Opened 3 years ago

Closed 6 days ago

#2564 closed defect (rejected)

Adblock Browser is requesting various permissions it doesn't need

Reported by: fhd Assignee: rjeschke
Priority: P2 Milestone:
Module: Adblock-Browser-for-Android Keywords: 2015q3
Cc: greiner Blocked By:
Blocking: Platform: Adblock Browser for Android
Ready: yes Confidential: no
Tester: Unknown Verified working: no
Review URL(s):

Description

Environment

Adblock Browser 1.0.20150520125137 on a Nexus 4 running Android 5.1.

How to reproduce

  1. Ensure Adblock Browser isn't installed.
  2. Install Adblock Browser.

Observed behaviour

Adblock Browser is requesting a lot of permissions, many of which I'm sure we don't need.

Expected behaviour

Adblock Browser should only request the permissions it actually needs.

Change History (16)

comment:1 follow-up: Changed 3 years ago by fhd

We've inherited all those permission requests from Firefox for Android, which does a lot of things we don't want to do, like adding Firefox web apps as launcher icons. Let's do some testing/research and figure out what we actually need to work, and reduce it to that.

Last edited 3 years ago by fhd (previous) (diff)

comment:3 in reply to: ↑ 1 Changed 3 years ago by greiner

  • Cc greiner added

Replying to fhd:

We've inherited all those permission requests from Firefox for Android, which does a lot of things we don't want to do, like adding Firefox web apps as launcher icons.

Note that the "adding web apps as launcher icons" feature, just like many other ones which require Firefox to request permissions, are specified in (upcoming) Web standards (e.g. Installable web applications) and should therefore not be removed.

As outlined on StackOverflow we could probably make a bunch of those permissions optional and only request them whenever we need them. However, that might not be worth the effort and may even lead to a worse user experience.
Therefore I'd suggest only removing permissions that are solely used for features we don't include in the browser in the first place.

comment:4 Changed 3 years ago by fhd

  • Priority changed from P3 to P2

comment:5 Changed 3 years ago by rjeschke

The SO question does not really apply here. There it is about an app using phone permission to run on non-phones and not be filtered out in the PlayStore.
Making a permission optional does not hide it, and you can not dynamically request permissions.
Also, as removing a permission might seem trivial, believe me, it is not. As an example consider removing camera/microphone access permission: all microphone and camera access is forbidden, a try results in an exception wich might result in a crash. To solve this we would need to remove WebRTC support, disable image uploads from camera and various other things related to a microphone.
All of those changes need to be done in code... you can imagine the effort (both developers and QA related).
IMO it is not really about 'not needed' permissions, but about users not understanding them.

Still, if we want to remove some of them, let us first decide which ones and continue from there.

comment:6 Changed 3 years ago by fhd

First we need to investigate how the permissions are used (in the code) and compile a list. Then we can remove those used by features we removed - we can always request the permission again later, once we need it.

In addition, we should put up our own page on what permissions we use and how - better than to refer to the Firefox one.

comment:7 Changed 2 years ago by philll

  • Platform changed from Unknown to Adblock Browser for Android

See #2673

comment:8 Changed 2 years ago by rjeschke

  • Owner set to rjeschke
  • Tester set to Unknown

comment:9 Changed 2 years ago by fhd

  • Keywords 2015q3 added

comment:10 Changed 2 years ago by fhd

  • Milestone set to Adblock-Browser-for-Android-next

comment:11 Changed 2 years ago by fhd

  • Milestone Adblock-Browser-for-Android-next deleted

Actually, changed my mind with the milestone - I don't see why this should be blocking the release. We can presumably not request one permission or two, but fundamentally this is really about help/FAQ content.

comment:12 Changed 2 years ago by fhd

René found these options we should add to the build configuration to address this as much as possible:

# Permission reduction
ac_add_options --disable-websms-backend
ac_add_options --disable-webrtc
ac_add_options --disable-webapp-runtime
ac_add_options --disable-mozril-geoloc

But we'll also need that FAQ.

comment:13 Changed 2 years ago by fhd

  • Resolution set to rejected
  • Status changed from new to closed

Turns out we do have that FAQ on adblockbrowser.org.

I don't think it's worth removing one or two permissions now. I would rather wait for Mozilla to use the new runtime permission system, that should solve the whole issue.

comment:14 Changed 5 weeks ago by markuscam

  • Resolution rejected deleted
  • Status changed from closed to reopened

This ad blocker works well for me but it gives me a problem when I want to connect the camera in online applications such as Skype to make video calls or other pages as webcam-porno.es connection may be required. The Webrtc system seems to be incompatible with this program. I'm not sure.

Regards.

Last edited 5 weeks ago by markuscam (previous) (diff)

comment:15 Changed 5 weeks ago by markuscam

I have found the solution to the problem. With the new version of Firefox everything works correctly. I downloaded the latest versions of Mozilla and Chorme and the camera works perfectly. I can make video calls without problem.

You can close the ticket. regards

comment:16 Changed 6 days ago by diegocarloslima

  • Resolution set to rejected
  • Status changed from reopened to closed
Note: See TracTickets for help on using tickets.