clock menu more-arrow no yes mobile

Filed under:

EFF criticizes Google for removing secret Android app permission manager

New, 75 comments
Android doll mascot logo
Android doll mascot logo

Android users should be familiar with app permissions, those often-unsettling lists of everything on your device that an app requests access to in order to be installed. Unfortunately, apps all-too-frequently demand access to more than they really need to keep running — a flashlight app, for instance, probably doesn't need to know your location. Google appeared to be in the process of addressing the problem when it shipped a hidden permissions management tool, called App Ops, inside of Android 4.3 and 4.4. But with the release of update 4.4.2 last week, App Ops has suddenly vanished.

"The disappearance ... is alarming news for Android users."

Now the Electronic Frontier Foundation is criticizing Google for the removal, saying that it constitutes a serious privacy issue for Android. "The disappearance of App Ops is alarming news for Android users," Peter Eckersley, the EFF's technology projects director, writes in a blog post. The tool allowed Android users to turn on and off individual permissions that an app requested, allowing them to deny those that they would rather not grant. "The fact that [Android users] cannot turn off app permissions is a Stygian hole in the Android security model," Eckersley writes.

Google declined to comment for this article, but it reportedly tells the EFF that App Ops wasn't actually meant to be released — that it was an experimental feature and it could potentially break apps. But the EFF suggests that App Ops was in full working order; it may have broken an app if you denied a permission that was truly necessary, but the security benefit was worth it. It's likely that Google did unintentionally release the tool though: it was buried inside of Android, and in order to use it you'd have to enable it through a third-party app specifically built to do so.

Even so, the EFF is now pushing for Google to re-release App Ops alongside a number of improvements to it. "A moment ago, it looked as though Google cared about this massive privacy problem," Eckersley writes. "Now we have our doubts." Properly releasing App Ops would certainly be welcomed by many Android users as a way to mitigate privacy concerns. Knowing that Google is holding back a functional — albeit potentially troublesome — security feature though will likely further frustrate the very users who'd love to take advantage of it.