How Google’s Permission System Works
Whenever you download an app from Google Play (the store formerly known as the Android Market), you see an alert that explains what information that app will be able to access once you install it on your phone; for instance, the alert will indicate whether the app needs to access your contacts list, or connect to the Internet. An app cannot use any part of the phone that it does not have permission to access, and the developer sets these permissions when it first submits the app to the Play store.
The Problem With Permissions
While the providing of this information is a good idea in theory, it doesn’t work so well in reality. According to Joe Keehnast, a product manager for Norton, very few people actually look through an app’s permissions before installing it.
Even if you were to read through the alert, you may not come away with much information: The permissions list can be extremely unclear and unhelpful. An app can request permission to use my network connection, for example, but I’m never sure what it’s actually using that connection for. Some security apps, such as Lookout Mobile Security, feature “privacy advisors” that can give you a little more detail as to why an app would request certain permissions. At best, however, that is a workaround for a larger problem. Even with the extra information from security apps, you never see explicit details as to why, say, a browser app wants access to your phone’s SMS function.
Confusion aside, the permission system as it is currently designed just does not work. In late February, the New York Times demonstrated an inherent flaw with the Android permission system by building an app that was able to access photos stored on an Android phone and copy them to a remote server. To accomplish that, the app needed only permission to access the Internet.
According to Google, the problem stems from the fact that it originally developed the permission system to work with devices that stored photos on the removable memory card. Now that phones store photos on the built-in storage, Google’s permission system no longer works as the company originally intended.
What to Look For
Though app permissions are by no means clear, you can look for a couple of red flags. Almost every app asks for access to the Internet (usually for ads), but very few should request permission to access your phone calls or your messages. A malicious app with permission to make calls or send messages can cost you big by dialing certain phone numbers or by sending out premium text messages without your knowledge. The only apps that should have access to your phone calls or text messages are security apps and communication apps such as Google Voice. If a game asks for permission to access your text messages, do not download it.
It should go without saying, but the situation needs to change. Google must revamp the permission system so that it is easier to understand, and app developers have to clearly explain what their apps can access–and why. But until that day comes, it’s important for you to keep questioning whether each app really needs access to all parts of your phone.