SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Application permissions</title>

</head>

Application permissions

</h1>

</header>

Permissions are a means of controlling and regulating access to specific system- and device-level functions by software. Typically, types of permissions cover functions that may have privacy implications, such as the ability to access a device's hardware features (including the camera and microphone), and personal data (such as storage devices, contacts lists, and the user's present geographical location). Permissions are typically declared in an application's manifest, and certain permissions must be specifically granted at runtime by the user—who may revoke the permission at any time.

Permission systems are common on mobile operating systems, where permissions needed by specific apps must be disclosed via the platform's app store.

<div class="mw-heading mw-heading2"><h2 id="Mobile_devices">Mobile devices</h2></div>

On mobile operating systems for <a href="Smartphone" title="Smartphone">smartphones</a> and <a href="Tablet_computer" title="Tablet computer">tablets</a>, typical types of permissions regulate:<a href="#cite_note-1">[1]</a><a href="#cite_note-2">[2]</a>

<ul><li>Access to <a href="Data_storage" title="Data storage">storage</a> and personal information, such as <a href="Contact_list" title="Contact list">contacts</a>, calendar appointments, etc.</li>

<li><a href="Geolocation" class="mw-redirect" title="Geolocation">Location tracking</a>.</li>

<li>Access to the device's internal <a href="Digital_camera" title="Digital camera">camera</a> and/or <a href="Microphone" title="Microphone">microphone</a>.</li>

<li>Access to <a href="Biometric_device" title="Biometric device">biometric</a> sensors, including <a href="Fingerprint_reader" class="mw-redirect" title="Fingerprint reader">fingerprint readers</a> and other health sensors..</li>

<li><a href="Internet" title="Internet">Internet</a> access.</li>

<li>Access to communications interfaces (including their hardware identifiers and signal strength where applicable, and requests to enable them), such as <a href="Bluetooth" title="Bluetooth">Bluetooth</a>, <a href="Wi-Fi" title="Wi-Fi">Wi-Fi</a>, <a href="Near-field_communication" title="Near-field communication">NFC</a>, and others.</li>

<li>Making and receiving <a href="Phone_call" class="mw-redirect" title="Phone call">phone calls</a>.</li>

<li>Sending and reading <a href="SMS" title="SMS">text messages</a></li>

<li>The ability to perform <a href="In-app_purchase" class="mw-redirect" title="In-app purchase">in-app purchases</a>.</li>

<li>The ability to "overlay" themselves within other apps.</li>

<li>Installing, deleting and otherwise managing applications.</li>

<li>Authentication tokens (e.g., <a href="OAuth" title="OAuth">OAuth</a> tokens) from web services stored in system storage for sharing between apps.</li></ul>

Prior to <a href="Android_Marshmallow" title="Android Marshmallow">Android 6.0 "Marshmallow"</a>, permissions were automatically granted to apps at runtime, and they were presented upon installation in <a href="Google_Play_Store" class="mw-redirect" title="Google Play Store">Google Play Store</a>. Since Marshmallow, certain permissions now require the app to request permission at runtime by the user. These permissions may also be revoked at any time via Android's settings menu.<a href="#cite_note-3">[3]</a> Usage of permissions on Android are sometimes abused by app developers to gather <a href="Personal_data" title="Personal data">personal information</a> and deliver advertising; in particular, apps for using a phone's camera flash as a <a href="Flashlight" title="Flashlight">flashlight</a> (which have grown largely redundant due to the integration of such functionality at the system level on later versions of Android) have been known to require a large array of unnecessary permissions beyond what is actually needed for the stated functionality.<a href="#cite_note-4">[4]</a> According to a 2024 study conducted by <a href="NordVPN" title="NordVPN">NordVPN</a>, 58% of mobile apps request access to sensitive data such as location and storage, while 55% of these apps request permissions primarily for advertising purposes.<a href="#cite_note-5">[5]</a> This trend highlights growing concerns about how mobile apps access personal information, often beyond what is necessary for the app’s core functionality.

iOS imposes a similar requirement for permissions to be granted at runtime, with particular controls offered for enabling of Bluetooth, Wi-Fi, and location tracking.<a href="#cite_note-6">[6]</a><a href="#cite_note-7">[7]</a>

<div class="mw-heading mw-heading2"><h2 id="WebPermissions">WebPermissions</h2></div>

WebPermissions is a permission system for <a href="Web_browsers" class="mw-redirect" title="Web browsers">web browsers</a>.<a href="#cite_note-8">[8]</a> When a <a href="Web_application" title="Web application">web application</a> needs some data behind permission, it must request it first. When it does it, a user sees a window asking him to make a choice. The choice is remembered, but can be cleared lately.

Currently the following resources are controlled:

<ul><li>geolocation<a href="#cite_note-9">[9]</a></li>

<li>desktop notifications<a href="#cite_note-10">[10]</a></li>

<li>service workers<a href="#cite_note-11">[11]</a><a href="#cite_note-12">[12]</a></li>

<li>sensors

<ul><li>audio capturing devices,<a href="#cite_note-w3c.github.io-13">[13]</a> like <a href="Sound_card" title="Sound card">sound cards</a>, and their model names and characteristics</li>

<li>video capturing devices,<a href="#cite_note-w3c.github.io-13">[13]</a> like <a href="Webcam" title="Webcam">cameras</a>, and their identifiers and characteristics</li></ul></li></ul>

<div class="mw-heading mw-heading2"><h2 id="Analysis">Analysis</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style>

The permission-based access control model assigns access privileges for certain data objects to application. This is a derivative of the discretionary access control model. The access permissions are usually granted in the context of a specific user on a specific device. Permissions are granted permanently with few automatic restrictions.

In some cases permissions are implemented in 'all-or-nothing' approach: a user either has to grant all the required permissions to access the application or the user can not access the application. There is still a lack of transparency when the permission is used by a program or application to access the data protected by the permission access control mechanism. Even if a user can revoke a permission, the app can <a href="Blackmail" title="Blackmail">blackmail</a> a user by refusing to operate, for example by just <a href="Crash_(computing)" title="Crash (computing)">crashing</a> or asking user to grant the permission again in order to access the application.

The permission mechanism has been widely criticized by researchers for several reasons, including;

<ul><li>Intransparency of personal data extraction and surveillance, including the creation of a false sense of security;<a href="#cite_note-14">[14]</a><a href="#cite_note-15">[15]</a></li>

<li>End-user fatigue of micro-managing access permissions leading to a fatalistic acceptance of surveillance and intransparency;<a href="#cite_note-16">[16]</a></li>

<li>Massive data extraction and personal <a href="Surveillance" title="Surveillance">surveillance</a> carried out once the permissions are granted.<a href="#cite_note-17">[17]</a><a href="#cite_note-18">[18]</a></li></ul>

Some apps, such as XPrivacy and Mockdroid<a href="#cite_note-19">[19]</a> <a href="Forgery" title="Forgery">spoof</a> data in order to act as a measure for privacy. Further transparency methods include longitudinal behavioural profiling and multiple-source privacy analysis of app data access.<a href="#cite_note-20">[20]</a><a href="#cite_note-21">[21]</a>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://developer.android.com/reference/android/Manifest.permission.html">"Manifest.permission - Android Developers"</a>. developer.android.com.</cite>

</li>

<li id="cite_note-2"><a href="#cite_ref-2">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.apple.com/business/docs/iOS_Security_Guide.pdf">"iOS Security Guide"</a> (PDF).</cite>

</li>

<li id="cite_note-3"><a href="#cite_ref-3">^</a> <cite id="CITEREFCimpanu" class="citation web cs1">Cimpanu, Catalin. <a rel="nofollow" class="external text" href="https://www.zdnet.com/article/permission-greedy-apps-delayed-android-6-upgrade-so-they-could-harvest-more-user-data/">"Permission-greedy apps delayed Android 6 upgrade so they could harvest more user data"</a>. ZDNet. Retrieved 2020-01-10.</cite>

</li>

<li id="cite_note-4"><a href="#cite_ref-4">^</a> <cite id="CITEREFCimpanu" class="citation web cs1">Cimpanu, Catalin. <a rel="nofollow" class="external text" href="https://www.zdnet.com/article/most-android-flashlight-apps-request-an-absurd-number-of-permissions/">"Most Android flashlight apps request an absurd number of permissions"</a>. ZDNet. Retrieved 2020-01-10.</cite>

</li>

<li id="cite_note-5"><a href="#cite_ref-5">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://nordvpn.com/research-lab/mobile-app-research/">"Mobile privacy: What do your apps want to know? | NordVPN"</a>. nordvpn.com. Retrieved 2024-09-17.</cite>

</li>

<li id="cite_note-6"><a href="#cite_ref-6">^</a> <cite id="CITEREFCipriani" class="citation web cs1">Cipriani, Jason. <a rel="nofollow" class="external text" href="https://www.cnet.com/how-to/keep-your-location-secret-with-ios-13s-new-privacy-features/">"Keep your location secret with iOS 13's new privacy features"</a>. <a href="CNET" title="CNET">CNET</a>. Retrieved 2019-08-08.</cite>

</li>

<li id="cite_note-7"><a href="#cite_ref-7">^</a> <cite id="CITEREFWelch2019" class="citation web cs1">Welch, Chris (2019-09-19). <a rel="nofollow" class="external text" href="https://www.theverge.com/2019/9/19/20867286/ios-13-bluetooth-permission-privacy-feature-apps">"Here's why so many apps are asking to use Bluetooth on iOS 13"</a>. <a href="The_Verge" title="The Verge">The Verge</a>. Retrieved 2019-09-26.</cite>

</li>

<li id="cite_note-8"><a href="#cite_ref-8">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://w3c.github.io/permissions/">"Permissions"</a>. w3c.github.io. Retrieved 2019-05-10.</cite>

</li>

<li id="cite_note-9"><a href="#cite_ref-9">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.w3.org/TR/geolocation-API/">"Geolocation API Specification 2nd Edition"</a>. www.w3.org.</cite>

</li>

<li id="cite_note-10"><a href="#cite_ref-10">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://notifications.spec.whatwg.org/">"Notifications API Standard"</a>. notifications.spec.whatwg.org.</cite>

</li>

</li>

<li id="cite_note-12"><a href="#cite_ref-12">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://wicg.github.io/BackgroundSync/spec/">"Web Background Synchronization"</a>. wicg.github.io.</cite>

</li>

<li id="cite_note-w3c.github.io-13">^ <a href="#cite_ref-w3c.github.io_13-0">a</a> <a href="#cite_ref-w3c.github.io_13-1">b</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://w3c.github.io/mediacapture-main/">"Media Capture and Streams"</a>. w3c.github.io.</cite>

</li>

<li id="cite_note-14"><a href="#cite_ref-14">^</a> Moen, Gro Mette, Ailo Krogh Ravna, and Finn Myrstad: Deceived by Design - How tech companies use dark patterns to discourage us from exercising our rights to privacy., 2018, Consumer council of Norway / Forbrukerrådet. Report. <a rel="nofollow" class="external free" href="https://www.forbrukerradet.no/undersokelse/no-undersokelsekategori/deceived-by-design">https://www.forbrukerradet.no/undersokelse/no-undersokelsekategori/deceived-by-design</a> <a rel="nofollow" class="external text" href="https://web.archive.org/web/20201011180604/https://www.forbrukerradet.no/undersokelse/no-undersokelsekategori/deceived-by-design">Archived</a> 2020-10-11 at the <a href="Wayback_Machine" title="Wayback Machine">Wayback Machine</a>

</li>

<li id="cite_note-15"><a href="#cite_ref-15">^</a> <cite id="CITEREFFritschMomen2017" class="citation journal cs1">Fritsch, Lothar; Momen, Nurul (2017). <a rel="nofollow" class="external text" href="http://urn.kb.se/resolve?urn=urn:nbn:se:kau:diva-63724">"Derived Partial Identities Generated from App Permissions"</a>. Gesellschaft für Informatik: 117–130.</cite> <code class="cs1-code">{{cite journal}}</code>: Cite journal requires <code class="cs1-code">|journal=</code> (help)

</li>

<li id="cite_note-16"><a href="#cite_ref-16">^</a> <cite id="CITEREFKelleyConsolvoCranorJung2012" class="citation book cs1">Kelley, Patrick Gage; <a href="Sunny_Consolvo" title="Sunny Consolvo">Consolvo, Sunny</a>; Cranor, Lorrie Faith; Jung, Jaeyeon; Sadeh, Norman; Wetherall, David (2012). "A Conundrum of Permissions: Installing Applications on an Android Smartphone". In Blyth, Jim; Dietrich, Sven; Camp, L. Jean (eds.). Financial Cryptography and Data Security. Lecture Notes in Computer Science. Vol. 7398. Springer Berlin Heidelberg. pp. 68–79. <a href="CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.232.4261">10.1.1.232.4261</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F978-3-642-34638-5_6">10.1007/978-3-642-34638-5_6</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-642-34638-5</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:17861847">17861847</a>.</cite>

</li>

<li id="cite_note-17"><a href="#cite_ref-17">^</a> <cite id="CITEREFMomenHatamianFritsch2019" class="citation journal cs1">Momen, N.; Hatamian, M.; Fritsch, L. (November 2019). <a rel="nofollow" class="external text" href="http://urn.kb.se/resolve?urn=urn:nbn:se:kau:diva-75508">"Did App Privacy Improve After the GDPR?"</a>. IEEE Security & Privacy. 17 (6): 10–20. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1109%2FMSEC.2019.2938445">10.1109/MSEC.2019.2938445</a>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/1558-4046">1558-4046</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:203699369">203699369</a>.</cite>

</li>

<li id="cite_note-18"><a href="#cite_ref-18">^</a> <cite id="CITEREFMomen2020" class="citation journal cs1">Momen, Nurul (2020). <a rel="nofollow" class="external text" href="http://urn.kb.se/resolve?urn=urn:nbn:se:kau:diva-79308">"Measuring Apps' Privacy-Friendliness : Introducing transparency to apps' data access behavior"</a>.</cite> <code class="cs1-code">{{cite journal}}</code>: Cite journal requires <code class="cs1-code">|journal=</code> (help)

</li>

<li id="cite_note-19"><a href="#cite_ref-19">^</a> <cite id="CITEREFBeresfordRiceSkehinSohan2011" class="citation book cs1">Beresford, Alastair R.; Rice, Andrew; Skehin, Nicholas; Sohan, Ripduman (2011). "MockDroid". Proceedings of the 12th Workshop on Mobile Computing Systems and Applications. New York, New York, USA: ACM Press. pp. 49–54. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F2184489.2184500">10.1145/2184489.2184500</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-4503-0649-2</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:2166732">2166732</a>.</cite>

</li>

<li id="cite_note-20"><a href="#cite_ref-20">^</a> <cite id="CITEREFMomen2018" class="citation journal cs1">Momen, Nurul (2018). <a rel="nofollow" class="external text" href="http://urn.kb.se/resolve?urn=urn:nbn:se:kau:diva-68569">"Towards Measuring Apps' Privacy-Friendliness"</a>. Diva.</cite>

</li>

<li id="cite_note-21"><a href="#cite_ref-21">^</a> <cite id="CITEREFHatamianMomenFritschRannenberg2019" class="citation book cs1">Hatamian, Majid; Momen, Nurul; Fritsch, Lothar; Rannenberg, Kai (2019). <a rel="nofollow" class="external text" href="https://zenodo.org/record/3248889">"A Multilateral Privacy Impact Analysis Method for Android Apps"</a>. In Naldi, Maurizio; Italiano, Giuseppe F.; Rannenberg, Kai; Medina, Manel; Bourka, Athena (eds.). Privacy Technologies and Policy. Lecture Notes in Computer Science. Vol. 11498. Springer International Publishing. pp. 87–106. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F978-3-030-21752-5_7">10.1007/978-3-030-21752-5_7</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-030-21752-5</bdi>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:184483219">184483219</a>.</cite>

</li>

</ol></div></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-07-25" href="https://en.wikipedia.org/wiki/?title=Application_permissions&oldid=1302499672">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>