I would like to see an app that can block/white list app permissions. Has anyone ran across such a beast?
I would like to have the ability to white list apps to particular permissions. For example, Pandora wants to read my contacts, send e-mails, and modify my calendar... I don't white list that app to those permissions so any request for those permissions get blocked. However, I do wish to give Pandora access to Bluetooth and read phone state... So I white list Pandora to those permissions...
Does this make sense? It is kind of a "Permissions Firewall."
I have searched for this and I have yet to find something like this.
Any suggestions?
One other thought is maybe each permission could get its own user modifiable canned answer, and the white list is the choice between providing the user defined canned information (For example: If you don't white list Fine GPS, the app will always receive one particular GPS coordinate instead of your real coordinates.)
The default could be "block" and the custom "canned" response could be user defined.
It would be nice, but I'm not sure about the ability of the app to run if specific permissions written into the code are changed from the end-user. Someone more knowledgeable about app code should chime in.
t1n0m3n said:
One other thought is maybe each permission could get its own user modifiable canned answer, and the white list is the choice between providing the user defined canned information (For example: If you don't white list Fine GPS, the app will always receive one particular GPS coordinate instead of your real coordinates.)
The default could be "block" and the custom "canned" response could be user defined.
Click to expand...
Click to collapse
Possible, but above...If an app requires specific information to run, it may need to be completely re-programmed/coded on the end-users side.
Yeah, it was that specific thing that my 2nd post was trying to get around. By providing the end user the ability to directly manipulate the answer provided to the app, I don't see why this wouldn't work.
Another thing would be to have profile sets available on the market that an enduser could install to set most of the "known OK" white list permissions, and the blacklist "fake answers" automatically to make managing the white list a bit easier.
Honestly, I have been wondering why I can't find something like this since my early G1 days. I really think that it could be an integral part of protecting one's own private information.
I agree...Have been wondering this myself since last summer--just do not know how to begin a project like this. Would be an AWESOME feature if someone could figure it out.
It would probably require root, but other than that, I think it would be fairly simple and straight forward to program. However, I can't code, do there you go...
Eat at joes
Too bad no one else thinks that this is a good idea. I had one more thought on this though. Configurable alerting on permissions offenses. The Pandora debacle got me thinking about this again.
I believe you have two options but first you must root your device. Check out:
Root Call Blocker
http://forum.xda-developers.com/showthread.php?t=1051274&highlight=firewall
DroidWall
http://code.google.com/p/droidwall/
However, it would be neat to have an app which does not require rooting.
Have you tried Permissions Denied or LBE Privacy Guard?
Related
After the recent article on apps that are sharing our personal information, it occurred to me that this should be an easy problem to fix. All we need is a good personal firewall app. Heck, iptables would be a great start, but it can be hard to implement that on an app by app basis. It will be hard to set up for apps that have legitimate needs to connect over port 80 for legitimate needs, but also uses that same port for less than legitimate needs. So I guess it will also take some blacklisting of certain servers, perhaps along the lines of the ad blockers apps that modify the hosts file.
Or does such an app already exist?
Skip
Here you go:
http://www.appbrain.com/app/droidwall-android-firewall/com.googlecode.droidwall.free
MrGibbage said:
After the recent article on apps that are sharing our personal information, it occurred to me that this should be an easy problem to fix. All we need is a good personal firewall app. Heck, iptables would be a great start, but it can be hard to implement that on an app by app basis. It will be hard to set up for apps that have legitimate needs to connect over port 80 for legitimate needs, but also uses that same port for less than legitimate needs. So I guess it will also take some blacklisting of certain servers, perhaps along the lines of the ad blockers apps that modify the hosts file.
Or does such an app already exist?
Skip
Click to expand...
Click to collapse
1. There's already a couple adblock apps like Adfree which block a lot of stuff.
2. If you read the permissions for the apps you CHOOSE to download, then you'll know exactly what access to data they'll have. If you don't like that PaperToss wants access to your device ID, then just don't install PaperToss.
And of course, such an app would undoubtedly cause more issues than the perception of "security" it would provide, since you'd probably not be able to use half the apps anymore. Or they'd stop being ad-supported, and would begin to charge instead.
From the article:
Google requires Android apps to notify users, before they download the app, of the data sources the app intends to access. Possible sources include the phone's camera, memory, contact list, and more than 100 others. If users don't like what a particular app wants to access, they can choose not to install the app, Google says.
Click to expand...
Click to collapse
Just read the app permissions. That tells you almost everything you need to know.
The problem is, the app permissions don't tell you what you need to know. Here are the permissions for Paper Toss by Backflip Studios:
Your Location (coarse network-based location)
Network communication-full internet access
Phone Calls - read phone state
While the Location permission would be suspect, and would cause me to question whether or not I should download this app, the other two permissions are not so immediately obvious that they are "bad". Network communications is a permission needed by every app that has in-game ads such as AdMob. And I don't know why this app needs the Phone Calls permission, but almost every single app in the market uses that permission. At least it isn't asking for access to the address book or anything like that.
What I would like is for the app to tell us what it needs internet access for, and to tell us what information it is sending to third parties.
MrGibbage said:
The problem is, the app permissions don't tell you what you need to know. Here are the permissions for Paper Toss by Backflip Studios:
Your Location (coarse network-based location)
Network communication-full internet access
Phone Calls - read phone state
While the Location permission would be suspect, and would cause me to question whether or not I should download this app, the other two permissions are not so immediately obvious that they are "bad". Network communications is a permission needed by every app that has in-game ads such as AdMob. And I don't know why this app needs the Phone Calls permission, but almost every single app in the market uses that permission. At least it isn't asking for access to the address book or anything like that.
What I would like is for the app to tell us what it needs internet access for, and to tell us what information it is sending to third parties.
Click to expand...
Click to collapse
Maybe to detect a phone call and pause the game.
Sent from my SGH-T959 using XDA App
MrGibbage said:
The problem is, the app permissions don't tell you what you need to know. Here are the permissions for Paper Toss by Backflip Studios:
Your Location (coarse network-based location)
Network communication-full internet access
Phone Calls - read phone state
While the Location permission would be suspect, and would cause me to question whether or not I should download this app, the other two permissions are not so immediately obvious that they are "bad". Network communications is a permission needed by every app that has in-game ads such as AdMob. And I don't know why this app needs the Phone Calls permission, but almost every single app in the market uses that permission. At least it isn't asking for access to the address book or anything like that.
What I would like is for the app to tell us what it needs internet access for, and to tell us what information it is sending to third parties.
Click to expand...
Click to collapse
All free apps will collect some information .... so they know what ads to aim your way ..... so they can make money ... Every one does this .... on your computer its the same as your cookies .... and only the really paranoid will set their browser cookies settings to "ultimate :block all cookies "...
Here's the difference, android openness will allow others to research and publish their findings, un like others that are closed and will not allow research, and if anyway is found to get the research. done the publication will be deleted from the web ......
The openness is why you see soooooo many articles on this issue over n over, none of them mentioning that the paid versions of these apps don't collect any thing .....
How much personal information are you planning on storing in the paper toss game?
Consider this in your answer, android system runs apps in sand box mode meaning, one app cannot access another without YOUR permission, or if an app is infected with malware, that malware will only operate in that app, unlike your windows machine where it would have a free for all .....
ferhanmm said:
Maybe to detect a phone call and pause the game.
Sent from my SGH-T959 using XDA App
Click to expand...
Click to collapse
That's my point. That would be a legitimate need for access to the phone state. However, granting that permission also gives the app permission to make phone phone calls. I still think the apps need to be more specific about the permissions they need.
The bottom line is, these phones are great, they can run all kinds of awesome software, but the people writing the software need to make a living too. If someone really wants to prevent their phone from sending out personal information, then they should not install any software, and maybe shouldn't even be using the phone at all. But I still see a need for a firewall app (possibly DroidWall, as mentioned above) to help us prevent this type of thing from happening.
A permissions firewall would be much more interesting and useful in my opinion.
Being able to block a certain thing like "read contact data" for all apps and only permit access with a white list would be very useful to me.
Before beginning, I'm outlining two application permissions for future reference.
These were pulled from this article. It also outlines other permissions.
Raju PP said:
fine (GPS) location
While not a danger for stealing any of your personal information, this will allow an application to track where you are. Typical applications that might need this include (but are not limited to) restaurant directories, movie theater finders, and mapping applications.
Click to expand...
Click to collapse
Raju PP said:
coarse (network-based) location
This setting is almost identical to the above GPS location permission, except that it is less precise when tracking your location.
Click to expand...
Click to collapse
Recently, I've taken an interest in privacy concerns with application permissions. I'm sure several of you are guilty of being unaware of unnecessary app permissions. I have apps on my device that I've had since migrating to Android, long before I concerned myself with privacy. In my recent hunt of cleaning up my application list, I've discovered that many applications have permissions that aren't necessary for it to function. The most common, unnecessary permission I've come across is coarse (network-based) location. As its name describes, this permission allows an app to determine your approximate location (e.g., the large location area shown by Google Maps when GPS is not on).
An example. I use a Wifi Login application to automatically enter login information for campus internet access (it was cumbersome to enter it manually each time). It works wonderfully, but it has this permission (coarse location). I asked myself, "what function of the app needs to access location??" I only need the app to access the internet, nothing else. I also noticed that each day, there was a location service wakelock despite having all location refreshing services turned off (in other apps, latitude, etc.). Upon removing its ability to obtain approximate location, the location service wakelock disappeared and functionality was not affected.
So, there are two concerns: privacy and unnecessary battery usage. While the link between the two is not often made, I'm making it here. Not only was the app (presumably) sharing my location, but in doing so, my battery took a hit. Before someone panics, I don't believe most apps use this maliciously. My guess is that app developers use it for demographic purposes to determine where in the U.S. their application is being used. Obviously not necessary, but an interesting tidbit for the creator of an app. So my question is, are you ok with apps accessing your approximate location? I've seen several games that have location permissions and in no way can that be justified.
Going beyond location permissions, there are obviously other privacy concerns. A number of app developers I've seen list why an application needs certain permissions. In the example provided above, the developer doesn't mention permission uses. In post 2, I will provide methods for identifying and removing app permissions (by using other apps lol - ironic, I know). Below is a good read about applications' additional "costs."
Free apps not truly 'free'
I use two applications to identify permissions: Appbrain Ad Detector and Avast Mobile Security. Appbrain Ad Detector has the ability to notify you when an app you install has "concerns." Avast Mobile Security has a lot of very useful features, one of them being "privacy advisor." Using one or both of these will allow you to determine what permissions are necessary and which ones are not. For what it's worth, I've only had a few apps that I felt had unnecessary permissions. You obviously don't want to revoke Tango access to the camera lol.
EDIT: I was going to suggest getting an application called "App Shield," (has the ability to remove app permissions) but it appears that it is no longer available on the market. It was a paid app that was just under 2 bucks, if I remember correctly. Due to this development, you'll have to find either App Shield or another method to accomplish this.
You can always just email the app creator and ask why they have the permission included. It (usually) takes more than one questionable permission to be truly dangerous.
From what I've read the majority of apps that use coarse location is for determining the ads you see in the app. Better chance of them being relevant to you.
Just like that article you linked, I think it was brought up on an xda portal article (either that or lifehacker love that site) that because of ad supported apps using coarse location, the battery use was higher, and paid apps that remove the ads will lower your battery drain. Not a huge difference, but it can add up.
gr8hairy1 said:
. . .
From what I've read the majority of apps that use coarse location is for determining the ads you see in the app. Better chance of them being relevant to you.
. . .
Click to expand...
Click to collapse
Makes sense. Coincidentally, the example I used is a paid app. The app itself had the permission, as well as the "pro" activation apk. Though it's no longer an issue, I may consider contacting the app developer out of curiosity.
Definitely do that. I have a large amount of apps on my phone, and it's not too uncommon to get an update for an app that removes a permission. Many times it's done because people contact the developer and the developer realizes it's not needed. Most times I see that happen is in paid apps, only sometimes with the free apps.
As for your original topic "are you ok with apps accessing your location", I have no issue with it. Obviously if it is getting used maliciously, no, I wouldn't be ok with it.
But as it is, 'guaranteed' the Phone Carriers know where you are and where you've been. And 'guaranteed' the government knows where you are and where you've been. I will always be more worried about the government knowing everything they want about me, without my permission, than some app creator. And as it is, I'm ok with the government knowing.
I feel the same way about the government as I do Google. Until they turn evil and start enslaving mankind (search "is google skynet", hilarious and royally creepy) I'm going to keep using them and stay in the country I live in.
Conspiracy theorists feel free to chime in. Although let's be honest, the over-the-top conspiracy theorists (that make for the best/most hilarious conversations) won't likely be carrying around a device that has cameras, microphones, gps chip, and internet access that can be used to activate one or all of those remotely
I don't really care if they know my location, but now that you mentioned a possible battery drain, I am bothered by that. Someone should make a list of popular apps that may have unnecessary permissions that can be safely disabled through some sort of means.
https://play.google.com/store/apps/details?id=com.stericson.permissions
Yer welcome.
Sent from my SGH-I777 using Tapatalk 2
I don't care either. I have my GPS constantly disabled so the only location any of my apps could get is a general network location....
Honestly, I think privacy concerns are often blown out of proportion... mostly by the media. Don't get me wrong, there is nothing bad with being concerned, but I highly doubt we are going to have another Craig's list killer situation from developers releasing apps on Google Play. Knock on wood.
As mentioned before, contact the app's dev and ask for more info. If they never reply then I would be worried. As well you can always use a different one. If needed you can use "Tasker" which can allow you to build almost any function any other app has to offer all under your control. Just be warned Tasker is highly addictive for us nerds....
Anyway, and in summary, I have less trust is most banks selling my purchase history then the random app developer.... but that's just me.
Being a Noob to Android I thought I'd install some location based profile software which is one of the things that Android owners always say they can do which is lacking from the iPhone.(where I come from)
Lamma seems to be recommended but the permissions it asks for include:
"Add or modify calendar events and send email to guests without owners' knowledge. read calendar events plus confidential information"
clicking on the detail is even more scary.
Android tells you what it's going to do - but do users actually allow this? Most apps seem to want permissions that you would have to be mad to accept.
Can I not install any useful app without agreeing to terms that are unacceptable?
What am i missing? Do people just allow unrestricted access? Not install any app? or is there a way of installing apps but not giving them stupid access?
I can't believe people allow that sort of access - I must be missing something.
Some custom after market ROMs allow to drop any permission by user but it may render app useless.
Most of the time apps are not malware, but sometimes they may be. You can contact developer of the app requesting for reasons of these permissions and he may reply better.
you can always use auto start manager app within the rom toolbox to control the permissions of the apps..
Confucious said:
Being a Noob to Android I thought I'd install some location based profile software which is one of the things that Android owners always say they can do which is lacking from the iPhone.(where I come from)
Lamma seems to be recommended but the permissions it asks for include:
"Add or modify calendar events and send email to guests without owners' knowledge. read calendar events plus confidential information"
clicking on the detail is even more scary.
Android tells you what it's going to do - but do users actually allow this? Most apps seem to want permissions that you would have to be mad to accept.
Can I not install any useful app without agreeing to terms that are unacceptable?
What am i missing? Do people just allow unrestricted access? Not install any app? or is there a way of installing apps but not giving them stupid access?
I can't believe people allow that sort of access - I must be missing something.
Click to expand...
Click to collapse
You really have to think about what the app could be using the permission for, for example something like tasker pretty much needs every permission going because it allows you to set anything up as a profile etc.
The rule of thumb is to look at the app reviews, look at the permissions and just think about what the app could be using it for.
Sure a soundboard style app shouldnt need to make phone calls but many apps do need permissions that at first glance you might not think are needed.
And if your really in doubt email the developer and ask them to explain why they need this permission.
Surprise :laugh:
http://www.xda-developers.com/android/manage-individual-app-permissions-with-xprivacy/
I want to disable the E911 on my phone. People if you dont agree keep it to yourself. I want to disable it. It should not matter why I want to especially not on site designed for people customizing the hell out of their phone. If you think I am paranoid I think your a sheep.
Can anyone actually provide some beneficial help towards my goal.
Maybe being a little more nice will get you your answer. You get more flies with sugar than vinegar.
Sent from my SCH-I500 using xda premium
Do you want to just disable E911 or disable all phone functionality? I haven't seen any way to just disable E911 on any mobile device. By default, every manufacturer puts stuff in that lets 911 locate your phone, and there is no way to disable it in software or hardware without basically stripping the software of its phone functions.
If you are still interested, and want software that strips this phone of all phone services and apps (including E911) try the GeeWiz Media ROM
As a Communications supervisor in a 911 center, I can tell you firsthand that disabling e911 won't prevent us from locating you. I've disabled e911 on several android phones that I've owned over the years and it still reports your Phase II Lat/Long
Sippi4x4man said:
As a Communications supervisor in a 911 center, I can tell you firsthand that disabling e911 won't prevent us from locating you. I've disabled e911 on several android phones that I've owned over the years and it still reports your Phase II Lat/Long
Click to expand...
Click to collapse
lol sippi, idk about the OP's reason for this, but ive personally seen people i know last week disable e911 on their phones (through ways like the Geewiz media rom+software mods) to do a drug dealing of all things, little did they know what u said was true and they were tracked not only by 911, but also by the stupidity of leaving my app (SMS Tasks) on their phones, leaving the person who ratted them out (not me but they did know their pass phrase), gave their phone to the local authorites and gave them the command [email protected]****** and with the version my app had on it (unofficial build), it located them with google-maps link that was clicked and gave a perfect track (because the people had gps on of all things), thus leading to the arrest (i personnaly felt good about it cause if i didnt make that app (SMS Tasks) they would be on the loose for a little bit longer causing who knows what cause the police officer said that they were having trouble tracking them with the e911 system for a "unknown error reported" as they told him so idk if it was a glitch with the tracking in my area's e911 or they acually disabled whatever it is that makes them track you (please dont reply with what it was just to be safe), but my app acually lead to an arrest =) so by what i saw i think there might be some workaround, or just a glitch, im not encouraging it one bit, but i know personally that there was at least one person capible of doing it (again unless it was a glitch in their system) =S
I'd also be curious to learn to disable this. I, unlike the previous poster, wouldn't pride myself on incarcerating someone for a business transaction and otherwise victimless crime.
If anything, the post above highlights exactly why you should not install apps which ask for unnecessary permissions, because some nanny state developer just might invade your privacy and track your movements instead of focus on the purpose of the app.
Domush said:
I'd also be curious to learn to disable this. I, unlike the previous poster, wouldn't pride myself on incarcerating someone for a business transaction and otherwise victimless crime.
If anything, the post above highlights exactly why you should not install apps which ask for unnecessary permissions, because some nanny state developer just might invade your privacy and track your movements instead of focus on the purpose of the app.
Click to expand...
Click to collapse
its acually a function of the app, not invasion of privacy, my app is open-sourced on my gitbub as-is for the app's released versions, thats locate command is one of the listed features on the thread, i update the github more then the thread but all the commands are safe, it was just some clever ideas for them to use my app to solve a criminal case thats all, as for the "business transaction and otherwise victimless crime" heroin and drug dealing is highly illegal in this area where it took place at, and the now ex-girlfriend of the guy was a victim from it because before he got out to buy it he beat her black and blue... >=( theres nothing funny about drug dealing making it a "victimless crime" as its a nuicence in our society no matter how many "benefits" people say it has, as for my app its clearly states in the thread for you to keep your pass phrase a secret, as he didnt, and all the commands+usage are all on there and clear warnings for the potentially dangerous commands, but the version he had on his phone was a newer beta test version that uses google-maps links instead of general GEOLocation area. all that was done was completely legal, and not abuse of my app or permissions as it still gives people to where it tells who sent the message in the tracking menu (by phone number) since its a new feature in my beta tester version so it did give full telling who it came from. but ive already been given warnings by the police from an earlier situation with the same people on the same kind of activity about regulations on tracking without consent, so i had to add that prompt to show who initiated the tracking, and am working on a button that will stop it remotely. so until i can comply with the regulations, while keeping it stable, i havent been able to update the app with them untill i get the new tracking system with prompts stable, but to do all that with the new systems i have in the app it needs to be installed in CWM recovery cause the system-app Reboot permissions, and better GPS/wifi Toggling
sorry if it seems like im ranting, im truly not, but that situation was really personally to me and i felt like what i did was the right thing, not a "abuse of permissions app", or to "incarcerating someone for a business transaction and otherwise victimless crime.", as it was more for the fact that he beat her and then he want to do an illegal activity
Wow, Im sorry for the long delay. I had switched phones and forgot all about this thread. I appreciate ALL who provided input. I still dont like the idea of it, but it doesnt bother me as much.
Not sure how far back...
Preexisting rom file from pre-e911 might work
Hi. We're currently putting the finishing touches on our calling app (dialer, spam detection, contacts, call log etc) and we've run into a bit of an issue. Google won't allow our app to be uploaded to Play Store because there's something wrong with the way we ask for runtime permissions.
Google's message:
You declared Default Phone handler (and any other core functionality usage while default handler), Caller ID, spam detection, and /or spam blocking, Write and Show Call History in Dialer as the core functionality of your app. However, after review, we found that your app does not match the declared use case(s). Learn more about permitted uses and exceptions.
Click to expand...
Click to collapse
We currently show the user a popup with an explanation before asking for permissions. If the user denies, we show another explanation popup (rationale) and ask again. If the user then denies again, we let them use the app without the features that use these permissions.
Permissions used:
Code:
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_PHONE_STATE
android.permission.CALL_PHONE
android.permission.READ_CONTACTS
android.permission.WRITE_CONTACTS
android.permission.READ_CALL_LOG
android.permission.WAKE_LOCK
One version did actually get approved but after that it went back to being denied. Nothing permission-related was changed tho. We're running out of ideas and Google hasn't provided any support so far either. Hoping we can get some help from here.
I think concerning the granting of permissions of an app is explained here exhaustively.
jwoegerbauer said:
I think concerning the granting of permissions of an app is explained here exhaustively.
Click to expand...
Click to collapse
True. We have done everything accordingly as well as tried several different approaches to displaying rationales, explanations etc but nothing seems to work. I think the issue might not be the way we ask for permissions but something else. Google says that showing call history, contacts etc is not the core functionality of our app. So I'm thinking it might have something to do with our intent filters in our manifest or something.
Edit:: So I did some more research on this and it seems like Google also checks the Play Store description for keywords related to being a calling app. We did not have any keywords that said this. Refreshed the descriptions and hoping for the best.
andres-h1 said:
True. We have done everything accordingly as well as tried several different approaches to displaying rationales, explanations etc but nothing seems to work. I think the issue might not be the way we ask for permissions but something else. Google says that showing call history, contacts etc is not the core functionality of our app. So I'm thinking it might have something to do with our intent filters in our manifest or something.
Edit:: So I did some more research on this and it seems like Google also checks the Play Store description for keywords related to being a calling app. We did not have any keywords that said this. Refreshed the descriptions and hoping for the best.
Click to expand...
Click to collapse
Any update on this Andres?