Reducing Permission Requests in Mobile Apps

Abstract

Users of mobile apps sometimes express discomfort or concerns with what they see as unnecessary or intrusive permission requests by certain apps. However encouraging mobile app developers to request fewer permissions is challenging because there are many reasons why permissions are requested; furthermore, prior work [25] has shown it is hard to disambiguate the purpose of a particular permission with high certainty.In this work we describe a novel, algorithmic mechanism intended to discourage mobile-app developers from asking for unnecessary permissions. Developers are incentivized by an automated alert, or "nudge", shown in the Google Play Console when their apps ask for permissions that are requested by very few functionallysimilar apps-in other words, by their competition. Empirically, this incentive is effective, with significant developer response since its deployment. Permissions have been redacted by 59% of apps that were warned, and this attenuation has occurred broadly across both app categories and app popularity levels. Importantly, billions of users' app installs from the Google Play have benefited from these redactions.

Legal Obligation and Ethical Best Practice: Towards Meaningful Verbal Consent for Voice Assistants

“…Standardisation is also an important factor in promoting accuracy and speed when interpreting privacy notices, highlighting the importance of their implementation at the platform level [20]. On smartphone platforms many of these findings have been adopted by app stores, including privacy labels and nudging developers to remove permissions not requested by functionally similar apps [24,37]. Some platforms also allow users to restrict the granting of permissions to when the app is foregrounded or grant one-time permissions which expire when the app is closed.…”

A First Look at Privacy Analysis of COVID-19 Contact-Tracing Mobile Applications

“…Providing permission to various private information would expose the private information of users to the advertisers, insurance companies [23], [24], and publicly expose personal data of the users without the user's consent [25], [26]. A large number of smartphones app also ask unnecessary permission that is not required for the functionality of the app, these apps might pose a serious threat to privacy and security of the users [27], [28]. Muhammad et al [29], [30] analyzed the security and privacy of smartphone apps designed for blocking the advertisement and providing mobile VPN clients.…”

Mules and Permission Laundering in Android: Dissecting Custom Permissions in the Wild

“…Previous work on Android's permission system has focused on the usage and abuse of AOSP permissions [86], [61], over-privileged apps [71], [67], [82], detecting vulnerabilities and weaknesses in the permission system [74], [66], [76], [85], [84], [65] and assessed the efficacy and transparency of Android's permission model to empower users [73], [72], [78], [90]. Multiple tools were also created to study AOSP permissions.…”