Most Android Flashlight Apps Request An Absurd Number of Permissions (zdnet.com) 109
Out of 937 flashlight apps on the Play Store, Avast Security Evangelist Luis Corrons found that the vast majority requested a large number of permissions, with the average being of 25 permissions per app. ZDNet reports: "There might be variables average users are not aware of and that are needed for these apps to work, but if 408 of the apps need just 10 permissions or less, which seems fairly reasonable, how come there are 262 apps that require 50 permissions or more," Corrons said in a report published this week. The Avast researcher said he found 77 flashlight apps that requested more than 50 permissions, which is about a third of the total number of permissions the Android OS supports. The champions were two apps that requested 77 permissions, followed by another three, which requested 76. But while Corrons said that some apps appeared to justify some of the permissions they asked for, these were only an exception to the rule.
So... (Score:4, Funny)
Re: (Score:2, Insightful)
10 permissions or less, which seems fairly reasonable
Reasonable? In what bizarro parallel universe is that reasonable? It is retarded fuckery.
Re:So... (Score:5, Insightful)
What's important is not how many permissions they want, but which permissions. If a flashlight app only wants one permission, read/write root access, that's probably not the one you want to install.
So what kind of permissions do these apps need anyway? Access to the flashlight, and... what else?
Re: (Score:3)
I just had a look at the list on the site, and I'm flabbergasted how these apps manage to get onto the Play Store. Doesn't Google have any review process at all?
You can say a lot about Apple's "walled garden", but if I try to upload a flashlight app that requests permission to record audio, read contacts, place phone calls, or any other absurd permission obviously unrelated to the app's functionality, the app is simply rejected with a message that it shouldn't need those permissions, and that I should eithe
Re: So... (Score:2)
Re: (Score:2)
Doesn't Google have any review process at all?
No. Unlike Apple's app store, Google Play is a completely open marketplace. Anyone can post an app there without needing permission from anyone. They scan for malware, and apps can get removed for violating their policies. But Google doesn't review them in advance to decide whether your app deserves to be in their store.
Re:So... (Score:5, Interesting)
AFAIK you have to get camera permissions because unless the camera is active you can't force the flash on. I assume it's a driver limitation that's too big to fix. Most apps request phone permissions because they all want to change state when you receive a phone call; in this case to switch the light off so you don't blind the person unfortunate enough to be sitting next to you when you take a call. It's a limitation of android that instead of a specific kind of app suspension message you respond to you have to get permission to know everything about the incoming call. You'll get a "backgrounded" message but last I checked you can't tell if it's because the user is switching to something they want to use WHILE the light is on, or if it's something they likely want to deal with separately like a phone call, so grabby permissions it is. The file permission I think is because although android provides a way to save preferences it's an unusual interface and full of gotchas so I suspect most devs just say "to hell with it" and request access to the file system so they can save stuff in a damned file. My experience with android development is that everything is just weird for weird's sake and it surprises me not one iota that most app devs take whatever shortcuts are available to them.
iOS on the other hand is pretty sensible, it's just learning Swift/ObjC that's the issue initially. But the big problem with iOS tends to be that the answer to "How do I...?" is "you can't" with the longer answer being "Apple don't want people abusing X to do Y so you don't get to solve your problems."
Re: (Score:1)
And access to contacts? (Read AND write?!)? Recording audio? Downloads without notification? Kill background processes? GPS location? SMS messages?
Re: (Score:2)
It's a flashlight app, it turns on your camera flash LED or makes the screen white, that's it. The only permission it requires is to access the camera, and only when the app is active (not background).
Most phones have this functionality built in anyway now (it's been part of stock Android for years). Most of these apps are scams, claiming to be the "brightest" or other obvious BS.
Re: (Score:2)
The fact that are 70 some needless apps for what's essentially a built-in function -minus a few pointless bells and whistles; should clue most people in.. this is a lazy script kiddie way to just mine phone data.
Why would anyone actually install these, particularly given the permissions requested..?
Re: (Score:2)
Why would anyone actually install these, particularly given the permissions requested..?
Because they are lazy, and don't understand the implications of those permissions.
Re: (Score:2)
Why would anyone actually install these, particularly given the permissions requested..?
Because they are lazy, and don't understand the implications of those permissions.
Strangely, this also applies to elections.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Holy crap that worked.
I don't have hey google enabled but if i do the main search widget and press mic it does.
Re: (Score:2)
Seriously. A flashlight app only need access to one thing. The camera flash.....
Re: (Score:2)
Er ... (Score:5, Insightful)
Er ... doesn't Android come with a flashlight app?
Re: (Score:2)
It's not provided by Google or the AOSP but is sometimes a system app provided by the device OEM. LG Phones have a flashlight baked in but Samsung and Motorola phones I've seen don't.
Re:Er ... (Score:5, Informative)
I run AOSP on a Pixel phone. Flashlight is right in the drop down menu from the top.
Re:Er ... (Score:4, Informative)
Re:Er ... (Score:5, Informative)
Re: (Score:3)
My Moto Z Play toggles the light if you shake it in a tomahawk-chop kind of motion. There might also be a settings toggle or something else to control it, but I've only ever shaken it to turn it on and off.
Re: (Score:3)
Re:Er ... (Score:4, Informative)
My last 3 or 4 samsungs all have had a flashlight... its just a button in the pull down menu... next to turning wifi on and off, blue tooth on and off, whether to lock the orientation, screen brightness, etc...
Re: (Score:1)
Although unlocking the phone, pulling down the menu and tapping on the flashlight icon is not particularly laborious and means that the flashlight is unlikely to be illuminated by accident, following the same procedure to switch off the flashlight can seem interminable if every second of battery life is vital.
I don't know if this is already a well known shortcut but to switch off my (Samsung) phone's flashlight I just double press the home button to start the camera, which immediately shuts off the flashlgh
Re: (Score:1)
(Should have read ...all the DSP used by the CAMERA.... and ... from time to time CAMERA tells me...)
Re: (Score:2)
Although unlocking the phone, pulling down the menu and tapping on the flashlight icon is not particularly laborious and means that the flashlight is unlikely to be illuminated by accident, following the same procedure to switch off the flashlight can seem interminable if every second of battery life is vital.
I don't know if this is already a well known shortcut but to switch off my (Samsung) phone's flashlight I just double press the home button to start the camera, which immediately shuts off the flashlght. Then back out of camera and shut off the screen.
This can save several seconds of flashlight time and even uses less Illuminated screen time.
I hesitated for a while before posting this in case an Android Professional might flame me and say that all the DSP used by the phone uses much more power than the flashlight until I remembered that from time to time Phone tells me it is working ok but there is not enough battery to even FLASH the flashlight.
Wow - I have a little flashlight in my pocket on a keychain. I know i'm not a modern hepcat, but for all of the hassle, or downloading an app that's obviously a data collection device, and the general shittieness of the weak smartphone lights in the first pace - why do people even use a phone as a flashlight?
Re: (Score:1)
Re: (Score:2)
Re:Er ... (Score:5, Informative)
It's not provided by Google or the AOSP
Google added the flashlight as core functionality in Lollipop. OEMs did it before then. It's not a separate app, look for a button somewhere in the swipe down menu.
Re: (Score:2)
My Motorola phone not only has flashlight functionality, but i access it through Moto actions. Turn the phone sideways and chop chop chop like you're cutting veggies and the light comes on. I can also do it the old fashioned way and turn it on from the pulldown, but i never do.
Re: (Score:2)
Re: (Score:2)
My Last 2 Samsung phones have had the flashlight built in. It's not an "App" per se, you can access it directly from the pull down menu similar to your Wifi/BT switches and brightness settings.
Re: Er ... (Score:1)
Re: (Score:2, Informative)
If not, then I recommend Simple Flashlight [f-droid.org].
In fact I recommend all of the Simple apps. They don't use any more permission than they absolutely need, they don't spy on you and they have a fantastic *offline* calendar (Simple Calendar [f-droid.org]) that doesn't rely upon Google's spyware calendar or libraries.
Re: (Score:3)
4.9Mb to turn on the LED?
Re: (Score:2)
Java with graphics.
Re: (Score:3)
90% of that is the app icon. Another 9.99% is boilerplate Java code and XML files from the Hello World sample app.
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Built in apps come with the ultimate permissions that you cannot deny.
So does MonsterStrike (Score:2)
but that is a game so then Google if fine with that absurd invasion of your privacy.
Wanna play the game, be prepared to give up all you privacy, including all contact information of your friends.
Re:So does MonsterStrike (Score:4, Interesting)
Like as not all or most of your friends and relatives are already on Facebook and even if you haven't given up your Privacy, more than likely someone did it on your behalf. Shadow Profiles are real.
Search by permissions!!!!1!!!one!!!eleven!!!!11!1 (Score:5, Insightful)
This is why it's absolutely insane that you can't search by permissions on the Play Store.
Re: (Score:1)
Not good for any ad company.
Re:Search by permissions!!!!1!!!one!!!eleven!!!!11 (Score:4, Interesting)
This is why it's absolutely insane that you can't search by permissions on the Play Store.
How are you thinking that would work? Do you actually want to search for all apps that require specific permissions? Maybe what you mean isn't "search" but "filter"? I can see the utility in searching for some keywords then filtering out the results that require some permission, or large numbers of permission, etc., but not "search by permissions".
Re: (Score:2)
How are you thinking that would work? Do you actually want to search for all apps that require specific permissions? Maybe what you mean isn't "search" but "filter"?
That's really splitting hairs lol
Re: (Score:2)
How are you thinking that would work? Do you actually want to search for all apps that require specific permissions? Maybe what you mean isn't "search" but "filter"?
That's really splitting hairs lol
My questions aren't idle. I'm considering filing a feature request against the Play store. If you're a programmer you understand that such details matter.
Re: (Score:2)
Re: (Score:2)
Should be pretty easy.. Search for a term such as 'Flashlight app' Then have a filter that allows you to deselect the collective permissions of all the apps in the results. Then you whittle down to what you want.. Seems pretty straight forward.
Yes, that makes sense to me, something like the filtering available on many shopping sites. "Search by permissions" doesn't make sense to me, but I thought it reasonable to ask in case I my guess as to what reanjr was really asking for was wrong.
Nothing wrong with it (Score:5, Funny)
I downloaded a flashlight app written by a recently civilized yak herder from Mongolia and I was worried about all the permissions that it required, so I contacted the developer.
A flashlight app requires access to your contacts so it can send a free copy of itself to all of your friends. It needs access to your calendar in order to schedule a remainder to install a payware version of itself and all other apps made by the same developer. It requires access to your location in order to adjust light intensity at based on time of day. It requires access to the storage and camera so it can take pictures of cute fury animals that got into your trashcan. I forgot why, but it also requires the permission to scan and disconnect the wifi networks and the ability to awaken your phone during sleep.
Also check out the FREE volume control app, free volume boost app, phone speed up app, storage optimizer app and a free lockscreen theme app from the same developer. This is awesome. These do require a bit more perms than the flashlight app.
Huh? (Score:4, Interesting)
Re: (Score:2)
No. It's part of Android's core functionality.
Flashlight app??? (Score:4, Insightful)
The bigger question is why are people downloading flashlight apps? It's been included in android forever right from the notification bar. Why are people looking for apps to do what the phone already does? I can't see any way to really improve on "turn on flash".
Re:Flashlight app??? (Score:4, Funny)
Besides which, having a *real* flashlight is far more useful! There is a considerable difference between whacking a stalker with a flashlight containing 8 D Size batteries, and whacking that same stalker with a 2 mm thick 3" by 5" smartphone ...
Re: (Score:2)
Depends on the circumstances. If I know I'm running at night, I bring an LED flashlight that's almost brighter than the Sun (slight exaggeration :) ). If I just need to light up a menu in a dimly-lit restaurant so my nearly 48-year-old eyes can read it, though, the light on my phone (which I'll have with me) is more than sufficient.
Re: (Score:2)
Re:Flashlight app??? (Score:4, Insightful)
Re: (Score:2)
Just like cameras, the best flashlight is the one you have with you.
There are few sentences in the English language as irritating as that one. People use that to justify their laziness and never learning how to use a camera or their shitty photos. Likewise, the best car is the one you have? The best job is the one you have now? The best food to eat is what is in your pocket?
Sure, your phone is better than nothing, but a poor substitute for a real flashlight or a real camera. A smart phone is more like a Swiss Army knife....it does a lot of things, but most of them m
Re: (Score:2)
Re: (Score:2)
Besides which, having a *real* flashlight is far more useful!
I have a real flashlight. It's completely useless. It's never with me when I need it, and when I'm near it I still have to go get the damn thing rather than just reaching in my pocket.
Equally my sunset photo last night was taken on the phone, not on my $5000 DSLR which is at home.
Re: (Score:2)
Besides which, having a *real* flashlight is far more useful!
I have a real flashlight. It's completely useless. It's never with me when I need it, and when I'm near it I still have to go get the damn thing rather than just reaching in my pocket. Equally my sunset photo last night was taken on the phone, not on my $5000 DSLR which is at home.
They have cute little LED flashlights that you can keep on your keychain. Really bright too.
Then again, I notice a lot of folks that have a hand permanently wrapped around their smartphone. Can't get more convenient than that.
Smartphones do a lot of things. They don't do anything particularly well though.
Re:Flashlight app??? (Score:4)
Smartphones do a lot of things. They don't do anything particularly well though.
They empty your wallet rather well.
Re: (Score:2)
Smartphones do a lot of things. They don't do anything particularly well though.
They empty your wallet rather well.
Well, there is that.
Re: (Score:2)
Smartphones do a lot of things. They don't do anything particularly well though.
I could see an argument for having a full size flashlight. I don't get the argument of having a keychain led light when you already have your phone in your pocket. It's not exactly significantly better in any way.
Re: (Score:2)
Smartphones do a lot of things. They don't do anything particularly well though.
I could see an argument for having a full size flashlight. I don't get the argument of having a keychain led light when you already have your phone in your pocket. It's not exactly significantly better in any way.
Doesn't spy on me, doesn't drain my phone battery. Much brighter.
Re: Flashlight app??? (Score:2)
I remember circa 2014 LG phones still didn't have it?
Re:Flashlight app??? (Score:5, Informative)
It's been included in android forever right from the notification bar.
It's been included in Android since 5.0 (Lollipop). According to the current Android version dashboard, that means 10.7% of active Android devices don't have it.
Those of us who use current Android devices can easily forget the people using old ones. I was also surprised that flashlight apps still exist, until I looked up when the built-in flashlight was added (IIRC it was added precisely because there were so many abusive flashlight apps).
Re: (Score:2)
Yep. Plus, it's such a complicated and valuable feature, backporting to old devices is impossible.
Re: (Score:2)
Yep. Plus, it's such a complicated and valuable feature, backporting to old devices is impossible.
Backporting is easy. Getting the vendors who made those old KitKat and JellyBean devices to update them is approximately impossible.
Re: (Score:2)
Google wrote the contract with those manufacturers. Google chose not to put it in there, and then pretends to lie that the manufacturers the problem..
You are assuming that Google could write anything it wanted in those contracts. That's not true. I wish it were, because there are several things I'd like to have added, but I can't until I can convince most of the device makers to agree that they're a good idea, which is very hard if the things in question will cost them money.
Re: (Score:2)
Re: (Score:2)
I have a Galaxy A3 with 6.0.1 installed... there's no preloaded flashlight app. I had to download an app.
Re: (Score:2)
My Galaxy Note4 doesn't have it.
Re: (Score:1)
My Galaxy Note4 doesn't have it.
Mine does, but it was hidden in the Widgets menu (long press on home screen) by default. Once I dragged it out onto the homescreen, it became available without hunting for it,
---PCJ
Re: (Score:2)
The bigger question is why are people downloading flashlight apps? It's been included in android forever right from the notification bar. Why are people looking for apps to do what the phone already does? I can't see any way to really improve on "turn on flash".
A lot of people aren't too bright?
Or maybe they thought they were downloading a Fleshlight app.
Let's See What We Can Get Away With (Score:2)
I'm software, I got on your phone.
Let's see what we can fuck with next.
Devil: "i'm just a flashlight app"
OS: "ok"
Devil: /evil echoing laughter `
Mine uses 2 (Score:2)
(1) Take pictures and videos -- presumably to access the flash.
(2) Prevent phone from sleeping -- presumably to keep the phone on whilst you're using the flashlight.
Icon Torch (Score:2)
I always look at the permission an app wants before installing it. I have to say I can remember looking at half a dozen torch apps before choosing...
https://play.google.com/store/... [google.com] ...it only requires three permssion:-
* take pictures and videos
* control flashlight
* prevent device from sleeping
The first one "take pictures and videos" seems a little dodgy, but perhaps when you go to implement it you can't control the flashlight without it and it's harmless anyway, they might be able to capture video and pi
Re: (Score:2)
Which version because the 2015 A3 certainly does, as does the 2017 A3.
If you have done nothing wrong... (Score:1)
The solution to this (Score:2)
Since Google alreadys know the brand of phone and OS that its running they could show help about the phone's built in function when somebody searches for a flashlight. A simple action like this for the most common handsets might go some way to increasing overall platform security. They should also curate apps for common functionality like calculators, flashli
Re: (Score:2)
I just searched for flashlight in the Google Search Widget and it turned on my flashlight, and showed a toggle switch on the screen to turn it back off and on. Not sure how universal this is across device, but I imagine it would probably work with any phone that supported the Google search widget on the home screen.
Dupe...from 2014 (Score:2)
This sensationalistic crap was news back in 2014 [pandasecurity.com]. Back then, Android was just getting a built-in flashlight and older phones needed an app. Also, back then, the LED was firmly affixed to the camera subsystem and Android permissions were less granular, so more permissions were needed. I think Kit Kat, releases in late 2013, started making permissions more granular and transparent.
Considering every version of Android since then has a flashlight toggle built into the quick settings menu (drag down from top), h
Re: (Score:1)
Some of us are dumb enough that we didn't know about the 2-step pull down (it's not in the phone manual, if the phone even has one) that reveals the built-in flashlight. I discovered it by accident about 6 months after getting the phone. Luckily, I didn't have a real need for it, so the apps were not attractive.
If somebody does download one of those apps, though, then uninstalls it (applies to any Android app, really), how can they be sure that all the background mining crap goes away with it? My suspicion:
People still use these apps? (Score:1)
Now that even pure android phones have a flashlight button in the notification bar, why on earth would you install an app? Are there phones that don't have this button?
Why use an app, when the OS gives you that ability (Score:2)
Obligatory prior art (Score:2)
Make Big Bucks Selling Personal Data! (Score:2)
Writing what is probably the simplest phone application you can think of could be your pathway to wealth and fame! Demanding access to all the user's data as a requirement for turning the LED on and turning the LED off? Really?
Why the vendor application stores don't round file any flashlight application that needs any permissions at all is the question we'd all like the answer to.
Army Knife (Score:3)
The Army Knife for Android [google.com] app has a flashlight in it, and a whole bunch of other useful apps: scientific calculator, magnifier, stop watch, timer, compass, bubble level, ruler, unit converter, and even a mirror ...
Highly recommended.
This has been going on for almost a decade... (Score:2)
Most Android phones, since even Android 1.0, have had a camera flash, so there have always been apps around that would either turn the display bright or turn on the flash LED. Of course, as time evolved, a lot of them wanted every permission under the sun, even SUPERUSER (for the apps that might use su for root.) Of course, the earlier Android permission model was all/nothing, so apps would have free reign on a phone to do what they pleased and grab anything.
I'm not surprised that this still going on, eve
fuggit (Score:2)
Why? (Score:1)
Was easier to write my own than search (Score:2)
When I first went to look for a flashlight app, I quickly decided it would be way less time consuming to write my own [google.com] than to find one that wasn't spyware. Not much use for it nowdays, since almost every phone has an app built in. But I had to write some other apps for the same reason. In the hopes that it may save some people the same frustration, you can use the link above to check out my other apps. They are all free, contain no ads, no more permissions than absolutley necessary, and don't track any
It's not just Android.... (Score:2)
...there's an LED smart strip that I bought (https://www.ihaper.com/collections/key-product/products/l3-smart-light-strip) that works with Apple's Homekit. I have lots of Homekit devices from different manufacturers, no problems at all.
The shit Chinese software for this (remember, this is basically a fancy lightbulb...) wanted me to a) set up iCloud Drive (Apple's cloud storage) AND set up if it didn't exist, and grant it access to iCloud Keychain (hosted credentials to share between Apple devices).
Really?