Android 6 permission stupidity

Rant ahead.

Some time ago I got a call from a colleague who had problems trying to connect to our meters with a new phone; our app couldn't find any bluetooth devices anymore. During the discussion it became apparent that the new phone had Android 6 installed, first one I've encountered so far. So I started to suspect that something in new Android version might have changed.

Phone in question was across the country at the time so I had to resort to some internet searches by intuition instead. After a short search session it became apparent that to be able to find bluetooth devices apps now need (in addition to old BLUETOOTH_ADMIN permission that explicitly deals with bluetooth discovery) also ACCESS_COARSE_LOCATION permission. Now, this is just about the stu-- no, this is the stupidest thing I've heard this week. Hell, even this month.. Actually, make that two months, as this text has been sitting in my publishing queue for some time now.

Remember, like I just said there is already permission for Bluetooth discovery and pairing, the BLUETOOTH_ADMIN, so for limiting damage a rogue app could do adding this other does absolutely nothing.

The reasoning for this change apparently is that mapping out bluetooth devices nearby would allow rough geolocation, similarly to WiFi. Which is pretty stupid already - unlike WiFi, Bluetooth has very short range - 10 metres or so (granted, I've heard that newer (low energy) versions have improved the range somewhat - no idea how much really). Unless the surroundings is pretty much littered with searchable unmoving devices the search will be pretty much useless.
Most bluetooth devices are actually mobile and most of the time not searchable, so they aren't very useful for location purposes. You might argue that this is a way to inform user about this obscure positioning method, but I don't buy that argument.

But wait, it gets even worse. My app has absolutely no need for location information, ever. I haven't used any Android 6 devices (or even emulators) myself so I haven't seen the new permission system in action, but based on what I've read it asks for permission when it's used (although it seems that for apps targeting older APIs (read: vast majority of them, mine included) the system works as before - permissions are given on install time.)  As far as excuses for a features go, this is a pretty sorry one.

But for new apps -- I imagine that when user clicks "Find BT device" button a permission request for location pops up! User goes "WTF?" and clicks deny. And nothing works. And user has no frickin' idea what just happened (after all, he denied location, not bluetooth!), he only sees that the app can't find any any devices. Yes, the permission can be granted later (via app permissions menu), but first user needs to know that this menu exist and then also why that permission is needed, and I'd imagine that explaining why bluetooth need location permission won't be accepted easily by quite a few end users...

On the other hand, now a rogue Bluetooth-using app (that shouldn't need the information about location) can silently gather information about its (coarse) location any time it wants! After all, now pairing a bluetooth device within app explicitly requires location, so essentially this change made permissions worse. If there were an option to "allow these permissions for 10 minutes" (for the duration of pairing) this just might be acceptable, but it seems to be all-or-nothing (not many people go around changing app permissions after pairing, so that app permission menu doesn't count.)

One use case that might apply would be in-shop beacons (think of targeted advertising - when you're at product aisle you start getting ads for kumquats and whatnot) , but with all the other downsides listed here the new permission is much a failure with more drawbacks than help.

Overall this change is stupid, stupid, stupid. Android permissions have been way too vague for a long time, and this change only waters down existing permissions by shoving even more irrelevant crud to their coverage. What the hell were you thinking there, Google?