your global blacklist might look like: No Microphone No Location

You install something like Snapchat. This requires camera, mic, contacts, and location. You start Snapchat but the OS pauses to tell you that null data will be fed to the app since it requires things that are blacklisted. You can either dismiss the notification or have the option to open up the local permission checklist. This would allow you to check off the things you may want to add like access to the mic or deny permissions you don't have globally blocked like contacts. You go through and give it access to the mic but block access to contacts. Now Snapchat has implicit access to the camera (since there is no rule about it), explicit access to the mic (as per local rules), explicit block to contacts (as per local rules), and explicit block to location (as per global rules). Now you can record videos with sound but not let it know where you are or who you know while still keeping a global blacklist that everyone must follow.

One important thing, under no circumstance would apps be allowed to know the the OS is blocking access to certain things. This would open up the ability for an app to complain that it needs something and just refuse to run.


That option has been there for ages.


Nope, not on my latest Android 5.1.1. The Play Store app allows you to block apps from being installed based on the maturity rating and to require a password for purchases. No where does it have an option to require a password for all installations.


AFAIK restricted accounts can't install apps.

I might be mistaken since I don't use that feature but I have just created one such account out of curiosity :

- the admin can decide which apps are useable from the restricted profile.

- it seems that the restricted account can't install additional apps.


Permission systems should not be a stand-in for good parenting. Monitor you children's electronics, educate them on what the important things are and what they mean.


Obviously. But how are you supposed to monitor your children's electronics, when they are few good tools to do so, and how are you supposed to educate them, when the technology is designed to obscure the dangers?


The content rating systems should help parents make choices about what apps are acceptable. They should reflect whether the app can record information about the child.


Education and monitoring are important, but they're no good without experience.


Can you be more specific about what actions one would take as part of "monitor your children's electronics" to prevent these problems?


if you just want your toddler to access a couple of apps from your tablet, create a restricted account that can only access these apps.


What if I want something in between locking them down to a couple of apps, and letting them accidentally send contacts to some app maker?


Ideally, you should have more granularity in the permissions of restricted accounts, with the option to let the second profile install app but with a prompt for the admin password when a new permission is required or a payment is started.

Sadly, AFAIK, there is no way to do that.


Right, so that's exactly the sort of thing being asked for, and it's what got this annoying/useless "just monitor your kids" response.


Are there third-party search engines for apps?


apparently, yes. see my other comment in this discussion.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: