Android tablets and privacy???

[Flibb]

Have been looking at installing Cynogenmod on my Nexus and Galaxy S2, I believe it also has permission controls built in.

[capt_cornflake]

Have been looking at installing Cynogenmod on my Nexus and Galaxy S2, I believe it also has permission controls built in.

CyanogenMod certainly used to have this functionality, definitely in CM7, but I've not really used this feature since then. It doesn't seem to exist in CM10.1 yet (Android 4.2) which I'm running on my SGS3, but it's entirely possible it's one of the features they've not yet merged as there are not yet any stable 10.1 builds

[Saracen]

I agree, absolutely and totally 100%. But that kind of control just isn't there by default on any mobile OS I know of.

....

It's not there, ar least not yet, on any mobile OS I know of either. That' my problem, and what I was hoping, without much expectation, for either a solution to or at least a workaround for.

[Saracen]

....

The same could be said for PCs though really. There will almost always be some app on your PC that is out of date, or even Windows itself, that could leak data. Heck, the US has had a few scares recently about backdoors at the actual silicon level!

I can understand the Google reluctance though If you do go down the custom ROM route though (ones that don't include gapps anyway), that should ease your mind a lot ....

Indeed, and I take the point you made earlier about balance, too.

PC's aren't perfect, by any stretch of the imagination. Part of my problem here is that I'm pretty familiar with PC's, and getting them configured in a way that suits my needs, preferences and, perhaps, paranoias.

After all, I've been working with PC's since a high proportion of people here were in short trousers. Or before. I think the first time I went to the US for PC-specicic training (from the manufacturer) was probably 1984, maybe 85.

But I'm an Android neophyte. I've worked out which way up to hold the tablet (once I'd sussed turning off that blody annoying auto-rotation, but I'm not much beyond that.

But as you say, balance.

You may have noticed that privacy over personal data is a bit of a pet hobby-horse for me. In other threads, I've pointed out why I won't use store reward cards (because of the loss of privacy) and why I gladly forego the discounts accordingly, and why I even keep credit csrd use to a minimum and pay for most things, especially groceries, in cash.

What I might not have said is that I don't do internet banking. Why? Because even beung pretty PC savvy, or maybe because I'm pretty PC savvy, I know my systems, which I do take care over, aren't infallible. I suspect I'm in a minority with that attitude to online banking, albeit certainly not alone in it. But I've taken it a step further. My bank(s) have written instructions, and have acknowledged those instructions, also in writing, that online banking is locked down on any and all accounts in my name, and that it CANNOT be unlocked without my presence, in person, in a branch, with proof of ID that is sufficient to meet money-laundering regulations, and that will include, at a minimum, a passport, and WRITTEN instruction from me to unlock the account.

So .... whether the banks have done as I asked or not I don't know, but what I do know is I've got them stone cold liable if any online banking takes place on my accounts. See, not only do I not trust my own systems to be adequately secure, but I also don't trust banks to not give me a hard time if fraud were to occur using online banking.

Getting in to the branch to do certain things is a bit of a pain, but nowhere near as much of a pain as trying to sort out illicit activity can be, and my attitude and written instructions are, if you like, a fairly exteme form of precautionary measure.

So, if you consider the mindset behind those decisions, and I'm aware many people won't agree, or go that far even if they do agree, you can then see where I'm coming from over keeping as much of my private life out of the hands of a data vampire like Google, let alone out of the hands of far less reputable data acquisition companies.

It's also reflected in my long-standing attitude to adverts, and junk mail. I don't like adverts and I detest personalised adverts. And I mean really, REALLY detest adverts persinalised by some company tracking my activity and either marketing at me based on it, or selling the data. I REALLY do not want personalised adverts, from anybody, about anything, under any circumstances, EVER. If there was, for instance, a competition with a really major prize, like a car, house or world cruise, and I just have to allow personalised adverts or junkmail, my response would be to tell the company where to stick the prize (which could be rather uncomfortable if it were a car, house or cruise liner ) and to not pester me with targeted ads or junkmail.

So yes, I accept there's a balance. But I think you're getting an idea of what's on one side of that balance, for me.

[Saracen]

Here's an example of the kind of thing that makes my skin crawl. A keyboard app, Swiftkey Tablet, wants permission to read all SMS messages, "regardless of content or confidentiality".

Maybe there's a good reason for needing that. But if there is they damn well ought to explain it. They do have a decent privacy policy, but that's relying on taking their word, AFTER giving them full access permission. It strikes me as akin to accepting a known burglar as a house sitter while you're on holiday, and taking his word for it that he won't nick anything - if he's lying, the first you'll know about it is when you discover something missing, by which time, it's too late. Far better to not give him your keys in the first place.

I was prepared to buy that app, until I saw the permissions. Now, I'm not prepared to install it, even if it were free.

[Agent]

Swiftkey has an option to learn your writing style from sent SMS messages when you first install it. I use it and it's fantastic

Sadly you're going to find this is the way with a lot of apps The really nice features will need that little bit more in terms of permissions.

I 'trust' Swiftkey, in that I don't think they'd risk their entire business on such a stupid move. But that's hardly a certainty really.

[Saracen]

Ironically perhaps, that particular potential loss of privacy is one that doesn't bother me. First, this is a wifi-only tablet, no 3G, and it isn't a phone. So no SMS' for it to read. Secondly, I don't even do texts on my phone, so the only privacy they'll invade is to read a collection of marketing spam. Anybody that knows me knows to not bother texting me, 'cos I won't read it.

It's the thought process behind sacrificing any privacy in SMS content for the sake of a minor function in a keyboard app that makes my skin crawl.

But what really makes my skin crawl is that a well-regarded and top-selling app can take that attitude and yet still be top-selling, because that tells me most users either don't bother to look, or worse yet, looked and don't care. Either way, that's REALLY depressing, because it's blindingly obvious that developers aren't going to change if users don't care enough to look, or just install anyway.

And you're right, Agent .... "sadly", indeed, because yes, it's the way most (but not all) developers think. Maybe there's a market niche there for developers .... develop apps with privacy as a prime objective, for people like me.

[capt_cornflake]

There is a more sensible approach I've seen in a few apps, which is to have a basic app with only the essential permissions and then a series of plugins which require additional permissions.

An example is the pure grid calendar app. Obviously it requires access to your calendar as default, but in the settings is the option to display birthday information from your contacts. Try and enable it and it prompts you to download the plugin which requires access to your contacts.

I wish more developers would take this approach really. It's a bit more work on their part, but allows the user more control. I see no reason why swiftkey for example don't do this for those people who were happy to grant sms permission.

[Saracen]

My background in serious software development is a very long time ago, so while I can conceive of how that might cause some real problems to implement, I've no idea if it actually does or not.

But if practical, it is indeed a very good way to resolve the conflict providing it's clear to users :-

- what they get in features if the add a module, and
- what permissions are required to change, and preferably, an explanation of the practical implications of that.

It does strike me as a little tacky for it to be left to developers to do it piecemeal, where one will and the next won't, but maybe it's the only way.

I'd rather see a permissions system where, sure, a default can be established at install time, but it can be over-ridden by the user, perhaps by logging in as a super-admin or some-such, and NO application could get past such a non-default setting with merely asking the user to change the permission. That is, an app could ask me to go change it, but cannot just ask my permission and then do it for me. I would like to see apps simply not able to override a non-default permission.

So, an app can perhaps set the default on install, but if I've manually locked it down, the ONLY way to unlock is for me to do it manually.

But then again, I'd also like to win £100m on the lottery, solve famine in Africa, cure cancer and bring world peace. Not necessarily in that order. My guess is I'll get that permissions system sometime after I get the rest.

[mgastrap]

unfortunely buddy this is what you get when getting an android and the way google are forcing people to join their properties is just getting silly. I also don't use any service from google, but had to create a fake email address to be able to use Android apps. I don't use that gmail address and turned off all sync options.

[Agent]

I also don't use any service from google, but had to create a fake email address to be able to use Android apps. I don't use that gmail address and turned off all sync options.

You don't need any email address to use Android apps. That's just not true.

You need an email to use services from Google, which includes the Play Store, but that's a very different thing.

[Saracen]

You don't need any email address to use Android apps. That's just not true.

You need an email to use services from Google, which includes the Play Store, but that's a very different thing.

With this Samsung tablet, I struggled for about an hour to get it to do ANYTHING, after first power-up, until I'd given it an email address. And failed. If there is a way, it sure as hell isn't obvious. It seems to be part of initial configuration, and either impossible, ir at least extremely hard, to bypass.

So, like mgasteap said, to use any apps, even Samsung default ones, you have to provide an email address. It's not an app-requirement, but does seem to be an install requirement.

[Agent]

With this Samsung tablet, I struggled for about an hour to get it to do ANYTHING, after first power-up, until I'd given it an email address. And failed. If there is a way, it sure as hell isn't obvious. It seems to be part of initial configuration, and either impossible, ir at least extremely hard, to bypass.

So, like mgasteap said, to yse any apps, even Samsung default ones, you have to provide an email address. It's not an app-requirement, but does seem to be an install requirement.

That's a Samsung thing then.

Building Android from source shows a very simple button / text of "skip this step" (or close) when it asks. Granted, I've not checked on KitKat, but it's there in previous versions for sure.

If Samsung are forking Android are forcing you to supply one, that's not really Androids fault.

edit - for example: http://www.itworld.com/mobile-wirele...without-google

When you first turn on your phone, or after you perform a “factory reset” on it, you’ll be asked to sign in with a Google account. Don’t do it, and look for the “Skip” option. Your phone can run without a Google account, and you can add other accounts to fill out your contacts and calendar and the like--Microsoft Exchange, Facebook, Twitter, and more. Also skip the options to send feedback about your usage, back up your settings to Google, and so on. Skip just about everything.

[Saracen]

Oh, it could well be a Samsung thing, or even a "this tablet" thing. My Android experience is minimal, and I'm sure not about to argue with you on it. I'm way out of your weight class on that. But in that limited Samsung-specific experience, no email address = no apps, and for that matter, no access to tablet.

Unless, of course, I missed something, but I did look, and look, and look. And so did my several friends that bought one, on an especially good in-branch-only (I.e. not on website) deal from John Lewis. They all had the same issue, so re: that tablet, if it's me being thick and missing the "skip" option, it's several other computer-literate users too. In fact, between four of us, we have about 145-150 man-years of computer experience, so we aren't exactly novices, although we admittedly are all Android novices. If it's there, on this device (Tab 2) it's neither obvious nor intuitive.

[badsyntax]

Or you can get the Xprivacy installer from the Google Play store. It needs root to install but it provides a nice app-by-app interface for setting and revoking permissions. It works fine in 4.4.2 despite the efforts of Google to revoke app permissions in the UI. This is why AppOps worked in 4.4 but not 4.4.2.

[mgastrap]

If Samsung are forking Android are forcing you to supply one, that's not really Androids fault.

who's fault is it then?

That's a Samsung thing then.

Building Android from source shows a very simple button / text of "skip this step" (or close) when it asks. Granted, I've not checked on KitKat, but it's there in previous versions for sure.

If Samsung are forking Android are forcing you to supply one, that's not really Androids fault.

edit - for example: http://www.itworld.com/mobile-wirele...without-google