What Personal Info Are You Leaking? How To Decipher Permission Requests?

Apps and add-ons often ask you to agree to 'permissions' before they can be installed, but it's not always clear what you're agreeing to and why. Here we explain how to decipher requests and control what apps can access.

It's very easy to install Android apps and browser add-ons without checking (or caring) about the data you're giving them access to. How many of us have simply shrugged after reading that a Chrome extension can "access your data on all websites", because we fail to consider the full implications? Many permissions are necessary for certain features to work properly, for example Google Maps for Mobile wouldn't be much use if it didn't have access to your location. But others go beyond what's necessary and make
unjustified requests that could pose a privacy threat. In this feature, we reveal how to check and control permissions on your PC and mobile devices so you can be sure you're not unwittingly leaking personal information. We'll explain what various permissions allow add-ons, apps and web services to do, and we show you how you can manage these requests to take charge of your data. In most cases permissions are harmless, but it pays to understand what you're agreeing to before you install something.

CHROME
What do the permissions involve?
Chrome apps and add-ons can request permission to access data stored on your computer, or on some (or all) the websites you visit. They might be able to access, modify or clear your browsing history, bookmarks and clipboard content, and pinpoint your physical location. Certain websites you visit also require permissions.

How do I check them?
When you install an app or extension from the Chrome Web Store (chrome.google.com/webstore), a dialogue box will open telling you what that item can access or do. Read this list carefully so you know exactly what you're granting access to. Although there's currently no way to allow certain permissions and deny others, meaning it's basically 'all or nothing', this could be set to change soon. Google has added a new feature to the Dev and Canary test builds of Chrome (http://www.chromium.org/getting-involved/dev-channel) that requires you to tick each of the requested permissions in turn. It's possible you may be able to skip permissions you don't agree with, but all the extensions we've tried require you to tick everything before an item can be installed. It's not yet confirmed that the feature will make it to the next stable version of Chrome. To view the permissions used by something you've already installed, go to Settings, Extensions in Chrome and click the Permissions tab. If an item's permissions change, you should receive an alert. You can use an add-on such as Extension Gallery and Web Store Inspector to see exactly what something does before you install it. To see and manage a website's permissions, click the favicon (the icon to the left of the site address) to display a drop-down menu with the details. This may include info about the cookies installed by the website, and whether certain content - such as images, JavaScript and plug-ins - is permitted to be displayed.

Should I be worried?
Items that can "access all data on your computer" and any websites you visit should potentially be avoided as they will have free rein to do everything from reading personal files to accessing your webcam. You should also be wary of ones that can "view your data on all websites" (unless it's something like an RSS reader). It's sometimes obvious why an add-on requires certain permissions, such as an ad blocker that needs to access data as you browse, but at other times the request doesn't make sense. If an add-on's list of permissions starts alarm bells ringing, avoid it. Worryingly, some browser extensions that previously had a good reputation have been bought by adware companies who inject ads into the pages you visit. So make sure you read the latest reviews of an extension before you install it.

How do I control them?
The easiest way to stop an app or add-on accessing personal data is to uninstall it. Type chrome://extensions or chrome://apps into your address bar to see what's installed. To remove an extension, just click the dustbin icon next to its name, and to uninstall an app, right-click it and select 'Remove from Chrome'. Alternatively, you can bolster your browser security by using an extension scanner such as Privacy Guard and Extension Defender. The former helps you make more informed decisions about the extensions you install by highlighting medium and high-risk permissions, while the latter scans your installed add-ons for known malware, adware and spyware, and is updated daily.

FIREFOX
What do the permissions involve?
Unlike Chrome extensions, all Firefox add-ons are reviewed by Mozilla and only made available on the Add-ons site (addons.mozilla.org) if they are judged safe and don't try to do anything they shouldn't. Some add-ons are 'preliminary reviewed', which means they don't have obvious security issues, but they may be buggy. Permissions in Firefox mainly relate to websites and usually mean letting them do certain things, such as store passwords, share your location, set cookies, open pop-up windows, maintain offline storage and run in full screen.

How do I check them?
To check what a website can do, click the favicon, or type about:permissions into the address bar and hit Enter. You can use MyPermissions Cleaner (mypermissions.com) to see how apps you've connected to Facebook, Twitter, Google, Instagram and others access your data. MyPermissions Cleaner is a powerful tool that works with Firefox, Chrome, Internet Explorer and Safari. It lets you filter apps based on permission type and alerts you when an app gets access to your data. There's currently no way to check extension permissions in Firefox, because there are no 'permissions' as such.

Should I be worried?
Not really, provided you check an add-on's details carefully before installing it. Mozilla's review process (which also covers extension updates) should keep you safe enough. When installing an add-on, you may see a message that says "Firefox prevented this site (addons.mozilla.org) from asking you to install software on your computer", but you can close this by clicking Allow. To stop the message appearing in future, click the Firefox button or Tools menu and select Options. Choose Security, then click the Exceptions button next to 'Warn me when sites try to install add-ons'. When the Allowed Sites - Add-ons Installation box opens, type addons.mozilla.org and click Close.

How do I control them?
To manage what websites can do in Firefox, type about:permissions into the address bar and hit Enter to open the Permissions Manager. Here, you can decide whether to store passwords, set cookies and share your location, either on a site-by-site basis or for all sites you visit in the browser. If you're worried about the permissions required by third-party apps, you can use MyPermissions Cleaner to automatically scan major accounts to see which apps have access to your personal data.

ANDROID
What do the permissions involve?
With mobile malware on the rise, the permissions required by Android apps have become a major concern for mobile users, because they can put your phone or tablet (and the data stored on it) at risk of being hacked and infected with malware. When you install an Android app from the Google Play store (play.google.com), you'll be informed of the permissions it needs and you can then decide whether to go ahead with the installation or cancel it. You can't pick and choose which to grant - as with Chrome extensions, it's all or nothing. Android apps typically request a lot of permissions - some are used to serve you targeted adverts, others allow the app to use hardware such as your phone's camera or microphone, and you may also be asked to give access to your contacts and SD memory card. Most Android apps update automatically, but some occasionally require you to update them manually. Although it's not made clear, this is usually because a new permission is required, so check this carefully.

How do I check them?
To find out what permissions a particular app has, go to Settings, Apps and tap an item. At the bottom of the 'App info' screen, you'll see the list of permissions allowed. Tap a permission to find out more about it. Android used to have a built-in permissions manager called AppOpp, which made it easy to see exactly which permissions apps had access to, but Google pulled this feature late last year claiming it wasn't ready for release. Fortunately, if you have a newer device running Android 4.3 (Jelly Bean) or 4.4 (KitKat), you can get back an extended version by installing Color Tiger's App Ops 4.3/4.4. There are plenty of other free apps that provide a similar function. Use F-Secure App Permissions or Advanced Permission Manager to check for apps that can cost you money, compromise your privacy by accessing confidential data and ask for more permissions than they require. F-Secure proudly claims that its app requires no permissions of its own but cautions that "you may learn quite a lot about your apps - so be prepared"! If you just want a quick overview of which permissions are good or bad, try PermissionDog.

Should I be worried?
Potentially, yes. Android apps often require all sorts of permissions that are easy to skip past without reading, but which you might not grant if you knew the details. For example, Angry Birds Star Wars can read your phone status, take pictures and record videos without your confirmation; it can also find accounts on your device and have full network access. Provided you download apps from Google Play or the Amazon Appstore, you should be safe enough. But just be wary when downloading an app from another site (sideloading apps) or from a developer you're unfamiliar with. Always check the app reviews to see what other users say. If you're not sure what a certain permission will allow an app to do, then it's best not to take any chances.

How do I control them?
You can uninstall risky apps through the Settings screen on your phone or tablet, but unfortunately you can't revoke individual permissions. Rooting your device (which grants you admin access and the ability to change things you wouldn't be able to normally) will give you greater control over things. You might also be able to remove certain permissions on a non-rooted phone using the aforementioned Advanced Permission Manager, but there's no guarantee that the app will work properly afterwards.

iOS
What do the permissions involve?
App permissions on the iPhone and iPad work differently to those on Android. Rather than asking you to make decisions on a per-app basis when installing, iOS automatically grants every app basic permission rights, such as the ability to access the internet. If the app needs more advanced permissions, the option to use your current location for example, or access to your photos, a pop-up will ask your permission and you can choose whether to allow this or not. Denying a permission won't stop the app from working altogether, but it might prevent certain features from working properly.

How do I check them?
Go to Settings, scroll down and select Privacy. Browse the list of categories to see the permissions for each app. You can dig deeper with Bitdefender's Clueful (www.cluefulapp.com). This used to be an app, but Apple removed it from the store, so now it's a web-based service. Just enter an app name to get an overview and details of what it can do.

Should I be worried?
Not really. Apple exercises tight control over its App Store and doesn't allow anything that could compromise your privacy and data (though lapses do occasionally happen). The fact that you can easily deny or revoke permissions should help allay any fears. Apps used to be able to send an iPhone owner's entire address book to the cloud, but that privacy hole has since been plugged. One remaining area of concern is the camera. Apple's Privacy settings lets you stop apps accessing your microphone and photos, but not the camera itself, so in theory an app could take photos or record (soundless) video without your knowledge.

How do I control them?
Browse the categories in the Privacy settings of your iPhone or iPad. If you don't want an app to use a certain feature - such as location services - all you have to do is flip the switch to turn it off. You can turn it back on just as easily when it's needed.

FACEBOOK
What do the permissions involve?
Facebook makes certain details publicly available, including your name, profile picture, cover photo, gender, networks, and username. Apps have access to this information, as well as anything else you've chosen to make public, such as your friends list. If an app requires additional permissions, such as the ability to send you email, or post on your timeline, it will have to request those permissions and you can choose whether to allow them or not. If you don't permit these extended permissions, you probably won't be able to use the app.

How do I check them?
Go to the App Settings page where you'll see all the Facebook apps that have access to your account. Click Edit to view what permissions a particular app needs; any additional permissions it doesn't need but has; and details of the last time the app accessed your data.

Should I be worried?
Some apps can access your mailbox, search your News Feed, log you into Facebook Chat, read your friend's data, post content on your behalf and create events - all of which should concern you. Just because they can perform these actions doesn't necessarily mean they will, but why take the risk?

How do I control them?
The Apps Settings page will let you remove apps you don't use or want to block from having access to your information. The app publisher will still have the data you shared with them including, potentially, your email address. You can revoke additional permissions from the Settings page, which may include the app being able to post on your behalf. Just click the X next to an item to remove it. If an app can't be installed without granting it certain permissions, you can limit who can see what it does by choosing 'Only me' from the 'Visibility of app' menu.

GOOGLE
What do the permissions involve?
You can use your Google account credentials to sign into numerous services, including websites such as Feedly and Facebook, which saves you the hassle of having to register using your email address. One drawback to this is you could be granting third-party apps and services access to your data on Gmail, YouTube and Google Drive. Exactly what they're allowed to do will depend on the connected service.

How do I check them?
If you've ever used your Google account to sign into a new online service, the chances are there are lots of sites still connected to your account that you don't use or have forgotten about. You can view the full list of connected services on your Account Permissions page  - you'll need to be signed into Google to see this. This will tell you what each service you've connected to your Google account has access to. Click an item to display on the right a full breakdown of the permissions it has along with the date you authorised it to access your account.

Should I be worried?
Most websites or apps only have limited access to your Google account and services. Those that have full access are likely to be Google products. For security reasons, it's best to check the list of connected apps and services regularly and revoke any you don't fully trust or don't regularly use.

How do I control them?
You can revoke account permissions for any connected app or website on your Account Permissions page. Just select the app or service, then click the 'Revoke access' button. You can also withdraw authorised access to your Google Account using the Account Permissions page. Just click Revoke Access next to any services you don't use (or don't recognise).

MICROSOFT
What do the permissions involve?
Once you've connected third-party services such as Facebook and Twitter to your Microsoft account, those services can share your personal data. If you use Windows 8 or 8.1, you may find that apps you've installed can also view, access and edit your SkyDrive photos and documents, and (in the case of games) access and update your Xbox Live info.

How do I check them?
Go to the Permissions page. You can choose what info your children can share with others online, manage connected accounts, and manage apps and services that can access your info.

Should I be worried?
Not especially. It's very unlikely that Microsoft will abuse its connection to other services - such as posting messages declaring undying love for Windows 8.1 on your Facebook wall, for instance - and the app permission requests we've seen all appear reasonable. You may find apps that can access information you'd rather they didn't, but these are easily removed.

How do I control them?
The Permissions screen lets you remove apps you're not happy with. You can't revoke individual permissions from that screen - it's an all-or-nothing arrangement. However, you can customise which data-connected services are shared with your Microsoft account. If you've connected Facebook, you'll be able to choose what you can see and post in Windows 8 and 8.1, Windows Phone, Outlook.com and OneDrive (formerly SkyDrive), as well as other Microsoft services, such as Photo Gallery and Movie Maker 2011.

0 comments:

Post a Comment