Who Added that Permission to My App? An Analysis of Developer Permission Changes in Open Source Android Apps

Android applications rely on a permission-based
model to carry out core functionality. Appropriate permission
usage is imperative for ensuring device security and protecting
the user’s desired privacy levels. But who is making the important
decisions of which permissions the app should request? Are they
experienced developers with the appropriate project knowledge to
make such important decisions, or are these crucial choices being
made by those with relatively minor amounts of contributions to
the project? When are these permission-related decisions being
made in the app’s development life cycle? We examined 1,402
Android version control repositories containing over 331,318
commits including 18,751 AndroidManifest.xml versions to better
understand when, why, and who is adding permissions to apps.
We found that (I) developers with more experience are more
likely to make permission-based changes (II) permissions are
typically added earlier in apps’ commit lifetime, but their
removal is more sustained throughout the commit lifetime (III)
developers reverting permission-based changes are typically more
experienced than developers who initially made the change being
reverted.