SkyDrive & apps, privacy concerns?
I have a bunch of apps on my Lumia 920 that can upload various things to SkyDrive. You have to authorize them first, but after that it seems that from the description they have a free reign over your account and all your files. There's a distinction between read & write rights, but if an app has read rights, it looks like it can access anything. That kind of concerns me, because even though I can probably trust these particular apps, but can I ever be really sure?
First of all, from a technical perspective, how does this access permission work? Is it really only this app, the bytes that are physically present on my phone that has these permissions, or have I created some sort of API key that anyone who has the key (the app publisher?) can use to exercise these rights? Take for example Mini Recorder, probably a perfectly harmless app, but below is what it asks of me. The 'access your info anytime' bothers me, because from Microsoft's description (which for me is in Dutch so I can't paste it here) it means that this access of data can happen from outside the app, which does seem to indicate I've given something outside the bits and bytes on my phone some access to my account.
And even if an app can only access my SkyDrive when it's running, that's still worrisome to me. I'm fine with this app writing and reading a folder that's specific to this app, but I'm definitely not okay with it having access to any sensitive photos and documents that I might have.
It seems to me like there should be a distinction between "this app wants to read to a certain folder" (in Mini Recorder's case it creates a folder Mini Recorder) and "this app will get access to your whole SkyDrive" (which you would want for certain apps). Or I would be able to label folders on my SkyDrive as "no apps can access this" or something along those lines.
I realize that you shouldn't consider any data in the cloud to be truly secure, but somehow this doesn't sit quite right with me either. And I also realize that the story isn't that much different on my PC where I'm typing this on, any process running under my user account can access pretty much anything and upload everything to some remote server. Technically there's 130 processes currently running on my PC that can do just that. But at least with a file system you can create some access restrictions, it gives you control. And maybe I feel differently because my PC is all local while SkyDrive lives somewhere on a remote server, though I'm not sure how much difference that makes.
I'm not really attacking SkyDrive, it just doesn't feel quite right.