The app that asked too much

A free torch app once requested access to a user's contacts, location and microphone. A torch needs one thing: the camera flash. The request was not a mistake.

Permissions are the point at which an app tells you what it intends, and most users read them the way they read a long contract — which is to say, not at all. Tapping accept is faster than thinking, and the app does not work until you do.

The useful habit is a single question: can I explain why this app needs this? A mapping app needs location, obviously. A note-taking app asking for location has no obvious reason, and no obvious reason is itself the finding. The absence of an explanation is information, in the same way that a shop unwilling to tell you where its meat comes from has told you something.

Modern phone systems have improved this. Permissions can now be granted once rather than forever, limited to while the app is open, or given as approximate location rather than exact. Each of these is worth using, and each is slightly less convenient, which is why most people never change the defaults.

The general shape is familiar. The safe option costs ten seconds, the risky one costs nothing, and the cost of the risky one arrives much later and is paid by someone who has long forgotten tapping accept.