Slashdot Mirror
Google's New SMS and Call Permission Policy is Crippling Apps Used by Millions (androidpolice.com)
Ryne Hager, writing for AndroidPolice: Late last year, Google decided it was time to crack down on apps requesting SMS and call log permissions. Ostensibly, exceptions would be granted for categories including backups and automation, but as of now, there are still gaps which cover legitimate use cases. While some popular apps like Tasker have successfully secured exemptions, others like Cerberus have not. Instead, they've decided to strip out those permissions or risk facing the wrath of Google's upcoming January 9th banhammer, killing associated functionality and disappointing millions of long-time users to adhere to the Play Store's new policy.
The Play Console support page for the applicable set of permissions notifies developers that they can submit what is effectively an application for an exemption, categories for which are listed on the same page. (And that list of exceptions has grown since the original announcement.) Nonetheless, a further set of prohibitions are also included in the form itself, which explicitly preclude support for phone security/device location apps like Cerberus.
The Play Console support page for the applicable set of permissions notifies developers that they can submit what is effectively an application for an exemption, categories for which are listed on the same page. (And that list of exceptions has grown since the original announcement.) Nonetheless, a further set of prohibitions are also included in the form itself, which explicitly preclude support for phone security/device location apps like Cerberus.
I honestly don't care where my apps are hosted. I use F-Droid more than Google Play anyway. I suspect someone wanting to use SMS to trigger a phone location are savvy enough to sort out alternate methods of getting the app.
Google can pull the ban hammer all they want, but until they also pull the walled garden hammer, people are going to be able to use the fact that it's still an open-ish platform to get the apps they want.
Users just need the ability to approve this on a per- app basis, not censorship.
Even better would be if users can choose to "approve" a permission but with fake data for those apps that try to overreach.
Well, if this were Apple, and going through their app store was the only legitimate way I could get an app onto my phone, then I would be upset at the high handedness of it. As it is, Android is still an open platform. People can get apps onto their phone other ways besides Google Play. So, if Google wants to start putting limits on what apps can have what permissions in order to appear in a store they own, go ahead. This particular permission is one that would be sought by apps used by more savvy people anyway. If Google wants to drive some of their more capable customers to other app repositories and stores, that bothers me none. I am, at the moment, happy with anything Google does to incentivize people to exert the activation energy required to move to more open app repositories.
If (maybe I should say "when" here) Google moves to make Android a walled garden with a sole-source on Google Play for apps, then you will see me become far more activist. But at the moment, Google is really only shooting themselves in the foot.
So, by all means, please carry on.
They were, the issue is that too many applications are misleading.
Given it isn't uncommon (unfortunately) for SMS to be used as a second factor its too unsafe to allow random applications to have access. Its also a common scam for using SMS permission to sign up for high cost services.
Permissions on apps have become stupid, and far too many apps are written and published by lying assholes.
It really is time to start treating these permissions as something an app doesn't need, and to prevent these fucking things from slurping your data and sending it off to some marketing asshole to be scraped and sold.
We passed peak smartphone and peak app quite some time ago, and while I've refused to become beholden to this crap, I see far too many stories about shady apps which request crazy permissions and mostly seem to exist to defraud you.
No thanks, don't need your fucking apps.
Sorry but collection of sensitive data for profit, is a much bigger concern than a few legitimate apps being broken. Now, if only we could do something about Google's data-mining
Remember when Windows came out, and it had tons of shitty security assumptions and bad default settings in place, and then MS had to spend decades cleaning up that mess? Good times.
In the early 2000s, Google should have been smart enough to know that "by default, just let anyone do anything" was a bad place to start.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
How bout an app that uses SMS as a remote control channel for when you lose your phone? This handy app: https://www.androidlost.com/ is about to get neutered. According to the forums, the author is doing all the right things with respect to applying for exemptions, and is going to get whacked anyway. If an app with this one's long history of good work gets blasted, any indie author is toast.
Then they never abide by it, and in fact do things that seem far more sinister than what they're claiming to prevent others from doing:
https://qz.com/1131515/google-collects-android-users-locations-even-when-location-services-are-disabled/
- Alex
> $100 says those exact same people will soon be complaining . . .
> Another $50 that they all get modded up to +5
One thousand quatloos that both sides will complain about google no matter what google does.
I for one, hate just how much google knows about me . . . . um . . . hey google can you recommend a movie that I might like?
I'll see your senator, and I'll raise you two judges.
Google could put the permissions an app wants in a clear place in the app store so that I could consider the information BEFORE I tried to install the dang thing. As it is, you have to install it, go "Nope", then un-install it and find another app that does the same thing so that you can repeat the process.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
replying to undo accidental mod
Sadly this is the only way on Android. There is no way to attach an event to a message without access to call logs and the inbox.
And what pressure is there for Google to fix its lazy-ass API's when it can just whack indy app developers? Are these people going to go to iPhone? No, most people can't afford one.
Oh, what's that you say, a third-party app store that has the more useful apps and only charges 5%? Interesting.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Any good reason why any app would want to see my call logs or sms!
Your lack if imagination isn't relevant here. I, for instance, use an app that enters all my calls into a work calendar where I have a background script that organizes them per-client. That gets automated into the billing system.
Maybe they'll get an exception, who knows ... I doubt it. Google is too lazy to add fine-grained control to its APIs and doesn't care much about uncommon use cases or if it puts a bunch of developers out of business. There are 99.5% more where they came from and growing. And they all hand over 30% of their revenue to Google.
The incentives are not aligned for Google to do the right thing and care about minorities.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
So why can't Cerberus use the SMS Retriever API for their functionality? For what they're doing they don't need to see every SMS message or call log entry on the device, they just need to see and respond to the single SMS message sent by their servers which is exactly what the Retriever API is designed for. It requires a loop, it'd be nice if there was a way for an app to register a permanent retriever so that loop wasn't necessary, but it shouldn't require a half-decent Android developer more than a day or two to code up the functionality needed. All these devs are doing is throwing a hissy fit instead of acknowledging why Google found these restrictions necessary and working within them (or working with Google to implement just the functionality needed). I suddenly feel a need to research any app or company complaining about this to see exactly why they're so upset about losing access to a data stream that it doesn't seem they should care about in the first place.
While I am not ready to entirely cut my ties with Google, it is time for some distance.
This month I wiped my Android ROM and loaded microG. This does complicate access to Google services, but I am willing to accept that.
I do have a lifetime Cerberus membership, and I have downloaded their full-featured APK directly, bypassing Google. UBER continues to work without error (and yes, I know UBER is also a privacy nightmare). I have downloaded many other apps from Google Play, most of which work perfectly with the microG compatibility libraries.
Knowledgeable people should act by excising spyware when they can. For Google Mobile Services on my daily driver, it was time.
This might be useful to you, as I believe it returns nonsensical data, rather than throwing an error.
Between Google's various experiments with locking down storage (e.g. I have an older tablet where epub readers cannot read epub files saved to the local storage) and crap like this, it feels amazingly like my time period with Windows Phone.
I wonder if they're going to remove all the third-party SMS apps like Textra (but of course the built-in messenger and Hangouts will work). Location? That should only be accessible to Google-branded apps.
It's going to be like Apple in terms of being locked down, but without the ability to actually talk to any human beings.
fencepost
just a little off
Nope, only the NSA Kernel SMS backdoor remains
How bout an app that uses SMS as a remote control channel for when you lose your phone?
Use data instead. Problem solved.
+1 the all or nothing approach is the problem.
Solutions have been conceived but after years in this game Google has yet to do anything more sensible.
Anyone have pointers to an alternative OS with any traction that is not Apple or Microsoft or anyone Chinese? I have an older phone handy to play with