Android App Permissions Dialog

Most Android users are at least vaguely aware, that every time we install or update an app, we’re shown a dialog with a list of permissions the app is requesting on our mobile device. We can either Allow or Deny this request.

What people should be aware of as well, is that by default, Android did not allow us to Accept or Decline each permission on its own. We were shown the whole list, and would then have to either Accept or Decline the entire list, and in the latter case, the app would not install, or the update would not take place.

This was a rather powerless feature, because when we declined an update, Google Play would just come back within short order, and offer the same update again. Also, there was no way to opt out of updating for one specific app. So we would then either be obliged to accept the update at a later time, or to uninstall the app.

This was the status-quo up to and including “Android Lollipop”. The Android version that came after Lollipop, and which is the current version, is called “Marshmallow”. And the main, key improvement which Marshmallow offers, is control by the user, for each individual permission the app is asking for. With Marshmallow, the user is no longer obliged either to accept the entire list of permissions or to reject it. He can grant or deny any specific permission, and then still install the update, which gets rid of the messages for that update.

One reason fw this is important, is the possibility of a “Privilege Escalation”, which is also a known form of cyber-attack. Privilege Escalation means, that an already-installed app can ask for progressively more permissions during each update, which users often don’t pay strict attention to, so that after several updates, the app has a dangerous collection of them on our device.

Granted, most of the time the apps need a large number of permissions for innocuous purposes, or maybe because they’re just not programmed well enough, to work without those. But the potential exists for too liberal a set of permissions eventually to compromise our privacy online, or even our online security.

This is why, regardless of whether we have Marshmallow or not, we should in fact be examining the requested permissions each time, before we simply grant them.

Having said that, I don’t have Android Marshmallow yet. This is secondhand information, from a friend of mine who is in the know, and who has Marshmallow on at least one of his devices.



Print Friendly, PDF & Email

7 thoughts on “Android App Permissions Dialog”

  1. Your style is so unique in comparison to other
    folks I’ve read stuff from. Thank you for posting when you’ve
    got the opportunity, Guess I’ll just book mark this site.

    my webpage Buddy

  2. I know this if off topic but I’m looking into starting my own weblog and was wondering what all is required
    to get setup? I’m assuming having a blog like yours would cost a pretty penny?
    I’m not very internet smart so I’m not 100% sure. Any suggestions
    or advice would be greatly appreciated. Cheers

    My website – garcinia cambogia free trial uk (Burton)

    1. I see two options for you: (1) Use a Blog-hosting service, or (2) Use a Web-server you at least have FTP access to, and do as I did, Upload to that server. I installed mine from a package-manager. My own blog uses this Web-application, not to be confused with, which you need to pay a subscription for.

      Therefore, the front page of my blog has the Meta-Widget as the last one at the bottom of its sidebar, which includes a credit and link to Beware though, that if you do upload the package of PHP scripts to a server – with privileges to run those – you’ll need to do some fiddling with it to get everything working. has a Support Forum to help its users with such issues, and yet I wouldn’t recommend it to anybody anyway, who isn’t fully computer-literate. In this last case, you’d be better off going with a paid-for service.

      If you simply added daily postings to an existing Web-page, your problem would be that Search Engines will not pick those up. A real blogging engine includes ‘SEO’ as well as an update service, which gets notified every time a blogger posts something.

    2. I should add: IF you are a client of a Web-hosting service, it would always be good to ask them, whether you’re allowed to be ‘running PHP, CGI scripts’. But because “” is Open-Source Software, the most you could lose if you’re not, is the time wasted uploading, and then having to delete the files again…

  3. There was nothing special you needed to do. It was just up to me to fix them. You click on them and follow your browser’s on-screen instructions.

  4. Oɦ my goodness! Inchredible article dude! Mɑny thanks,
    Ηowever Ⅰ ɑm Һaving difficulties
    ѡith yοur RSS. ӏ dοn’t understasnd tҺе reason ᴡhy I cannot join іt.

    Ιѕ tҺere anybody ᥱlse
    getting tҺе same RSS problems?
    Ꭺnyone whho кnows tһе solution ᴡill yⲟu kindly respond?


    Ηere iѕ mу website; ourworld gem code

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>