Android permissions
Abstract
Android's permission system is intended to inform users about the risks of installing applications. When a user installs an application, he or she has the opportunity to review the application's permission requests and cancel the installation if the permissions are excessive or objectionable. We examine whether the Android permission system is effective at warning users. In particular, we evaluate whether Android users pay attention to, understand, and act on permission information during installation. We performed two usability studies: an Internet survey of 308 Android users, and a laboratory study wherein we interviewed and observed 25 Android users. Study participants displayed low attention and comprehension rates: both the Internet survey and laboratory study found that 17% of participants paid attention to permissions during installation, and only 3% of Internet survey respondents could correctly answer all three permission comprehension questions. This indicates that current Android permission warnings do not help most users make correct security decisions. However, a notable minority of users demonstrated both awareness of permission warnings and reasonable rates of comprehension. We present recommendations for improving user attention and comprehension, as well as identify open challenges.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Only 17% of participants paid attention to permissions and almost half did not notice permissions at all.
“In their study on user attention, comprehension and behavior regarding Android permissions, Felt et al. (2012) determined that only 17% of participants paid attention to permissions and almost half of the sample did not notice permissions at all.”
From Putting the privacy paradox to the test: Online privacy and security behaviors among users with technical knowledge, privacy awareness, and financial resources (2019) · cites this paper as Felt et al. (2012)
Understanding of permissions is crucial for privacy consideration; without sufficient knowledge, users cannot make adequate privacy decisions.
“The understanding of permissions is a crucial component in privacy consideration as without sufficient knowledge about permissions warning, users are unable to make adequate privacy decisions (Felt et al., 2012).”
From Putting the privacy paradox to the test: Online privacy and security behaviors among users with technical knowledge, privacy awareness, and financial resources (2019) · cites this paper as Felt et al., 2012
Cites
Zhu, F., & Zhang, X. (2010) · Journal of Marketing · doi:10.1509/jmkg.74.2.133 · Cited by 2,372 · see citing works
An Information Processing Theory of Consumer Choice
Ross, I., & Bettman, J. R. (1979) · Journal of Marketing · doi:10.2307/1250155 · Cited by 2,267 · see citing works
TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones
Enck, W., Gilbert, P., Chun, B.-G., Cox, L. P., Jung, J., McDaniel, P. D., & Sheth, A. N. (2010) · doi:10.5555/1924943.1924971 · Cited by 2,259 · see citing works
Android permissions demystified
Felt, A. P., Chin, E., Hanna, S., Song, D. X., & Wagner, D. (2011) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2046707.2046779 · Cited by 1,305 · see citing works
Self-citationWhy are you telling me this? An examination into negative consumer reviews on the Web
Sen, S., & Lerman, D. B. (2007) · Journal of Interactive Marketing · doi:10.1002/dir.20090 · Cited by 1,267 · see citing works
On lightweight mobile phone application certification
Enck, W., Ongtang, M., & McDaniel, P. D. (2009) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1653662.1653691 · Cited by 926 · see citing works
A study of android application security
Enck, W., Octeau, D., McDaniel, P. D., & Chaudhuri, S. (2011) · Cited by 871 · see citing works
A survey of mobile malware in the wild
Felt, A. P., Finifter, M., Chin, E., Hanna, S., & Wagner, D. (2011) · Security and Privacy in Smartphones and Mobile Devices · doi:10.1145/2046614.2046618 · Cited by 775 · see citing works
Self-citationHey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets
Zhou, Y., Wang, Z., Zhou, W., & Jiang, X. (2012) · Network and Distributed System Security Symposium · Cited by 734 · see citing works
Egelman, S., Cranor, L. F., & Hong, J. (2008) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/1357054.1357219 · Cited by 610 · see citing works
Self-citationThese aren't the droids you're looking for
Hornyack, P., Han, S., Jung, J., Schechter, S., & Wetherall, D. J. (2011) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2046707.2046780 · Cited by 569 · see citing works
Privacy in electronic commerce and the economics of immediate gratification
Acquisti, A. (2004) · Proceedings of the 5th ACM conference on Electronic commerce · doi:10.1145/988772.988777 · Cited by 561 · see citing works
Location disclosure to social relations
Consolvo, S., Smith, I. E., Matthews, T. L., LaMarca, A., Tabert, J., & Powledge, P. S. (2005) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/1054972.1054985 · Cited by 547 · see citing works
Ackerman, M. S., Cranor, L. F., & Reagle, J. (1999) · ACM Conference on Electronic Commerce (EC) · doi:10.1145/336992.336995 · Cited by 532 · see citing works
Nauman, M., Khan, S. R., & Zhang, X. (2010) · ACM Symposium on Information, Computer and Communications Security · doi:10.1145/1755688.1755732 · Cited by 530 · see citing works
Location-Based Services for Mobile Telephony: a study of users' privacy concerns
Barkhuus, L., & Dey, A. K. (2003) · IT University Of Copenhagen (IT University of Copenhagen) · Cited by 455 · see citing works
Privacy practices of Internet users: Self-reports versus observed behavior
Jensen, C., Potts, C., & Jensen, C. (2005) · International Journal of Human-Computer Studies · doi:10.1016/j.ijhcs.2005.04.019 · Cited by 406 · see citing works
The Emperor's New Security Indicators
Schechter, S. E., Dhamija, R., Ozment, A., & Fischer, I. (2007) · 2007 IEEE Symposium on Security and Privacy (SP '07) · doi:10.1109/sp.2007.35 · Cited by 405 · see citing works
Journal of Risk and Uncertainty
(2013) · Journal of Risk and Uncertainty · doi:10.1007/11166.1573-0476 · Cited by 374 · see citing works
Lindqvist, J., Cranshaw, J., Wiese, J., Hong, J., & Zimmerman, J. (2011) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/1978942.1979295 · Cited by 362 · see citing works
A Conundrum of Permissions: Installing Applications on an Android Smartphone
Kelley, P. G., Consolvo, S., Cranor, L. F., Jung, J., Sadeh, N., & Wetherall, D. J. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-34638-5_6 · Cited by 352 · see citing works
Crying Wolf: An Empirical Study of SSL Warning Effectiveness
Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., & Cranor, L. F. (2018) · KiltHub Repository · doi:10.1184/r1/6621806 · Cited by 331 · see citing works
Self-citationUnderstanding and capturing people's privacy policies in a mobile social networking application
Sadeh, N., Hong, J., Cranor, L., Fette, I., Kelley, P., Prabaker, M., & Rao, J. (2009) · Personal and Ubiquitous Computing · doi:10.1007/s00779-008-0214-3 · Cited by 318 · see citing works
Privacy indexes : a survey of Westin's studies
Kumaraguru, P., & Cranor, L. F. (2018) · doi:10.1184/r1/6625406 · Cited by 315 · see citing works
(2011) · Journal of Marketing Research · doi:10.1509/jmkr.48.spl.i · Cited by 310 · see citing works
SCanDroid: Automated Security Certification of Android
Fuchs, A. P., Chaudhuri, A., & Foster, J. S. (2009) · University Libraries (University of Maryland) · Cited by 302 · see citing works
(2006) · doi:10.1201/9781482289688 · Cited by 277 · see citing works
Journal of Interactive Marketing
(2006) · Journal of Interactive Marketing · doi:10.1002/(issn)1520-6653 · Cited by 272 · see citing works
A Framework for Reasoning About the Human in the Loop
Cranor, L. F. (2018) · Figshare · doi:10.1184/r1/6620651 · Cited by 256 · see citing works
The effectiveness of application permissions
Felt, A. P., Greenwood, K., & Wagner, D. (2011) · Cited by 245 · see citing works
Self-citationReducing the influence of irrelevant information on experienced decision makers
Gaeth, G. J., & Shanteau, J. (1984) · Organizational Behavior and Human Performance · doi:10.1016/0030-5073(84)90024-2 · Cited by 229 · see citing works
User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems
Roesner, F., Kohno, T., Moshchuk, A., Parno, B. J., Wang, H. J., & Cowan, C. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.24 · Cited by 215 · see citing works
Promoting universal usability with multi-layer interface design
Shneiderman, B. (2002) · Conference on Universal Usability · doi:10.1145/957205.957206 · Cited by 196 · see citing works
King (2011) · doi:10.1145/2078827.2078843 · Cited by 100 · see citing works
Multi-Layered Interfaces to Improve Older Adults' Initial Learnability of Mobile Applications
Leung, R., Findlater, L., McGrenere, J., Graf, P., & Yang, J. (2010) · ACM Transactions on Accessible Computing · doi:10.1145/1838562.1838563 · Cited by 91 · see citing works
Motiee, S., Hawkey, K., & Beznosov, K. (2010) · Proceedings of the Sixth Symposium on Usable Privacy and Security · doi:10.1145/1837110.1837112 · Cited by 71 · see citing works
When are users comfortable sharing locations with advertisers?
Kelley, P. G., Benisch, M., Cranor, L. F., et al. (2011) · ACM SIGCHI Conference on Human Factors in Computing Systems (CHI) · doi:10.1145/1978942.1979299 · Cited by 59 · see citing works
Consumer processing of hazard warning information
Magat, W. A., Viscusi, W. K., & Huber, J. C. (1988) · Journal of Risk and Uncertainty · doi:10.1007/bf00056168 · Cited by 54 · see citing works
Position Bias in Multiple-Choice Questions
Blunch, N. (1984) · Journal of Marketing Research · doi:10.1177/002224378402100210 · Cited by 50 · see citing works
Flagged first, then by citations
Research works printed but not linked: 12
- How Consumers Interact with Mobile App Advertising . Harris Interactive Survey , December 2011 . How Consumers Interact with Mobile App Advertising. Harris Interactive Survey, December 2011.
- Android Open Source Project . Android Security Overview , 2012 . Android Open Source Project. Android Security Overview, 2012.
- 10.5555/1190275.1190279 · DOI
- 10.5555/1387649.1387650 · DOI
- 10.5555/2002168.2002175 · DOI
- J. Howell and S. Schechter . What you see is what they get . In Proceedings of the IEEE Workshop on Web 2.0 Security and Privacy (W2SP) , 2010 . J. Howell and S. Schechter. What you see is what they get. In Proceedings of the IEEE Workshop on Web 2.0 Security and Privacy (W2SP), 2010.
- K. Mueller and K. Butler . Flex-P: Flexible Android Permissions. IEEE Symposium on Security and Privacy , Poster Session , 2011 . K. Mueller and K. Butler. Flex-P: Flexible Android Permissions. IEEE Symposium on Security and Privacy, Poster Session, 2011.
- P. Nickinson . Android Market now has more than a quarter-million applications , 2011 . P. Nickinson. Android Market now has more than a quarter-million applications, 2011.
- J. Sunshine , S. Egelman , H. Almuhimedi , N. Atri , and L. F. Cranor . Crying Wolf: An Empirical Study of SSL Warning Effectiveness . In Proceedings of the USENIX Security Symposium , 2009 . J. Sunshine, S. Egelman, H. Almuhimedi, N. Atri, and L. F. Cranor. Crying Wolf: An Empirical Study of SSL Warning Effectiveness. In Proceedings of the USENIX Security Symposium, 2009.
- H. Taylor . Most People are "Privacy Pragmatists" Who, While Concerned about Privacy , Will Sometimes Trade It Off for Other Benefits. Harris Interactive , March 2003 . H. Taylor. Most People are "Privacy Pragmatists" Who, While Concerned about Privacy, Will Sometimes Trade It Off for Other Benefits. Harris Interactive, March 2003.
- S. Thurm and Y. I. Kane . Your apps are watching you , 2010 . S. Thurm and Y. I. Kane. Your apps are watching you, 2010.
- 10.1201/9781482289688 · DOI · Paper page
Cited by
Sorted by citations
Privacy as part of the app decision-making process
Kelley, P. G., Cranor, L. F., & Sadeh, N. (2013) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/2470654.2466466 · Cited by 314 · see citing works
Barth, S., de Jong, M. D. T., Junger, M., Hartel, P. H., & Roppelt, J. C. (2019) · Telematics and Informatics · doi:10.1016/j.tele.2019.03.003 · Cited by 219 · see citing works
McIntosh, T., Kayes, A. S. M., Chen, Y.-P. P., Ng, A., & Watters, P. (2022) · ACM Computing Surveys · doi:10.1145/3479393 · Cited by 146 · see citing works
The Spyware Used in Intimate Partner Violence
Chatterjee, R., Doerfler, P., Orgad, H., Havron, S., Palmer, J., Freed, D., Levy, K., Dell, N., McCoy, D., & Ristenpart, T. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00061 · Cited by 142 · see citing works
Choice Architecture and Smartphone Privacy: There’s a Price for That
Egelman, S., Felt, A. P., & Wagner, D. (2013) · The Economics of Information Security and Privacy · doi:10.1007/978-3-642-39498-0_10 · Cited by 131 · see citing works
Self-citationConceptual framework for the security of mobile health applications on Android platform
Hussain, M., Zaidan, A. A., Zidan, B. B., Iqbal, S., Ahmed, M. M., Albahri, O. S., & Albahri, A. S. (2018) · Telematics and Informatics · doi:10.1016/j.tele.2018.03.005 · Cited by 122 · see citing works
Akter, M., Godfrey, A. J., Kropczynski, J., Lipford, H. R., & Wisniewski, P. J. (2022) · Proceedings of the ACM on Human-Computer Interaction · doi:10.1145/3512904 · Cited by 71 · see citing works
Danilova, A., Naiakshina, A., & Smith, M. (2020) · Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering · doi:10.1145/3377811.3380387 · Cited by 25 · see citing works
Akter, M., Alghamdi, L., Kropczynski, J., Lipford, H. R., & Wisniewski, P. J. (2023) · Extended Abstracts of the 2023 CHI Conference on Human Factors in Computing Systems · doi:10.1145/3544549.3585904 · Cited by 23 · see citing works
Defeating Prompt Injections by Design
Debenedetti, E., Shumailov, I., Fan, T., Hayes, J., Carlini, N., Fabian, D., Kern, C., Shi, C., Terzis, A., & Tramèr, F. (2026) · 2026 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml68715.2026.00040 · Cited by 15 · see citing works
APOLLO: A GPT-based tool to detect phishing emails and generate explanations that warn users
Desolda, G., Greco, F., & Vigano, L. (2025) · Proceedings of the ACM on Human-Computer Interaction · doi:10.1145/3733049 · Cited by 16 · see citing works
The privacy and control paradoxes in the context of smartphone apps
Ayres-Pereira, V., Pirrone, A., Korbmacher, M., Tjostheim, I., & Böhm, G. (2022) · Frontiers in Computer Science · doi:10.3389/fcomp.2022.986138 · Cited by 4 · see citing works
- Authors
- Felt, A. P., Ha, E., Egelman, S., Haney, A., Chin, E., & Wagner, D.
- Affiliations
- University of California, Berkeley (US)
- Venue
- Proceedings of the Eighth Symposium on Usable Privacy and Security
- Publisher
- ACM
- Published
- 2012-07-11
- Pages
- 1-14
- OpenAlex
- W2033811191
- Semantic Scholar
- 1b9fae8255fda28e4adeb96a36f8e907e8aac6f9
- Cited by
- 983
- References
- 39
- Citations by year
- 2026: 27 · 2025: 20 · 2024: 30 · 2023: 32 · 2022: 40 · 2021: 62 · 2020: 72 · 2019: 91 · 2018: 110 · 2017: 95 · 2016: 124 · 2015: 93 · 2014: 97 · 2013: 67 · 2012: 23
- FWCI
- 231.33
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Symposium On Usable Privacy and Security (publishedVersion)
- Funders
- Division of Computing and Communication Foundations (CCF-0424422)
- Topics
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- Android permissions, user attention, security decision-making, user awareness, usability, mobile security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
