Would you allow a stranger into your house without verifying who they were? Would you give a stranger the keys to your bedroom just because they asked? Most of us would say, ‘No’, but everyday, we unknowingly allow strangers to into our bedrooms just because they asked.
Let me introduce you to mobile app permissions.
You find an app online that you like so much, and you cannot wait to try it out. You download and install it on your mobile phone but before you can access its features, a prompt appears requesting various permissions including reading your saved contacts and media files. You do not read the request because you cannot wait to use the app – so you tap ‘accept’ as quickly as possible. Boom! Stranger in your bedroom.
Mobile apps require certain permissions for them to function properly on our phones and most app development policies require that developers make requests for these permissions before the app can be used. Unfortunately, because the average user does not always really know what permissions are necessary for a particular app or understand the implications of those permissions, they tend to accept all permission requests. However, some malicious app developers exploit this weakness and request for app permissions that are not needed for the app to function, for their own selfish purposes. For example, imagine a mobile game requesting access to your contact list or a calculator app requesting access to your media files. Isn’t that suspicious?
To reduce this problem, Google Inc., the owners of the Android operating system, constantly makes changes to their app developer policies to prevent developers from requesting for more permissions than their apps typically need, but these measures cannot totally prevent these unnecessary requests from happening. A malicious developer just needs to include a dummy feature in their app that would typically need the permission they want to exploit, to conceal their real intentions. Therefore, it is left for users to identify what permission an app type would ideally require. To help raise awareness around this problem, I was involved in a research project by Anirudh Ganesh, in which a persuasive game called PermaRun was developed to educate Android mobile phone users on the typical permissions that are required for various types of apps.
One simple general guideline is thus: “if it seems like the app does not need the permission it is requesting, then it probably does not need it.” Therefore, when installing apps on your devices, it is important to take the time to read these app permissions before accepting them. “A few seconds of scrutiny can save you from the stubborn stranger in your bedroom.”
Image by mohamed Hassan from Pixabay
