What we learned auditing thousands of Android permission requests

Privacy Lens scans the apps already installed on a device and explains, in plain language, what each one can reach. Building the classifier meant working through a very large number of real manifests. A few things surprised us.

Over-permissioning is usually accidental

The intuitive story is that apps request broad permissions in order to harvest data. In practice the more common cause is a dependency. A developer adds an analytics or advertising library, the library declares permissions in its own manifest, and manifest merging silently promotes them into the final app. The developer often does not know.

Permission count is a bad signal

Early versions of our scoring leaned on how many permissions an app declared. It ranked a flashlight app with four permissions as riskier than a messenger with two very sensitive ones. We rewrote the model around what a combination enables rather than how long the list is.

• Location plus background execution plus network is a tracking capability, regardless of stated purpose.
• Storage plus contacts plus network is an exfiltration capability.
• Camera alone, in a camera app, is unremarkable.

Explanations beat scores

Our first interface showed a risk score out of 100. Users did not act on it. They could not tell whether 62 was fine. Replacing the number with a single sentence — 'this app can read your location while it is closed and send it over the internet' — produced markedly different behaviour in testing. People uninstalled things.

A score compresses a judgement you have not earned the right to make on the user's behalf. A description hands them the judgement.

We scan on-device

It would be considerably easier to upload the installed-app list and classify server-side. We do not, because a complete inventory of someone's installed apps is itself sensitive — arguably the single most revealing list on the phone. A privacy tool that collects it has lost the argument before it starts.