
Wikipedia Android app now requests identity permissions - dredmorbius
https://plus.google.com/104092656004159577193/posts/4bMEBEkRoKA
======
dkopi
This reads to me as an overreaction. Sure, it's important to be vigilant about
the permissions you give apps, but it's also important to understand the
underlying OS and permission layers.

TLDR: If you're concerned about your privacy, upgrade to Android 6.0

There's nothing wrong with Wikipedia letting you manage your Wikipedia account
using the app. They're using the Account Manager API, which is the right way
to approach account management on android. Prior to android 6.0, they need the
GET_ACCOUNTS permission to use the account manager.

Wikipedia's FAQ explains: Note: The app does not store your Wikipedia login
credentials on the device, and it does not access any non-Wikipedia accounts
on your device, nor any other aspects of your identity. Note: This permission
is only required in Android versions earlier than 6.0 (Marshmallow). For
Android 6.0 and above, this permission is not required.

GET_ACCOUNTS is a dangerous permission. That's why google changed the behavior
in android 6.0 by: 1\. Allowing users to decline specific permissions to apps,
instead of the "accept all or none" approach in lollipop and bellow. 2\.
Allowing apps to manage the account they own without requesting GET_ACCOUNTS.

The Android docs explain this as well: Note: Beginning with Android 6.0 (API
level 23), if an app shares the signature of the authenticator that manages an
account, it does not need "GET_ACCOUNTS" permission to read information about
that account. On Android 5.1 and lower, all apps need "GET_ACCOUNTS"
permission to read information about any account.

Bottom line is: if you're concerned about app permissions (as you should be) -
you should be running Android 6. Wikipedia won't ask you for GET_ACCOUNTS, and
you'll be able to manually control permissions other apps receive as well.

~~~
pramodliv1
Also, since the code is open sourced ([https://github.com/wikimedia/apps-
android-wikipedia](https://github.com/wikimedia/apps-android-wikipedia)), I
guess they get the benefit of the doubt?

~~~
dredmorbius
OpenSSL was open sourced. That worked out real well.

It's not being open sourced that leads to secure, well-behaved software.

It's being well-behaved, secure software. Which, among other properties, means
following the principles of least privilege and least capability. See the
OpenBSD project for more on that philosophy.

~~~
Nullabillity
This isn't C we're talking about. You don't magically expose random memory
with Java code.

~~~
dredmorbius
Tool choice _may_ improve security. See again OpenBSD, which has
_specifically_ rewritten parts of the C library to avoid classes of bugs.

That said, Java has a markedly less-than-perfect record.

------
awinter-py
Urgh, I am so over permissions.

I don't mind if my app _accesses_ geo as long as it doesn't exfiltrate. In a
perfect world, only a small subset of an app's data should leave the device.

This ends up being pretty hard to do generically. If a geofence event triggers
a network call, has geo information been exfiltrated?

As things are, I don't feel like I'm past having to trust the app author.

~~~
dredmorbius
I've suggested separately that Google should can the concept of supporting
_apps_ and look at what _functions_ it wants to provide, and provide a Free
Software framework for supporting that, with a guidance structure specifying
what app authors and package maintainers must and must not do.

Pretty much Debian.

[https://plus.google.com/104092656004159577193/posts/2eg1rG6k...](https://plus.google.com/104092656004159577193/posts/2eg1rG6kmJp)

(Caution: harsh language.)

 _Edit:_ Updated link. Had the wrong Android rant referenced earlier.

------
rocky1138
Why not just use the Wikipedia website?

~~~
petepete
Last time I used the app it didn't support 'Find in page' or pinching to zoom.
The web site is great and just works for what I want to use it for. The only
thing that's annoying is that when sections of the article are collapsed 'Find
in page' doesn't work (which is obvious, but annoying).

~~~
p1mrx
Wikipedia's mobile site really is a usability disaster, with low-density
tables and most of the content hidden by default. I've always had to scroll
down and switch to Desktop to do any serious reading. It's as if the interface
was designed for the first-gen iPhone, and subsequently abandoned.

At one point, pages had a "Permanently disable mobile site" link at the
bottom, but they scrapped that back in 2012.

------
brudgers
Direct link to app:
[https://play.google.com/store/apps/details?id=org.wikipedia](https://play.google.com/store/apps/details?id=org.wikipedia)

~~~
dublinben
Non Google link to the app:
[https://f-droid.org/repository/browse/?fdfilter=wikipedia&fd...](https://f-droid.org/repository/browse/?fdfilter=wikipedia&fdid=org.wikipedia)

------
deleterious
This is not an overreaction at all. In fact, with the recent Wikipedia search
engine debacal, the chances of these so called necessary permissions being
unrelated, or coincidence, is nil and none. Jeez people keep up!

