On: "This community is available in the app"

[clort]

> Which of those things can the official Reddit app do currently?

Looking at https://play.google.com/store/apps/details?id=com.reddit.fro..., scroll down and click the 'View Details' under Permissions. It shows that the app can read your contacts, network connections, approximate location, contents of your USB storage plus much more which would cover all of codedokode's points adequately I think? (I'm not sure of the annoying notifications, perhaps all apps can do that..)

The list in full:

  This app has access to:
  Photos/Media/Files

    read the contents of your USB storage
    modify or delete the contents of your USB storage

  Location

    approximate location (network-based)

  Storage

    read the contents of your USB storage
    modify or delete the contents of your USB storage

  Microphone

    record audio

  Camera
    take pictures and videos

  Contacts

    find accounts on the device

  Device & app history

    read sensitive log data

  Identity

    add or remove accounts
    find accounts on the device

  Other

    receive data from Internet
    view network connections
    prevent device from sleeping
    run at startup
    read Google service configuration
    draw over other apps
    read sync settings
    full network access
    create accounts and set passwords
    use accounts on the device
    toggle sync on and off
    install shortcuts

[JshWright → clort]

Many (though certainly not all) of those things require explicit permission from the user (particularly the storage, location, and camera related stuff).

[thewhitetulip → JshWright]

When all an app needs to do is connect to a website and cache a few images why does it need microphone access?

Also if it has 100s of dialogs popping up users get a fatigue. They tend to say yes to everything and that's how default Android permissions are

[inerg → thewhitetulip]

I don't have the app installed but I'm assuming you can record video in it to post on Reddit? If that's the case I can see why it requires access to the microphone. That's the only way I could look at justifying it.

[thewhitetulip → inerg]

True. But why need all permissions upfront?

Security model should be automated. Request only when needed

Can't see why it needs all permissions upfront. Apps keep nagging u until we provide all permissions.

90% of my reddit usage is posting amd reading text. 10% is photo related. So browser is better for me.

I don't need an app to have all access when I upload photos once a month

[rjzzleep → JshWright]

The only ones that require user interaction are contacts, location, storage, microphone, camera.

Microphone is granted along camera. Camera is needed if you want to upload photos.(I might be wrong about the microphone)

Storage is always necessary for apps that cache anything from the web.

That leaves contacts and location.

So you can disable contacts and location, but all your metadata including device and network information is read and probably transmitted. In most cases it's good enough as location information as well.