Default android permissions

34 replies [Last post]
wbblackstone
User offline. Last seen 1 year 39 weeks ago. Offline
Joined: 9 Feb 2012

I am a brand new developer and brand new corona user. I built my very first app through trial and error and much reading and learning. However, it is very, VERY disappointing to find out that after I tried to account for everything before building and posting my first app to the google market, I find that those who attempt to download my simple quiz app are faced with a warning that informs them that my app will access their phone book and calls they make, their Internet connection, as well as their network connection. I understand that many apps need these capabilities, but my app doesn't. And worse, because it is apparent to any reasonable end user that an app such as mine shouldn't need these permissions, it immediately leads them to "rightly" worry that my app could be some type of malware. After finding out that this was a problem, I immediately began to look for a solution, for examPle, I've tried adding a blank android permissions table and so forth, to no avail. to my utter dismay, after researching the ansca forums, it appears that there is no solution, save trying to somehow go outside corona, recompiling the APK with 3rd party programs and so forth. I purchased corona precisely because DIDNT want to have to work with other complicated Tools. If that was the case, I might as well just learn c or java or whatever and use Xcode. I still hold out hope that there is a solution to getting rid of these three default permission settings. If there really isn't, then I'm really shocked. This should be the NUMBER 1 thing on the corona agenda. Either that, or somebody needs to give me a really good reason why ANY permission should be set such that it can't be altered. Can't you just set these three permissions to false like the rest of the huge permissions list, and let developers turn them on as needed? What are these three doing that is so special and untochable, besides creating a huge headache for me, and I'm sure many others? Please help me!!! Corona has made me so happy, and now at the very end I have to have a sleepless night over something that seems to have no real solution. Tell me it ain't true!!! :-(

- a distraught corona newbie

Replies

wunderwuzzi
User offline. Last seen 39 weeks 3 days ago. Offline
Joined: 17 Jan 2012

Yes, I agree that is a problem. On Amazon AppStore apps are constantly getting bad reviews because of permission issues. People don't even bother downloading, they just rate with 1 star. Here is an example: http://www.amazon.com/Candycane-Apps-Fling/dp/B006ZZC3D6/ref=sr_1_1?ie=UTF8&qid=1335083347&sr=8-1

There are many more, just watch the reviews of the free app of the day. It would be great if we could just start with no permissions and add as needed.

--wunderwuzzi

Mike V
User offline. Last seen 4 years 45 weeks ago. Offline
Joined: 19 Apr 2012

Is this is a problem using Corona on amazon? Ive downloaded Corons apps on Google Play and this issue doesnt exist with them. If its just amazon doing it I wouldnt be bothered much by it as we all know even though all the markets are good to be on the one you want it too work on is Google Play. If this is indeed something that happens using Corona on Amazon I wouldnt even bother with Amazon.

Im kinda annoyed after reading those comments on amazon. That one guy is going off because the developer has taken out the permissions that were annoying everyone. Kinda looked like he did it by removing openfeint. Um. Wouldnt you be happy with a developer who listened and removed the issue? Isnt that a good thing? This guy seems to think hes up to something evil because he took them out. Kinda bullcrap. I hate how some people just think they are so freaking important and have a brain that sits out in left field. I was going to make an account but devided whats the point? Remember that saying about arguing with fools on the internet.

You actually see stupid people often which is what is expected. Even on the google market I see dumb people. Like I hate it when people whine about the price of things, how developers tricked them by only letteing them play four levels and then want an ingame purchase for the rest or how having ads is ruining thier gaming experiance. How do they not understand that people should get paid for thier work? Thats why most devs do it. Ridiculous man. I wonder if these people bitch and moan in the walmart line when they have to buy a roll of toilet paper for 2 bucks. How dare that toilet paper company charge me! Why Im Mike V! I should get it for free! Grrrrrr sorry went off there I do apologize. ;)

peach pellen
User offline. Last seen 4 years 40 weeks ago. Offline
Alumni
Joined: 12 Apr 2011

Will bring this up in our next meeting :)

Mike V
User offline. Last seen 4 years 45 weeks ago. Offline
Joined: 19 Apr 2012

Peach is like, Ill just ignore the sputtering idiot above me. hahaha. Funny!

peach pellen
User offline. Last seen 4 years 40 weeks ago. Offline
Alumni
Joined: 12 Apr 2011

Haha, hey Mike!

Actually your post wasn't up when I opened the tab. I open a bunch of threads at once sometimes and yeah, it must have taken me longer to reply to this than the 20 minutes between our posts.

I agree that some people will never be pleased, some want everything for free, including the benefit of others hard work. It's a shame and it does seem to be more prevalent on Android markets, for whatever reason.

The end of your post was amusing ;)

seebs
User offline. Last seen 4 years 21 weeks ago. Offline
Joined: 17 Apr 2012

I really need a way to turn these off if I'm going to release my app for android. Which I may not due to performance issues anyway. :P

But yeah, my app is entirely self contained and absolutely, positively, does not want or need permission to modify storage or access the net, and I don't want it claiming it does.

tiago_rasia
User offline. Last seen 3 years 27 weeks ago. Offline
Joined: 20 Apr 2012

Hi, same question, I think that this permissions was because Im still trial , when I move to Pro before first release its not going to happen (in the daily build )

seebs
User offline. Last seen 4 years 21 weeks ago. Offline
Joined: 17 Apr 2012

No, I'm using pro and daily builds, still can't make those permissions go away.

peach pellen
User offline. Last seen 4 years 40 weeks ago. Offline
Alumni
Joined: 12 Apr 2011

Not yet, no - we are planning (very soon) to put up a list of requested features and have a system where you guys can let us know what is most important to you; so look out for it and when we get it setup put in your +1 for this. OK? :)

bigfish
User offline. Last seen 3 years 1 week ago. Offline
Joined: 3 Nov 2011

Well, this issue (default Android permissions) is *VERY* important. Makes our Android apps look bad, us look bad and ultimately Corona look bad... Wrote an email to support about this when I found out (a month ago), was told that is was for your stats (!), was checking today to see if anything had been done to remove these "things", to find out that no and not even working on it, but maybe mentioning it in the next meeting... Not really very on, is it? This is a serious intrusion on personal privacy and perhaps not even legal? Priority 1, I'd say.

Bohumil Vosicky
User offline. Last seen 5 weeks 1 day ago. Offline
Joined: 12 Jun 2010

Yes, this issue is extremely important. I never criticized Corona for anything. It's a great product and I made many good apps with Corona SDK. But this issue is known for a very long time and not solved or answered yet. Please let us know if you do not plan or you are not able to solve it. Because if we want to to publish succesfull apps for Android, it should be solved now. Not next month but really in next daily builds. Otherwise I will have to stop my development in Corona and move away.
In past, I would call Carlos and tried to explain it to him. But there is no Carlos now, so what should I do...

dvboren
User offline. Last seen 13 weeks 1 day ago. Offline
Joined: 17 Jan 2011

Knots 3D: Amazon Free app of the Day today. Unfortunately I am getting a fair number of 1 star reviews due to these permissions issues. Too bad since the one star reviewers generally like the app but are concerned with privacy (as they should be). Corona, this really needs to be addressed soon. This has been an issue on the forums for many months. This may be my biggest single complaint of an otherwise great programming framework.

http://www.amazon.com/gp/product/B00701L5XS?ie=UTF8&ref=mas_faad

peach pellen
User offline. Last seen 4 years 40 weeks ago. Offline
Alumni
Joined: 12 Apr 2011

Hey guys,

We're not ready to strip out the default permission from Android apps yet. We can't just rip them out, because a lot of code and 3rd party dependencies such as InMobi, inneractive, OpenFeint, Flurry, etc. Ripping them out would cause crashes and generate a lot issues - but we haven't forgotten about this and do hope we can come to a solution.

Omnigeek Media
User offline. Last seen 1 week 6 days ago. Offline
Joined: 18 Jan 2011

Can I offer a suggestion? I'm having a permission problem, but in my case, I didn't add a permission for Vibrate. Seriously I have to get permission to use vibrarte?

I think that it would be cool that if I call an api call like system.vibrate() that Corona SDK should realize that calling that api needs VIBRATE and would automatically add it.

So if I'm using network.*, gameNetwork.* ads.* or any thing that needs the network, turn the permission on at the time I need it. Yea, its work, perhaps not low hanging fruit, since I would want it to see if I'm writing files and need to turn the WRITE EXTERNAL permission on. But at least for the common things, like we know we don't have address book access, no reason to turn that on at all. Phone call would be tough since you can open a tel: url to make a call.

Or perhaps the build screen should list the available permissions too for weird things.

jfb
User offline. Last seen 4 years 36 weeks ago. Offline
Joined: 18 Aug 2011

@ Peach

" We can't just rip them out,"

But people are already ripping them out with apktool. They are not only ripping out unnecessary permissions but unused libraries as well

http://www.ludicroussoftware.com/blog/2012/05/08/remove-unused-libraries-from-corona-apps/

Provided the app doesn't actually USE analytics, advertising etc, this does not seem to cause a crash. After all the permissions are not used and libraries are not called.

peach pellen
User offline. Last seen 4 years 40 weeks ago. Offline
Alumni
Joined: 12 Apr 2011

@jfb - I *believe* this can cause problems in Jellybean. I'm not certain because I do not work directly with Android, I can only relay info at this stage.

Have you had success with Jellybean?

dvboren
User offline. Last seen 13 weeks 1 day ago. Offline
Joined: 17 Jan 2011

I want to second the link jfb mentioned above. Following the excellent instructions Darren posted on his blog, I was able to remove both the permissions and 3rd party libraries and it wasn't as difficult as I had expected (though still a hassle to have to do for every release).

http://www.ludicroussoftware.com/blog/2012/05/08/remove-unused-libraries-from-corona-apps/

Sales on both Google Play and Amazon have been up slightly for Knots 3D since the offending components were removed. I highly recommend you follow these instructions as your app ratings and sales will be better for it .

kbradford
User offline. Last seen 1 hour 24 min ago. Offline
Joined: 16 Aug 2011

In response to Peach's comment, I am indeed having problems using apktool for Jellybean systems. Specifically I'm attempting to remove permissions for my apk's on the Kindle Fire HD.

I can decompile, modify, and recompile just fine. It even installs correct, but once the app is started there is are error that will cause Amazon to flat out reject. If you start in landscape, lock the screen, turn to portrait and then unlock the app will force close.

I have checked and a normal Corona apk that is unaltered will handle this case fine. An apk that gets decompiled, recompiled, and jarsigned (even with no other changes to anything in the apk) will cause this crash.

This is very disappointing as this has been the only way to remove unneeded permissions from Corona apks. Without this ability I'm sure my apps will begin getting numerous reviews about unneeded permissions.

Corona, please make this permissions issue a top priority!

Andriy Pertsov
User offline. Last seen 1 day 1 hour ago. Offline
Joined: 14 Sep 2010

@kbradford
Totally agree with you.

@CoronaLabs
+1 "make this permissions issue a top priority!"

bigfish
User offline. Last seen 3 years 1 week ago. Offline
Joined: 3 Nov 2011

I second that! Please, make this a priority issue.

wunderwuzzi
User offline. Last seen 39 weeks 3 days ago. Offline
Joined: 17 Jan 2012

Is there an update on this? I just got contacted by Amazon that they want to put my app up for the "Free App of the Day", but I don't want to until the permissions are fixed. I really don't need any of them.

It's been nearly 6 months that this was brought up... can we get a fix please? :)

I'm thinking of doing it manually, but read that some things crash on latest Android. Did someone solve the problem with crashes on Kindle Fire HD?

---wunderwuzzi

wunderwuzzi
User offline. Last seen 39 weeks 3 days ago. Offline
Joined: 17 Jan 2012

@kbradford: Did you also remove the libraries as pointed out by ludicrious or just the permissions? Wondering if the crashes are related to the removed libraries or really just the permissions.

If it crashes it means that actually something is really secretly using those permissions which seems to be a big privacy issue in my opinion.

--wunderwuzzi

mike470
User offline. Last seen 2 years 29 weeks ago. Offline
Joined: 29 Jun 2012

You do have to set

launchPad = false,

in your config.lua if you remove those permissions through apktool.

wunderwuzzi
User offline. Last seen 39 weeks 3 days ago. Offline
Joined: 17 Jan 2012

Yes, I'm doing that and removed the three permissions that Corona sets by default:

Just wondering if there are still crashes with JellyBean devices afterwards? I don't have a Kindle Fire HD, so can't test. Do you know?

--wunderwuzzi

mike470
User offline. Last seen 2 years 29 weeks ago. Offline
Joined: 29 Jun 2012

I have done this to all my APKs - for google play, amazon, and nook, and no one reported any crashes. Of course, maybe they are crashing and not telling me :)

wunderwuzzi
User offline. Last seen 39 weeks 3 days ago. Offline
Joined: 17 Jan 2012

Thanks Mike this is very helpful information!!

Btw. did you also delete the openfeint folder and some of the others under the smali subdirectory, or just remove the permissions? Wondering if maybe the crashes that were mentioned are related to internal code trying to touch those files (that might have been deleted), and not in regards to the permissions.

--wunderwuzzi

mike470
User offline. Last seen 2 years 29 weeks ago. Offline
Joined: 29 Jun 2012

I didn't delete those files. They are really not THAT huge (my total APK size is 20M) and if it ain't broke...

I am not hugely concerned with someone diving into my APK and discovering (gasp) "spyware" files. What I am concerned with, though, is someone trying to install it and saying "why would a kid's math app require access to the phone state and internet" and either canceling the sale or leaving a one-star rating.

wunderwuzzi
User offline. Last seen 39 weeks 3 days ago. Offline
Joined: 17 Jan 2012

Yes, same concern here. I don't want those permissions. Removed them and submitted to Amazon, let's see if it passes their testing...

Thanks for your input.

--wunderwuzzi

kbradford
User offline. Last seen 1 hour 24 min ago. Offline
Joined: 16 Aug 2011

I was able to successfully remove permissions and recompile without errors using the newest apktool 1.5

My issue is that I had an old version of apktool I had been using for over a year, and the first time it runs it creates some "frameworks" in C:\Users\\apktool\framework\

Those frameworks were based on Android 2.2, so even though I was using a new apktool the frameworks were old and this would prevent certain options in the AndroidManifest.

To fix it I just deleted everything in that framework folder, decompiled with apktool, modified the manifest, recompiled, signed, and zipaligned.

It would still be great if Corona offers an easy way to do this, but for now this isn't too bad.

Andriy Pertsov
User offline. Last seen 1 day 1 hour ago. Offline
Joined: 14 Sep 2010

Today I tried to remove unused permissions - downloaded latest ApkTool (1.5), Android SDK (Rev. 20), JDK (1.7), using Corona SDK 927. I had no luck to install resulting .apk file (even without any changes in manifest) on device with Android 2.2 (got "Application not installed" message). So this is not for me - as I do not want to find out what "magic" I need to get worked application.

@CoronaLabs
Please, make removing unused permissions a top priority. We really need it.

bigfish
User offline. Last seen 3 years 1 week ago. Offline
Joined: 3 Nov 2011

I develop apps for small children. I do not need any of these permissions - how many of your other customers do? Assuming everyone will is only seriously poor thinking ahead on your part if you want my humble opinion. And it only creates this situation : I am not releasing apps developped with Corona on GooglePlay anymore until this bug (sorry but as far as I am concerned, it is a bug as it's seriously bugging me) is fixed. I just installed a debug version of my latest app on my galaxy tablet and it does warn me that the app will access internet and pick up details of my phone. In real life, it means *after* a customer has paid - I was wondering why I had so many cancellations... Cancellations mean no money, no money means Corona is useless. Corona useless means I will not be renewing my subscription. As simple as that. How many developpers are you going to lose over this issue? It's a shame because outside of this BIG, ENORMOUS, GIGANTIC issue, Corona is a great product.

Dotnaught
User offline. Last seen 1 week 2 days ago. Offline
Joined: 7 Jul 2009

Has any progress been made on this? There should be an easy way to disable libraries.

Pixin
User offline. Last seen 34 weeks 56 min ago. Offline
Joined: 21 Feb 2011

+ 1 - need to be able to disable libraries

walter
User offline. Last seen 1 week 8 hours ago. Offline
Staff
Joined: 22 Jun 2009

Just chiming in...

So starting in daily build 1030, we have removed default permissions. There were a lot of details we needed to get right in order to give you more control, yet perserve what everyone loves about developing with Corona.

You can read more here:

http://www.coronalabs.com/blog/2013/02/18/say-goodbye-to-default-android-permissions/

Viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.