Why Does Your Game App Need My Browser History and Photos?

Years ago, I started paying attention to the usage of so-called digital rights management (DRM) in games and made my purchasing decisions accordingly. I might have missed out on some major cultural impacts, but I wasn’t going to passively accept what I thought was a draconian form of copy protection. A form of protection that, by the way, doesn’t even work most of the time, so only legitimate customers get punished.

In practice, it meant not buying many major games. Spore is one very famous example, and I wrote a bit about it in this post about it’s reception in the market. Reading it today, I can see I was a bit angry about the DRM:

Do I like the game? I haven’t played it. Apparently Spore has some crappy so-called DRM solution attached to it, and it’s definitely not available for Gnu/Linux, so my choice is to boot up Windows AND suffer this DRM crap, or play a different game on my preferred system. It’s too bad. If things were different, I’m sure I would have liked Spore, too, but I refuse to pay for a steak dinner delivered on a garbage can lid.

Ooh, burn!

It was my attitude, and it still is today, partly because DRM is fundamentally flawed and partly because it’s a system that makes it easier to be a criminal.

But this post isn’t really supposed to be about DRM. Today, I find myself concerned about downloading free-to-play games on my smartphone that require bizarre permissions.

Recently, I was looking for a good strategy or simulation game to play on my Android smartphone. I found some that seemed promising and popular, and I found myself stopped when I clicked the install button because the requested permissions were ridiculous.

Why does this game need access to my browser bookmarks and history? Or why does that game need access to my photos?

Actually, it seems that Google’s API just doesn’t allow very fine-grained control of what is and isn’t allowed to be accessed by an app. According to this What’s on Dave’s Droid? post, if an app needs access to the state of the phone to know when to minimize if a call is coming in, it has to get that information from the same permission that gives it access to the identity of who is calling.

And this isn’t a new story. I’ve just only become aware of the problem myself.

I get that the permissions section can’t be too complex for the user experience. People don’t read EULAs as it is, and I’m sure many apps are perfectly safe, but is it weird that we’re being so trusting of apps by hoping that they don’t cross a line we’ve given them permission to cross? Especially in a world where we know we’re being spied on?

For now, I feel that I need to treat some apps just as I treated games packaged with so-called DRM. I’ll ignore the ones that ask too much or that are made by someone I have no reason to trust. Maybe I miss out on a gem, but I’ve survived without Sony’s rootkits and the pain of not being able to install a game I’ve legally purchased in the past. I think I’ll survive not playing a game that may or may not be compiling a list of my contacts and recording my location.