I am trying to install an app from Google Play store and I see Device & app history permission.
does anyone know what android permission in manifest causes "Device & app history" permission?
Device & app history
Allows the app to view one or more of: information about activity on the device, which apps are running, browsing history and bookmarks
OK, after researching about this mysteries Android permissions, I got my answer from Adam P. in Android Communities. Thanks Adam.
If you look at the picture below, you will see a description for Device & app history permission for an Android app. At first, this permission description sounds really bad. If you don't know the reasoning behind why all those 3 permissions listed under one group, you would think that this app is really accessing your list of apps, your browsing history and bookmarks. WOW! what a scary thing!
We all know that Google's Android permission system is really broken. From the non tech-savvy people's point of view, this message will scare them and they may not even install your app. Simply, this message on the permission dialog is misleading. Why? actually this sample app needs "retrieve running apps" permission only.
Now, if you pay attention to the message, it reads "one or more of:". What do you mean by "one or more of:"?
Why can't you just display it in a simple format instead of confusing users?
Lesson learned: apparently, one permission from that group is enough to trigger to show that message shown in #1.
Here are the permissions under Device & app history group permission:
Read sensitive log data (android.permission.READ_LOGS)
Retrieve system internal state (android.permission.DUMP)
Read your web bookmarks and history (com.android.browser.permission.READ_HISTORY_BOOKMARKS)
Retrieve running apps (android.permission.GET_TASKS)
Now, if you close the dialog shown on #1 screenshot and then scroll down on the Google Play Store app, you will see a text link reads "View details" shown on #2 screenshot. Click that to see a little bit different version of these permissions. By the way, this link is hidden down in the page and I wonder how many users find that link.
This is what I like. It's clear and concise. Whereas in #1 screenshot, you need to be a linguistic teacher to understand what Google's copyeditors' message mean. Obviously, the first permission dialog in #1 confused me.
OK, this is an extra bonus for you to get confused even more. This sample app apparently requires your phone number to create an account. Nowadays, a lot of social apps started doing that.
Now, if you hold down your app's launcher icon and drag onto App Info button, you will go to your app's details section. Suddenly, you will see this yellow scary message reads "this may cost you money". Well, I know this app does not make a call at all. It just used your phone number to register an account. Google, is it fair to scare people off with that message when the app doesn't really do that?
Conclusion:
Lesson learned; the group permission can be triggered by one permission within and that can cause to show those scary messages.
I am still waiting for the day that Google changes these permissions system. Instead of asking me Yes or No question before installing, I would like to customize the app permissions while I am installing.
Wouldn't it be nice if you check/uncheck each permission and install the app? And, you can turn on more permissions in the app's settings view if necessary. By the way, App Ops won't help with that much.
some more info at: https://support.google.com/googleplay/answer/6014972?hl=en
You're leaving out an essential point concerning these permissions groups. According to Google's Review app permissions (your source) it states the following:
Permissions groups
Permissions groups are designed to show what an app will be able to
access on your device. With permissions groups, you can quickly see
what capabilities or information an app may use before downloading it.
Also, you can review individual permissions at any time using the
Google Play Store Play Store app.
It's a good idea to review permissions groups before downloading an
app. Once you've allowed an app to access a permissions group, the app
may use any of the individual permissions that are part of that group.
You won't need to manually approve individual permissions updates that
belong to a permissions group you've already accepted.
I got an app on my phone that I wanted to update today and noticed that it now asks for access to the Device & app history permission group. As you suggested, the drill down via the Permissions details shows that in reality, it is only requiring the 'retrieve running apps' permission. Great! .. you might think ... but NOT!
If I proceed and accept this now in good faith that I'm OK for this app to see what apps I got running, a subsequent update of this app is NOT going to ask again for access to the Device & app history permission group if they ADD another permission from this same permission group. In other words, today I approve this, granting access to Retrieve running apps (android.permission.GET_TASKS), but as a consequence of that I will not get a new approval request if a next app update adds any of these permissions:
Read sensitive log data (android.permission.READ_LOGS)
Retrieve system internal state (android.permission.DUMP)
Read your web bookmarks and history (com.android.browser.permission.READ_HISTORY_BOOKMARKS)
My conclusion is that if the developers of this app decides they want to obtain eg. my browser history for whatever reason (ads?), they can just add the com.android.browser.permission.READ_HISTORY_BOOKMARKS to their app and I will not be notified when it automatically updates since I have already granted the Device & app history permission group.
Device & app history
Allows the app to view one or more of: information about activity on the device, which apps are running, browsing history and bookmarks
Related
We have an app and have built in IG integration but keep getting denied on our submission. We want to allow our users who have IG accounts to sign in on our app and then link their IG account. We show the IG icon and their IG name with a follow button so a user can gain followers on IG through our app. We need the follower list permission so that we can know if they are already following them or not and the relationship permission so that we can follow from our app. We have detailed the use case demo'd on a video but this is the only reply we continue to get. Any assistance would be great.
follower_list:
This permission (follower_list) does not support the use case you described in your submission notes, screencast and website. Please review Login Permissions (http://instagram.com/developer/authorization/) for a comprehensive list of permissions and valid use cases.
relationships:
This permission (relationships) does not support the use case you described in your submission notes, screencast and website. Please review Login Permissions (http://instagram.com/developer/authorization/) for a comprehensive list of permissions and valid use cases.
I'm running into the same issue with them declining my application for a valid use case.
I think it's because there wasn't enough information for them to validate the app, or the website isn't following their Platform Policy. I would read through it and make sure you're doing everything they want you to do. I would triple check what use case you picked and how you justified that your app falls into it.
It's also good to cover these, taken from Instagram.com:
Your submission should explain what does your app or company do, which
of the approved use cases your integration falls into, who will be
using your app, how do your user authenticate with your app, how you
use the API to power your integration, how does your product use the
data acquired from Instagram, etc.
I'm trying to resolve an issue regarding Google+ and authorizing users for an app using Google OAuth-2. More specifically, I find the authorization is successful when the user presses Accept on the consent screen; using the oauth playground and the auth/games scope, that looks like: http://retrofist.com/temp/Auth_01.png
However, if I then check my app privileges at plus.google.com/apps, I see the playground listed as visible to 'Only You': http://retrofist.com/temp/Auth_02.png - even though 'Anyone on the web' was selected on the consent screen. As I'm using Google Play Games for leaderboards, the result is that no one can see any leaderboard entries until they have manually corrected this to 'Public' visibility.
Can anyone explain a reason or workaround for this? Many thanks.
I observed similar issues, my scores was not published publicly to the leaderboard of the game. I then realized that, this is only for users whose email is defined as tester email. I could see the scores as publicly posted after deleting those emails from tester list.
I am developing an app for iOS. I am planning to publish this app in app-store as free app. I would like to authorize app users via outside RESTful webservice. Is this practice against any Apple official guidelines and can be not approved by Apple app review?
The Apple Review Guidelines 11.1 states:
Apps that unlock or enable additional features or functionality with
mechanisms other than the App Store will be rejected.
It sounds clear, but I believe it is open to interpretation on behalf of their reviewers. My company has produced an app exactly as you describe and it not only passed but has been versioned up very recently. Like yours, this app consumes a web service and while the launch screen is public facing, the user must immediately authenticate on the screen after that to go any further.
Our app was not a good candidate for the enterprise store model, since the intention is to distribute to customers, not employees.
Also, and perhaps most telling, when you prepare to upload your binary the iTunes Connect portal has a place for you to enter demo account credentials for the testers to access protected content in your app. So I think you're OK. Screencap below taken from iTunes Connect.
UPDATE
Apparently, when submitting your app you can provide demo account information (#erikr98), implying that an app like yours could be tested by Apple and be approved in the store. I've seen apps like this and worked on them before, but was under the impression that you also had to provide some sort of functionality in the app outside of your "pay wall."
....
I think the answer is maybe. It sounds like you're hovering the line between a public app and an enterprise app. I'm going to assume your question could be rephrased like this:
"I make money from my customers through an existing process (probably on the web) and I want to allow them to use that functionality on iOS without giving 1/3 of that money to Apple via a paid-app or through In-App Purchase. If I build a free app and provide my current customers access to its content via their existing accounts (and through a login process) will Apple reject it?"
Apple's App Store Review Guidelines, Section 11, clearly states that if you allow users to upgrade the content, unlock features or abilities, or purchase content through your application, that purchase must be done through In-App Purchase.
However, in my experience I have found that Apple will not reject an application if it provides value to everyone, not just those with an account. If you provide some sort of benefit for someone without an account you stand a much better chance. In my case we had, 5 features available to the people without an account, and 10 features available for those that could login. Our app was approved and released to the App Store. This was last year.
Also, think about this from a reviewer's perspective at Apple: When you sit down to review an app, its probably not a good sign that you can't access any part of the app without a user name and password.
Look at the model that the newspapers use. Washington Post, for example, has a free app with a $15 In-App purchase that provides you access to their content. You get a limited number of free articles, first, though. See, they provide content for everyone even if on a limited basis. You can also sign into the application, which unlocks all content, if you already have a paying account.
Is there any way to post on a user's activity feed for an iOS game? There seems to be no API for this but there is a permission
user_games_activity
on https://developers.facebook.com/docs/authentication/permissions/#open_graph_perms
I have noticed that there are activity feeds for Facebook games itself, but I haven't come across an activity feed regarding an iOS app.
Any help would be appreciated, thanks!
You can post user actions/achivements from iOS by taking publish_actions extended permission, but you need backend server support. You need a public url with open graph tags for each object/achievement.
Publish actions
Allows your app to publish to the Open Graph using Built-in Actions,
Achievements, Scores, or Custom Actions. Your app can also publish
other activity which is detailed in the Publishing Permissions doc.
Note: The user-prompt for this permission will be displayed in the
first screen of the Enhanced Auth Dialog and cannot be revoked as part
of the authentication flow. However, a user can later revoke this
permission in their Account Settings. If you want to be notified if
this happens, you should subscribe to the permissions object within
the Realtime API.
If you want to post achivements, here is basic info. For more info see the below link.
The Graph API for achievements allows game developers to publish user
achievements in their game to provide more meaningful and relevant
stories.
Note: This API is only available to applications categorized as
'Games'. You can categorize your app as 'Games' in the Developer app
by navigating to About > Basic Info and selecting 'Games` in the drop
down menu in the category field.
FYI: https://developers.facebook.com/docs/achievements/
FYI: Improving app distrubution
I want to make an application that has some views for information display. If I install my app on my iPhone then it should display the info. If I then install that app on my iPad then the app should recognize the device and display the info related to my account.
Is there any way to find the single user of two devices without the user's iTunes credentials, or is it possible to generate a key that can identify the common user of both devices?
No, currently there is no way to associate multiple devices to a single user owning those devices given the information you've provided.
However, if you added, "the information I want to display in the views, pertains to the same user account in Game Center for both devices", then you could use the player's identifier from Game Kit API.
https://developer.apple.com/game-center/
This is being added well after the fact, but:
You could use iCloud APIs to accomplish this. These are distinct from iTunes credentials, but obviously the same type of prerequisite in that the user must have an account and it's not under your control.