For what it's worth: I've forever been on the lookout of an app that sits in the background and informs users of bad apps -- and suggest cleaner alternatives.
I'm tired of watching my non-technical family's phones slow down to a sludge because of these apps. Give them a rotten tomatoes like score collected from users, and pretty soon users will stop installing the low scored, ad filled, battery hogging apps.
It's a good tool, certainly much better than the play store's almost hidden "View permissions" link.
Perhaps it can be enhanced to take into account API level differences too, since that sometimes has a significant impact on what the app is allowed to do.
For example, READ_CONTACTS allows an application to read the user's contacts data, but in IceCreamSandwich and lower, it also allows the app to read call logs, which is an altogether different set of data in the eyes of an end user.
Combine that with INTERNET permission, and basically you have an app which can send all your call logs to whomever it wants.
Interesting, I did not realize READ_CONTACTS gave access to call logs in <= IceCreamSandwich.
I wish Android used a permissions model similar to iOS, where the application prompts the user for specific permissions as needed, rather than up front.
Perhaps the most reliable way to know exactly what all a permission allows, is to write an analyzer tool that analyzes android platform sources and/or bytecode looking for calls to permission APIs, creates a list of such calling methods, and finally maps these callers to what data they affect.
Not sure if the underlying native binaries too use these permissions, but if they do, they too can probably be analyzed.
Cool site, but it doesn't seem to work. It doesn't display the same list that the app displays. Reading the list the app displays looks scary. Reading the list on the site makes it sem ok
7 comments
[ 2.9 ms ] story [ 26.1 ms ] threadI'm tired of watching my non-technical family's phones slow down to a sludge because of these apps. Give them a rotten tomatoes like score collected from users, and pretty soon users will stop installing the low scored, ad filled, battery hogging apps.
I am planning on surfacing some type of rating or score, derived from the required permissions, in the near future.
Perhaps it can be enhanced to take into account API level differences too, since that sometimes has a significant impact on what the app is allowed to do.
For example, READ_CONTACTS allows an application to read the user's contacts data, but in IceCreamSandwich and lower, it also allows the app to read call logs, which is an altogether different set of data in the eyes of an end user.
Combine that with INTERNET permission, and basically you have an app which can send all your call logs to whomever it wants.
I wish Android used a permissions model similar to iOS, where the application prompts the user for specific permissions as needed, rather than up front.
Not sure if the underlying native binaries too use these permissions, but if they do, they too can probably be analyzed.
I wonder if such a tool already exists.