Why does a browser need access to...

[TooNice]

I admit that I don't update apps on my phone very often especially if it doesn't seem broken. Okay, perhaps there are security risks under the hood that I am risking by not updating to the latest and greatest, but I am really put off when I see that an update requiring additional permissions when it is not obvious why they are needed.

As an example, if I want to update my pretty ancient version of Opera, I will need to allow access to:

- Device & app history: I don't see why it is necessary but maybe there is legitimate use..
- Location: Why? Up until now it sometime ask to use my location. And I would tell it to go away each time. Seems like I won't get that choice anymore.
- Photos / Media / Files: It seems like the browser doesn't need permission for me to upload stuff in the very rare instance I need to as it is, so I am not sure what this permission is for.
- Camera: WHY??
- Microphone: WHY???
- Wi-Fi connection information: It is another one I can imagine being relevant to browsers, but has been fine without until now.
- Device ID & call information: WHY???

I appreciate that at least it lets me know that updating would sign me up to those additional permissions, but usually it just leads me to cancel and tell it to bugger off.

I really think that developers should be made to not only disclose the permission required, but also why they are needed for. I am not the most paranoid person ever, but I think that it is reasonable to know what those permissions are used for.

[scaryjim]

There may be an underlying change in the OS/API that means the new version now has to ask for a set of permissions separately when they were previously all bundled into one permission? If the app is old and you've been updating your OS regularly that's quite possible. If the old version of the app was asking to access your location before, that suggests it had permission to access it...

I can see Microphone and Camera if there are plug-ins or HTML5 features that can access them (like flash can on your desktop). Location makes sense if it can't even ask for your location unless it has the permission to access it; same with media & files. Device ID and call information is questionable. But given Opera isn't a dodgy back-room operation why not search on their website to see if it explains what each permission is required for (last time I looked into Android development there was at least one thing you could only do if the app had a seemingly unrelated permission...)

[DanceswithUnix]

The photos, media & files one is a pretty wide permission. If it needs to write a temporary file, cache contents, or indeed anything to the filesystem then I believe it needs this.

Device and app history, again this could simply be that it wants to record browser history and I would guess this is the api to do it (I have only dabbled in android app writing so I can't be sure).

Call information may be down to nicely dealing with an incoming call so it doesn't try and render over the top of the phone app. I would hope this is improved, but screen handling seemed quite crude when I was playing.

WiFi connection, well I wish my son would get a warning when the wifi drops and he starts eating through his data allowance watching videos.

Camera and microphone? I am guessing that is down to WebRTC which allows video calling in your browser. That strikes me as a stupid pointless thing to be able to do, but it seems to be a part of HTML5.

[TooNice]

Thanks for the replies.

There may be an underlying change in the OS/API that means the new version now has to ask for a set of permissions separately when they were previously all bundled into one permission? If the app is old and you've been updating your OS regularly that's quite possible. If the old version of the app was asking to access your location before, that suggests it had permission to access it...

To be honest, I am even worse at updating my OS than my apps. Doesn't seem like it can be done automatically on a rooted phone (I realise there might be -some- irony in worrying about permissions yet rooting the phone, but anyway..) and I am always worried that something break and I will have to spend the whole evening or more fixing/restoring it.

Hmm, if Google asks to use my location while I am using Opera, would it suggest that it already had that permission before? Usually if an application already had permission, it wouldn't ask again when updating though. I suppose that it is relevant if I use Google Maps from the browser (very rare - usually only if I am opening the map from a link) and want to use my GPS location. Well, as long as it has to ask first even if it has permission I supposed that it's not as bad as I thought.

But yeah, one of the permission I hate the most is the one that asks for my contact list information. NO. Just.. no!

[Saracen]

The photos, media & files one is a pretty wide permission. If it needs to write a temporary file, cache contents, or indeed anything to the filesystem then I believe it needs this.

Device and app history, again this could simply be that it wants to record browser history and I would guess this is the api to do it (I have only dabbled in android app writing so I can't be sure).

Call information may be down to nicely dealing with an incoming call so it doesn't try and render over the top of the phone app. I would hope this is improved, but screen handling seemed quite crude when I was playing.

WiFi connection, well I wish my son would get a warning when the wifi drops and he starts eating through his data allowance watching videos.

Camera and microphone? I am guessing that is down to WebRTC which allows video calling in your browser. That strikes me as a stupid pointless thing to be able to do, but it seems to be a part of HTML5.

All logical enough, in one sense.

But this is at the core of why I won't have a smartphone, and am VERY selective in what I use a tablet for. It's also at the core of one of my objections to Win10.

For me, they have the telescope the wrong way round. I want to be able to deny access to ANYTHING wanting access to certain data, unless I've explicitly approved it, and be CERTAIN that hardware like camera, mic and GPS location aren't being used without my express permission.

Far too many apps want, for whatever reason, far too broad a permission.

It certainly is reasonaboe for an app to say "I need xyz permission in order to do ABC action" but I expect to be able to say, in return, "well, don't do ABC, then".

However, car too many apps with zero legit reason to access my contact list, phone data, photos, etc, expect to be absolute access just to be installed. As TooNice so eloquently put it .... "NO. Just.. no!".

Thing is, I flat out don't trust either Google or app developers not to be using access to MY personal data for THEIR purposes, and benefit, and the supposed use is little more that a fig leaf to cover why they need access. So, .... NO. Just.. no!

Which is why I won't have a smartphone until/unless that changes, and why NO personal info goes on my tablet. None at all. It's a pain, and limits it's use, but ... so be it.

[abaxas]

So let me get this right, you want full rights over applications that people give away for free?

Good luck with that.

[Saracen]

So let me get this right, you want full rights over applications that people give away for free?

Good luck with that.

I want full control over what access those apps have to my data, or I don't install them.

Given a choice of paying for an app allowing me to limit it's access to my personal data, or a "free" app with free reign over personal data, I'd pay every single time. What I won't do, but obviously many people either from ignorance or explicit choice will, is "pay" for the app with access to personal data. There aren't ANY apps important enough to me to be prepared to do that, and about 99.99% of apps aren't important to me at all, let alone enough to do that.

So for me it's an easy decision. No smartphone, and a tablet that's used for little more than forums, and a bit of (securitised) web browsing.

[ceejays88]

These apps are getting more and more intrusive

[BobF64]

This makes for useful reading : https://support.google.com/googlepla.../6014972?hl=en

The Android settings don't seem granular enough, and some include perhaps 1 thing that unfortunately gives you access to lots of other things.

These are my best guesses though.

- Device & app history: Most likely so it can read your web bookmarks

- Location: Quite possibly so websites can provide you with local services, apparently this is a "helpful" thing for finding food emporiums and the likes

- Photos / Media / Files: I'd guess this was so it can save data, either cache or files you download

- Camera: For those needy people that like to post photos/video directly to Facebook etc

- Microphone: Same as above, except for recording audio only

- Wi-Fi connection information: This might be as simple as seeing if you're using Wi-Fi or cellular data

- Device ID & call information: Either being used as some sort of identification method or just as basic as seeing if you're making a phone call so the app can stop playing media

Ultimately, it just shows that simplicity is winning over user control. Quite a lot of the things on the Google list would be better if they were broken down further, like allowing the app to read files, but not make any changes, or to see if you are making a phone call, but not anything about it.