Permissions: What your phone wants from you
4.7.2018
Translation: machine translated
Support: Melanie Anna Lee, Stephanie Tresch
Every app on every phone asks you for permission to access components and software. It is difficult to handle permissions sensibly, as they are usually opaque. What's more, you often simply accept them without questioning. A look at what is probably the most broken feature in the smartphone world.
"You, I don't want this mobile," says a customer in the Zurich shop.
She has just received a replacement mobile phone from digitec's fleet of replacement phones and is setting up the Lenovo P2 in the shop. The phone is the model that the shop assistants give you when they have to send yours in. The P2 was chosen because it is inexpensive, powerful and stable, so it should survive several customers. It has replaced the Wiko Highway Star, which has served well for years.
So why doesn't the customer want it?
"The contact app on my mobile wants access to my location. I don't want that."
Good thinking. A contact app really shouldn't have to access location data. And why should it? The app reads your Google contacts and displays them in Lenovo's design. That's all it should do. Perhaps it needs the "Camera" permission if the app allows you to take a photo of your colleague and then use it as a contact picture. But "Location" is a bit absurd.
The workaround for the customer is simple: Google Contacts also needs a mountain of permissions, but not the location data. This mountain may sound threatening, but it is not. Let's take a look at this in detail.
The permissions mountain taken apart
Understanding permissions requires some understanding of your phone's hardware. Your phone is not a box of black magic, it's a computer. Computers always follow logic, even if you have to think outside the box to understand them.
So here's a quick interlude in which I'm going to de-blacken the black magic for you.
Interlude: Why a torch app needs access to your camera
A good example of how you need to think outside the box is the torch app. If you're looking for something in the dark, the torch on your phone is a lifesaver. After all, who always has a torch to hand? Most new phones have a torch built into the Android ROM. However, if this is not the case, you can use a flashlight app.
As soon as you install the app, the app asks for the "Camera" permission. Why?
The torch on your phone is actually not a torch at all. It is the camera's flash, which is not actually a flash, but simply an LED light bulb. Furthermore, this LED is part of your phone's camera system.
When you switch on the torch, you are essentially telling the phone "You're going to flash until I tell you to stop." To do this, the app has to talk to the camera system. Hence the "Camera" permission. There is also the "Control Flashlight" permission, for obvious reasons.
Google Contacts at permission level
So, now we have an example. Let's now take the permissions of Google Contacts apart. The app does require some permissions, but not without reason. I had to do a bit of guesswork when interpreting the permissions, as Google does not clearly communicate what the permissions are actually used for.
Identity
- find accounts on the device: Access to accounts that are linked to the phone, i.e. Google, Facebook, LinkedIn...
- add or remove accounts: Manage the accounts found above
- read your own contact card: Read your own contact details
- modify your own contact card: Customise your own contact details
Calendar
- read calendar events plus confidential information: enter birthdays, send appointment invitations, ....
Contacts
- find accounts on the device: access accounts that are linked to the phone, i.e. Google, Facebook, LinkedIn...
- read your contacts: Read out contact data
- modify your contacts: Change contact details on your account only. Changes here will not change the contact details of your friends. For example: You save your mum not under her name but as "Mummy"
SMS
- read your text messages (SMS or MMS): Association of contact with text messages
Phone
- directly call phone numbers: Call directly from the contact app, often the reverse of this function is stored in the phone app of the phone
- read call log: Call log, often contacts, ...
- read phone status and identity: Important if you have categorised your contacts and certain contacts may disturb you despite sleep mode
Photos / Media / Files
Other
The bigger problem with permissions
In newer versions of Android, your phone will ask you whether you want to grant or deny the app permission. If an app is well programmed, then the functionality of the app is by and large not affected by this. You can still view pictures on Instagram if you deny the app access to the camera.
The problem with "Yes, go on, OK"
As much effort as Google and other Android developers put into permissions, it's a labour of love. The reason for this is you. Unfortunately, most users don't scrutinise permissions. When they install an app, they simply click on "Yes", "Next", "Allow" and "OK".
So my advice: think about what permissions you give your apps. Be conservative and try out what happens if you don't give the permission. Better less than more. If you deny a permission that renders the app inoperable, simply restart the app and it will ask for the permission again.
What can happen if everything goes wrong
To conclude this article, I would like to quickly discuss the worst-case scenario: If you give an app too many permissions and someone does something bad with your phone.
The threat researchers at Trend Micro have put together a gallery of the twelve most abused permissions.
Most of these permissions are misused to open the door for criminals to either abuse your smartphone for its computing power or to harvest information. Only one of them can cause you direct financial harm and only one of them can lead to data loss.
Nevertheless: It is advisable to only grant permissions where absolutely necessary.
Journalist. Author. Hacker. A storyteller searching for boundaries, secrets and taboos – putting the world to paper. Not because I can but because I can’t not.
Background information
Interesting facts about products, behind-the-scenes looks at manufacturers and deep-dives on interesting people.
Show all
