Application permissions

Permissions are a means of controlling and regulating access to specific system- and device-level functions by software. Typically, types of permissions cover functions that may have privacy implications, such as the ability to access a device's hardware features (including the camera and microphone), and personal data (such as device storage, the contacts list, and the user's present geographical location). Permissions are typically declared in an application's manifest, and certain permissions must be specifically granted at runtime by the user—who may revoke the permission at any time.

Permission systems are common on mobile operating systems, where permissions needed by specific apps must be disclosed via the platform's app store.

Mobile devices

On mobile operating systems for smartphones and tablets, typical types of permissions regulate:[1][2]

  • Access to storage and personal information, such as contacts, calendar appointments, etc.
  • Location tracking.
  • Access to the device's internal camera and/or microphone.
  • Access to biometric sensors, including fingerprint readers and other health sensors..
  • internet access.
  • Access to communications interfaces (including their hardware identifiers and signal strength where applicable, and requests to enable them), such as Bluetooth, Wi-Fi, Near-field communication (NFC), and others.
  • Making and receiving phone calls.
  • Sending and reading text messages
  • The ability to perform in-app purchases.
  • The ability to "overlay" themselves within other apps.
  • Installing, deleting and otherwise managing applications.
  • Authentication tokens (i.e. OAuth ones) of web services stored in system storage for sharing between apps.

Prior to Android 6.0 "Marshmallow", permissions were automatically granted to apps at runtime, and they were presented upon installation in Google Play Store. Since Marshmallow, certain permissions now require the app to request permission at runtime by the user. These permissions may also be revoked at any time via Android's settings menu.[3] Usage of permissions on Android are sometimes abused by app developers to gather personal information and deliver advertising; in particular, apps for using a phone's camera flash as a flashlight (which have grown largely redundant due to the integration of such functionality at the system level on later versions of Android) have been known to require a large array of unnecessary permissions beyond what is actually needed for the stated functionality.[4]

iOS imposes a similar requirement for permissions to be granted at runtime, with particular controls offered for enabling of Bluetooth, Wi-Fi, and location tracking.[5][6]

WebPermissions

WebPermissions is a permission system for web browsers.[7] When a web application needs some data behind a permission, it must request it first. When it does it, a user sees a window asking him to make a choice. The choice is remembered, but can be cleared lately.

Currently the following resources are controlled:

  • geolocation[8]
  • desktop notifications[9]
  • service workers[10][11]
  • sensors
    • audio capturing devices,[12] like soundcards, and their model names and characteristics
    • video capturing devices,[12] like cameras, and their identifiers and characteristics

Analysis

The permission-based access control model assigns access privileges for certain data objects to apps. This is a derivate of the discretionary access control model. The access permissions are usually granted in the context of a specific user on a specific device. Permissions are granted permanently with few automatic restrictions.

In some cases permissions are implemented in 'all-or-nothing' approach: a user either has to grant all the requested permissions to an app, or be unable to use the app. It remains intransparent to the user when the permission is used by a program or app to access the data protected by the permission access control mechanism. Even if a user can revoke a permission, the app can blackmail a user by refusing to operate, for example by just crashing.

The permission mechanism has been widely criticized by researchers for several reasons, including;

  • Intransparency of personal data extraction and surveillance, including the creation of a false sense of security[13][14];
  • End-user fatigue of micro-managing access permissions leading to a fatalistic acceptance of surveillance and intransparency[15];
  • Massive data extraction and personal surveillance carried out once the permissions are granted[16].

There are some solutions, such as XPrivacy, which instead of providing access to the requested data instead of throwing an exception and crashing an app returning disinformation to make an app operate as if the permission was granted. Mockdroid[17] is another instance of this approach. It is also possible to use static analysis to analyze the requested permissions.[18] Further transparency methods include longitudinal behavioural profiling and multiple-source privacy analysis of app data access[19][20] .

References
  1. "Manifest.permission - Android Developers". developer.android.com.
  2. "iOS Security Guide" (PDF).
  3. Cimpanu, Catalin. "Permission-greedy apps delayed Android 6 upgrade so they could harvest more user data". ZDNet. Retrieved 2020-01-10.
  4. Cimpanu, Catalin. "Most Android flashlight apps request an absurd number of permissions". ZDNet. Retrieved 2020-01-10.
  5. Cipriani, Jason. "Keep your location secret with iOS 13's new privacy features". CNET. Retrieved 2019-08-08.
  6. Welch, Chris (2019-09-19). "Here's why so many apps are asking to use Bluetooth on iOS 13". The Verge. Retrieved 2019-09-26.
  7. "Permissions". w3c.github.io. Retrieved 2019-05-10.
  8. "Geolocation API Specification 2nd Edition". www.w3.org.
  9. "Notifications API Standard". notifications.spec.whatwg.org.
  10. "Push API". www.w3.org.
  11. "Web Background Synchronization". wicg.github.io.
  12. "Media Capture and Streams". w3c.github.io.
  13. Moen, Gro Mette, Ailo Krogh Ravna, and Finn Myrstad: Deceived by Design - How tech companies use dark patterns to discourage us from exercising our rights to privacy., 2018, Consumer concil of Norway / Forbrukerrådet. Report. https://www.forbrukerradet.no/undersokelse/no-undersokelsekategori/deceived-by-design
  14. Fritsch, Lothar; Momen, Nurul (2017). "Derived Partial Identities Generated from App Permissions". Gesellschaft für Informatik: 117–130. Cite journal requires |journal= (help)
  15. Kelley, Patrick Gage; Consolvo, Sunny; Cranor, Lorrie Faith; Jung, Jaeyeon; Sadeh, Norman; Wetherall, David (2012). Blyth, Jim; Dietrich, Sven; Camp, L. Jean (eds.). "A Conundrum of Permissions: Installing Applications on an Android Smartphone". Financial Cryptography and Data Security. Lecture Notes in Computer Science. Springer Berlin Heidelberg. 7398: 68–79. doi:10.1007/978-3-642-34638-5_6. ISBN 978-3-642-34638-5.
  16. Momen, N.; Hatamian, M.; Fritsch, L. (November 2019). "Did App Privacy Improve After the GDPR?". IEEE Security Privacy. 17 (6): 10–20. doi:10.1109/MSEC.2019.2938445. ISSN 1558-4046.
  17. Beresford, Alastair R.; Rice, Andrew; Skehin, Nicholas; Sohan, Ripduman (2011). "MockDroid". Proceedings of the 12th Workshop on Mobile Computing Systems and Applications - HotMobile '11. New York, New York, USA: ACM Press: 49. doi:10.1145/2184489.2184500. ISBN 978-1-4503-0649-2.
  18. Bartel, Alexandre; Klein, Jacques; Le Traon, Yves; Monperrus, Martin (2012). "Automatically securing permission-based software by reducing the attack surface: an application to Android". Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering - ASE 2012. p. 274. arXiv:1206.5829. doi:10.1145/2351676.2351722. ISBN 9781450312042.
  19. Momen, Nurul (2018). "Towards Measuring Apps' Privacy-Friendliness". Diva.
  20. Hatamian, Majid; Momen, Nurul; Fritsch, Lothar; Rannenberg, Kai (2019). Naldi, Maurizio; Italiano, Giuseppe F.; Rannenberg, Kai; Medina, Manel; Bourka, Athena (eds.). "A Multilateral Privacy Impact Analysis Method for Android Apps" (PDF). Privacy Technologies and Policy. Lecture Notes in Computer Science. Springer International Publishing. 11498: 87–106. doi:10.1007/978-3-030-21752-5_7. ISBN 978-3-030-21752-5.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.