App Ops - what you need to know

What is App Ops?

App Ops is a framework inside Android which allows the permissions of individual apps to be tweaked. Android was built with an app permission system and when you install an app they are asked to agree to the permissions that the app requests. If you decline then the app isn’t installed. It is an all or nothing situation. The problem is that some permissions are requested because of secondary functionality (often connected with mobile advertising) that don’t have anything to do with the main function of the app.

The App Ops functionality, when exposed via any one of the handy apps in the Play Store, allows users to change the permissions of an app. The idea is that if you don’t want your favorite flashlight app to collect your location data then you can revoke that permission just for that app.

How does it work and why is it needed?

What App Ops does is allow a user to revoke an individual permission for an app. When the app then starts and tries to make an Android system call to access something that the user has now forbidden then Android will return an error and won’t grant access to that data or functionality.

The reason why such control is needed is because many apps have a very poorly defined set of permissions. In fact there are probably cases where apps request a certain permission and never actually use it. But the user doesn’t know that and there is no way to tell if an app is actually utilizing all the permissions it asked for.

Secondly, some of Android’s permissions are too course. For example the “Read Phone State and Identity” permission is needed to detect when a call is being received so that the app can mute its own sound. But the same permission also allows the app to harvest the phone’s IMEI.

Thirdly, lots of mobile ad platforms rely on using data like the user’s location and the ability to access the Internet to serve ads. However some ad platforms are just darn right rude about what they collect and how they store and process that data. There are some mobile advertising companies which claim to have millions of unique records about consumers which can track users from their phone to their desktop. Search for hemorrhoid cream on your phone and you soon start getting hemorrhoid cream ads inside your desktop web browser! They do assure us that this data is anonymous… but is it if they have your IMEI?

Why did Google remove it?

The official word from Google is that the App Ops functionality was removed because it was never intended to be end-user functionality and was “there for development purposes.” And that may be true but that isn’t the reason that Google removed it. The thing you need to remember is that Google is actually an advertising company. Most of its money comes from displaying adverts and all of its services like Search, Gmail and even Android are just ways to get adverts in front of people. If Google actually allowed users to block certain permissions the first thing they would do is block all the adverts on all those nice free apps. Although blocking internet permission isn’t one of the options for App Ops, ad effectiveness can be disrupted by disabling other permissions including location.

If ads are disrupted or become less effective this could mean that the app developers would see reduced income, as would Google. This could then critically impact the Android eco-system. The whole free and freemium monetization model would start to crumble and developers would either abandon Android or move their apps to be paid-for only.

Another reason why Google removed App Ops is that some apps probably don’t check for error conditions when requesting data via an API that is permissions protected. Since the app isn’t expecting an error condition the app will likely crash. This in turn will increase the support load of the developers because users are running apps in non-standard configurations.

How can you still get it?

If you are running Android 4.3, Android 4.4.0 or Android 4.4.1 then App Ops is still accessible. If you upgraded to Android 4.4.2 then Google has slammed the door shut. It is still possible to access App Ops on 4.4.2 if your phone is rooted and you install the Xposed Framework for Android 4.4. Alternatively apps like App Ops X can do some of the installation for you, but again only if your phone has root access.

Is the EFF right to grill Google about it?

Yes and no. The EFF is concerned about privacy and so should every good citizen. At a national level, governments exist to serve its citizens not the other way around. Any state sponsored breaches of privacy are in fact a breach of democracy. But this isn’t the case with Android. The commercialization of private data (like location and phone number) has been accepted by the general populace for years now. It isn’t spying but rather monetization. So from a privacy standpoint the EFF is doing what it was created to do, raise awareness of the privacy issues and digital rights issues connected with the pervasive technology that touches almost every aspect of our lives.

Ultimately if you don’t like the permission list of an app, don’t install it.

How does iOS handle permissions and should Android mimic that?

iOS handles this issue differently than Android and it could be argued that it actually does a better job. When you install an app on iOS it doesn’t ask you to agree to a big long list of permissions. This means that users don’t suffer from permission list blindness. Android users must admit that in a large number of cases they just ignore the permission list and hit Accept. What iOS does is that the first time the newly installed app tries to access some sensitive data, like your current location, it will ask the user if they agree. This decision is then remembered for the future.

One area where Android could learn from iOS is that for permissions that allow access to your contacts or the phone’s IMEI the user should be prompted and asked if they agree. That would partially solve the permission list blindness and make users more aware of what kind of data is accessed by apps.

What do you think? Join the conversation by leaving a comment below.