Hacker News Reader

Comment by macspoofing | Hacker News Reader

>where there are a class of apps which could conceivably rely on you not being able to lie about it.

I don't think having 'mock' data is the right approach, but as you mentioned below, it's enough that the relevant API simply throw a security exception and let the app handle it gracefully.

>If the user refused you'd get an exception, but you were expected to handle it gracefully.

And that's absolutely the right approach.

>It really wasn't that big of a problem, except for the user experience of the prompts some manufacturers chose to implement being fairly horrible.

That should be handled by the OS, which would completely negate this issue.

View on HN

Exceptions are not a solution - instead of the OS request "grant permission X to install the app" you get an app request "grant permission X to run the app".

This is the exact scenario that needs to be avoided - if the app developer wants something that I don't want to give, then you can't rely on cooperation from the app.

The whole point is that if a flaslight app wants to read my SMS, then I shouldn't have to choose between using that app and keeping my privacy; the OS is perfectly capable of keeping that app in an ignorant bliss thinking that it read my SMS and can turn on the light.

> flaslight app wants to read my SMS

I got so frustrated with flashlight apps asking for Internet access to show ads and getting stuck when there is no Internet (typically the same time when I need a flashlight) that I wrote one and made it completely permission free:

https://play.google.com/store/apps/details?id=com.bigosaur.l...

hey, this looks great, but it's not actually working on either on either of my nexus 5s, is that a known issue? There's no crash or anything, the flashlight just doesn't actually turn on.

Apparently there are two APIs available for this. Unfortunatelly, none of the devices I have at hand use the other API so I cannot test. :(

If you want, I can send you the source code to try to modify it. Just e-mail me.

Beautiful in its simplicity. It Just Works. Tested on S4.

Sharing with friends ;).

because using system flashlight app is too edgy, huh? Why you need extra app for thing you have just build in Android ? Check your widgets for "Assistive light". Problem solved.

Becase that thing is built-in in Android since 4.2, which is fairly recent. People needed flashlight apps even two years ago.

I'll also note the TeslaLED app as another good one - it requires camera permissions to control the LED, plus screen drawing and sleep control - I suspect around the minimum that would be needed for a flashlight app.

https://play.google.com/store/apps/details?id=com.teslacoils...

This is what I've always used. LampA doesn't work on my Galaxy Nexus. I was hoping it would start up quicker because my biggest peeve with Tesla is that it takes time not only to open the app but there is a hundreds of ms delay in turning on the LED. I assume the complexities causing this are also what prevent LampA from working.

here's the one referenced in the Fox inerview from Snoopwall. They seem legit. http://www.snoopwall.com/flashlight-apps-spying-revealed/

also http://resources.infosecinstitute.com/android-app-permission...

What's wrong with downrating the app and moving on?

The original article gives flashlight apps as an example - all of the top 10 flashlight apps had such features; so "downrating the app and moving on" wouldn't be productive at least the first 10 times.

Better search features could help with this.

I'm in the "let them fake it" camp, but at the same time I think the exception throwing version could work, with a single tweak borrowed from iOS: Let the app ask for the permission once, and only once. That way repeatedly bugging the user for the permission won't work as a strategy.

Reply on news.ycombinator.com