Access Control: Screen Locks, App Permissions & Mobile Privacy

Table of Contents

Part 1: Screen Locks

• Types of Screen Locks
• Screen Lock Security Tier List
• Platform Configuration Guide
• Lock Screen Notification Privacy
• Advanced Lock Screen Features

Part 2: App Permissions

• What Are App Permissions?
• Permission Risk Matrix
• Platform Permission Models
• Permission Audit Guide
• Suspicious Permission Patterns
• Permissions by App Category

Part 3: Mobile Privacy

• What Data Do Apps Collect?
• Privacy Labels (iOS & Play)
• Privacy Settings Deep Dive
• Privacy Scores for Major Apps
• Advanced Privacy Techniques
• Complete Checklist
• Exercises

Overview

Access control is the core of mobile security — it determines who can access your device (screen locks) and what apps can access on your device (permissions and privacy). This tutorial covers these three interlocking layers:

Screen Locks ──► Controls physical device access
      │
      ▼
App Permissions ──► Controls app access to data/hardware
      │
      ▼
Mobile Privacy ──► Controls how collected data is used/shared

Part 1: Screen Locks — Your First Line of Defense

How to control physical access to your device — the most basic and important security layer.

A screen lock prevents unauthorized access if your device is lost, stolen, or temporarily unattended. No lock screen = anyone who picks up your phone has access to everything.

Types of Screen Locks — Detailed Comparison

1. PIN (Personal Identification Number)

Commonly used (and easily guessed) PINs:

1234   (most common)
0000   1111   2222   3333
2580   (straight vertical)
1212   1122   4321
The user's birth year (e.g., 1995)

Over 25% of 4-digit PINs can be guessed in 20 attempts using the most common combinations.

Best practices:

• Use a 6-digit PIN minimum (not 4).
• Avoid sequential numbers, repeated digits, and personal dates.
• Wipe fingerprints off the screen after unlocking.

2. Alphanumeric Password

A combination of letters, numbers, and symbols — the strongest lock screen option.

Recommended format:

Use a passphrase: "Blue@SkY$2024!Mob" 
(Random words + numbers + symbols — easy to remember, hard to crack)

3. Pattern Lock (Android)

A 3x3 dot grid pattern — convenient but the least secure lock option.

Why pattern locks are weak:

• Smudge marks on the screen reveal the pattern.
• Common patterns (L-shape, square, zigzag) are easily guessed.
• Can be observed from a distance more easily than PIN entry.
• Most people start from the top-left corner (~40% of patterns).

Real-world example: In a 2017 study, researchers could guess over 50% of pattern locks within 5 attempts using common patterns.

4. Fingerprint (Touch ID / Ultrasonic)

Uses your unique fingerprint to unlock — fast and convenient with some legal caveats.

Security considerations:

• In the US, courts have ruled that police can compel you to unlock with fingerprint (but NOT with a passcode — 5th Amendment protection for "testimony").
• High-quality photos of fingerprints can theoretically be used to create fake prints.
• Sweat, dirt, moisture can interfere with reading.
• Wet hands are a common failure mode.

Best practices:

• Register multiple fingers (especially thumbs — most commonly used).
• Clean the sensor if it's not reading correctly.
• After device restart, you MUST enter your passcode first (fingerprint alone won't work).

5. Face Recognition

Uses your face to unlock — security varies dramatically between Face ID and 2D camera-based systems.

Face ID is highly secure because:

• It uses depth information — a flat photo won't work.
• It projects infrared dots — works in complete darkness.
• It adapts to changes in appearance (beard, glasses, hats).
• Attention-aware — only unlocks if your eyes are open and looking at the phone.

Android Face Unlock (2D camera-based):

Important: Some Android phones (Google Pixel 4, Samsung S22+/S23+) have secure face unlock with depth sensors similar to Face ID. Check your specific device capabilities.

6. Iris Scanner (Samsung, some Androids)

Scans your iris pattern using infrared — very secure but less common in newer devices.

Note: Iris scanners are becoming less common. Samsung removed them from the S10 series onward in favor of ultrasonic fingerprint + face unlock.

Screen Lock Security Tier List

A ranked comparison of all lock types from best to avoid.

Tier 1 (Best):
  ├── Alphanumeric Password (8+ chars, mixed case + symbols)
  ├── Face ID (Apple)
  ├── Iris Scanner
  └── 6+ digit PIN

Tier 2 (Good):
  ├── 6-digit PIN
  └── Fingerprint (as secondary)

Tier 3 (Adequate — but upgrade):
  └── 4-digit PIN

Tier 4 (Avoid):
  ├── Pattern Lock
  ├── 2D Face Unlock (Android)
  └── No lock screen (!!)

Platform-Specific Lock Configuration

Where to find and configure lock screen settings on Android and iOS.

Android Settings Path

iOS Settings Path

Where to find and configure key lock screen settings on iOS.

Lock Screen Notification Privacy

How to stop sensitive information from being visible on your locked screen. Even with a lock screen, notifications can show sensitive content.

Risks:

• Banking OTPs visible on lock screen.
• Private messages previewed for anyone to read.
• Calendar events with locations visible.
• 2FA codes from authenticator apps on lock screen.

Recommended settings:

Android: Settings → Notifications → Lock screen
  → "Show sensitive content only when unlocked" (or "Hide")

iOS: Settings → Face ID & Passcode → Allow Access When Locked
  → Disable: Notification Center, Today View
  → Or: Settings → Notifications → Preview → "When Unlocked" or "Never"

Advanced Lock Screen Features

Auto-wipe and Smart Lock — useful features with important security trade-offs.

• Device factory resets after 10 failed unlock attempts.
• ⚠️ Warning: If a child or unauthorized person keeps trying, you lose ALL data.
• ✅ Safer approach: Back up regularly AND enable auto-wipe.
• Android: Settings → Security → Auto factory reset.
• iOS: Settings → Face ID & Passcode → Erase Data.

Smart Lock (Android)

• Keeps device unlocked in specific trusted contexts:

⚠️ Smart Lock trades security for convenience. Use only the specific contexts you need.

Part 2: App Permissions — Gatekeepers of Your Data

How apps request and use access to your data and device features — and how to control them.

What Are App Permissions?

Permissions control which data (location, camera, contacts, etc.) an app can access. Permissions control which data and hardware features an app can use — location, camera, microphone, contacts, photos, SMS, calendar, health data, and more.

The Principle of Least Privilege

Only grant an app the minimum permissions it actually needs — nothing more.

✅ A Maps app needs:
   • Location (While Using App)
   • Storage (to cache maps offline)

❌ A Maps app does NOT need:
   • Contacts
   • SMS
   • Microphone
   • Camera (unless it's also navigating with AR)

The golden rule: Every permission request should have a clear, justifiable reason. If you can't figure out why an app needs a permission, deny it.

Permission Risk Matrix — Full Breakdown

A complete reference of every permission type, what goes wrong if abused, and when it's actually needed.

Permission Models by Platform — Detailed

How Android and iOS handle permissions differently — from install-time to granular runtime controls.

Android Permissions Evolution

Android's permission system has improved dramatically over versions:

How Android permissions work now:

App needs location → System dialog appears
  ┌─────────────────────────────────┐
  │ Allow "Maps" to access this     │
  │ device's location?              │
  │                                 │
  │ ○ Precise    ○ Approximate     │
  │                                 │
  │ [Allow]  [While Using] [Deny]  │
  │                    [Only This   │
  │                     Time]       │
  └─────────────────────────────────┘

Your options:
• Allow all the time (avoid unless necessary)
• Allow only while using the app (recommended for most cases)
• Ask every time (most restrictive — grant once only)
• Deny (app may or may not work without it)

iOS Permissions

iOS has always had a strong permission model. Key aspects:

Types of permission prompts:

App wants to access your Location:
  [Allow Once]  [Allow While Using App]  [Deny]

App wants to access your Photos:
  [Allow Full Access]  [Select Photos...]  [Deny]

App wants to Track You:
  [Ask App Not to Track]  [Allow]

Unique iOS permission features:

Permission Audit — How to Review

Step-by-step guide to auditing permissions on both platforms.

Android Permission Manager (Best tool)

Settings → Privacy → Permission Manager
This shows you ALL apps with each permission type.

For each permission (Location, Camera, etc.):
→ See exactly which apps have access
→ Revoke inappropriate access
→ Look for "Always" — this should be rare

Monthly audit checklist:

1. Open Permission Manager.
2. Click on Location — How many apps have "Allow all the time"? Ideally 1-2 (maybe Maps, Find My Device).
3. Click on Camera — Do 20 apps have camera access? They shouldn't.
4. Click on Microphone — Same check.
5. Click on SMS — Only banking apps and SMS backup apps should be here.
6. Click on Contacts — Only messaging and email apps.
7. Click on Phone — Only phone and call-recording apps.

iOS Privacy Settings

Settings → Privacy → [Permission Type]
Shows all apps with that permission.

Better approach: Settings → Privacy → App Privacy Report
→ Turn ON "App Privacy Report"
→ Wait a few days of normal use
→ Check which apps accessed what, when, and how often

What to look for in Privacy Report:

• Apps accessing location in the background unexpectedly.
• Apps reading clipboard data.
• Apps checking contacts or photos when you didn't ask them to.
• Apps with high "data access" counts for no clear reason.

Suspicious Permission Patterns

Quick reference for spotting permission combinations that should raise red flags.

Real-world example: In 2023, Google removed dozens of battery saver and cleaner apps that were secretly extracting contacts and SMS data and sending them to ad networks.

App Permissions by Category — What's Reasonable

A practical guide to which permissions make sense for different types of apps.

Note: Some legitimate apps need permissions that seem suspicious. Banking apps need camera for check deposit. Messaging apps need contacts for friend discovery. The key is: can the app justify the permission request with a clear explanation?

Part 3: Mobile Privacy — Taking Control of Your Data

How your data is collected, what you can do about it, and how to make informed privacy decisions.

What Data Are Apps Collecting?

The full range of data that apps can collect — from contact info to device diagnostics.

Categories of data collection (per Apple/Google privacy labels):

Privacy Labels — How to Read Them

How to read iOS App Store privacy labels and Google Play Data Safety sections before installing.

iOS App Store — App Privacy

App Store → Tap App → Scroll to "App Privacy"
Shows:
┌────────────────────────────────────────┐
│ App Privacy                            │
│                                        │
│ Data Used to Track You:                │
│   • Identifiers                        │
│   • Usage Data                         │
│                                        │
│ Data Linked to You:                    │
│   • Contact Info                       │
│   • Location                           │
│   • User Content                       │
│                                        │
│ Data Not Linked to You:                │
│   • Diagnostics                        │
└────────────────────────────────────────┘

• Data Used to Track You — Linked to your identity across apps/websites for ads.
• Data Linked to You — Collected and can be tied to your identity (e.g., for account management).
• Data Not Linked to You — Collected but not tied to you specifically (aggregated).

Google Play — Data Safety

Google Play → Tap App → Scroll to "Data Safety"
Shows:
┌────────────────────────────────────────┐
│ Data Safety                            │
│                                        │
│ Data collected:                        │
│  ✅ Personal info (name, email)        │
│  ✅ Location                           │
│  ✅ Photos & videos                    │
│  ❌ SMS messages                       │
│                                        │
│ Data shared with third parties:        │
│  ✅ Location (for ads)                 │
│                                        │
│ Security practices:                    │
│  ✅ Data encrypted in transit          │
│  ✅ You can request data deletion      │
└────────────────────────────────────────┘

Always check privacy labels BEFORE installing, not after.

Privacy Settings Deep Dive

Step-by-step configuration guides for the most important privacy settings on both platforms.

Android Privacy Settings

iOS Privacy Settings

Privacy by App Category — Pro Tips

Privacy best practices for specific app types — social media, banking, messaging, and health.

Social Media (Facebook, Instagram, TikTok, Snapchat)

• Location: Only While Using — never Always.
• Background Refresh: OFF — they don't need to update in the background.
• App Tracking: Deny/Ask not to track.
• Contacts: Deny unless you want friend suggestions from your phonebook.
• Photos: Use limited/selected access.
• Check: Privacy checkup in each app's settings.

Facebook specific:

• Settings & Privacy → Privacy Shortcuts → Review.
• Off-Facebook Activity → Clear History (stops Facebook from tracking your web activity).

Banking & Finance Apps

• Location: While Using (for fraud checks) or Deny (work in many cases).
• Biometrics: Enable app-level fingerprint/Face ID login.
• Notifications: Leave enabled (fraud alerts) but check what info they show on lock screen.
• Photos: Deny for most banking apps (only need it for check deposit; grant temporarily).
• Extra: Don't store passwords in the app (use password manager instead).

Messaging (WhatsApp, Signal, Telegram)

• Privacy check for WhatsApp:
  • Last Seen & Online: My Contacts / Nobody.
  • Profile Photo: My Contacts.
  • About: My Contacts.
  • Status: My Contacts.
  • Read Receipts: OFF if you want privacy.
  • Disappearing Messages: ON for sensitive chats.
  • End-to-End Backups: ON (iOS: Advanced Data Protection).

Health & Fitness Apps

• Location: While Using only.
• What to review: Which apps can read/write Health data (iOS Health or Android Health Connect).
• Revoke: Remove access for apps you no longer use.
• Danger: Some fitness apps share data with insurers — check the privacy policy.

Privacy Scores for Major Apps

At-a-glance privacy ratings for popular apps — from Signal (best) to TikTok (worst).

Advanced Privacy Techniques

Go beyond the basics — use App Privacy Reports, Google Takeout, and third-party audits.

1. App Privacy Report (iOS)

Settings → Privacy → App Privacy Report → Turn ON
After a week: Review which apps access what
→ Surprising finding: Many apps access data you didn't expect
→ Action: Revoke unnecessary permissions

2. Google Takeout — Download Your Data

takeout.google.com
You can download everything Google knows about you:
→ Search history, location history, YouTube activity
→ Emails, contacts, calendar
→ It's often SHOCKING how much data is collected
→ Clear what you don't need

3. Apple Privacy Report

appleid.apple.com → Data & Privacy
→ Request a copy of your data
→ Manage data stored in iCloud

4. Third-Party App Access Audit

Google Account → Security → Third-party apps with account access
Apple ID → Sign in with Apple → Apps Using Your Apple ID
→ Remove apps you no longer use
→ This is often a huge amount of apps people forget about

Complete Access Control Checklist

A comprehensive checklist organized by daily, weekly, monthly, quarterly, and annual tasks.

Daily

• Lock device when not in use (make it a habit — every time you put it down).
• Check for camera/mic indicators (green/orange dots on iOS, icons on Android).

Weekly

• Review lock screen notifications — any sensitive content leaking?

Monthly

• Permission Audit: Open Permission Manager (Android) or Privacy (iOS).
• Review Location access — how many "Always" apps? Reduce to 1-2.
• Review Camera + Mic access — revoke unused apps.
• Review Contacts + SMS access.
• Check App Privacy Report (iOS) — which apps are accessing what unexpectedly?.
• Uninstall apps you haven't used in 3+ months.

Quarterly

• Check third-party app access on Google Account (myaccount.google.com) and Apple ID (appleid.apple.com).
• Review privacy settings (ad tracking, analytics, location history).
• Clear Google Location History and Web & App Activity.
• Check what devices are logged into your accounts.

Annually

• Full privacy audit — review all settings from scratch.
• Download your data from Google Takeout and Apple Privacy — see what's collected.
• Change critical passwords (Google Account, Apple ID, banking).
• Review and update trusted phone numbers for account recovery.
• Full backup + factory reset if device is 2+ years old (fresh start, removes accumulated app clutter).

Bottom Line: Access control is the foundation of mobile security.

• Screen locks control WHO gets into your device.
• App permissions control WHAT apps can access.
• Privacy settings control HOW your data is used.

Master these three layers and review them regularly. The biggest mistake users make is "set it and forget it" — permissions and privacy need ongoing attention.

Exercises

Exercise 4.1 — Lock Screen Security Design (10 min)

Objective: Design the optimal lock screen configuration for different user profiles.

Scenario A — Busy Professional:

User profile: Always on the go, sensitive work emails, mobile banking daily.
Design their lock screen:
  Lock type: _________________
  Auto-lock timer: ____ seconds
  Notifications on lock screen: Show / Hide / Don't Show
  Smart Lock: Enabled? ______ Trusted devices? ______
  Biometrics: Enable? ______
  Wipe after 10 attempts: Enable? ______
Justify your choices: _______________________________________________

Scenario B — Elderly Parent:

User profile: Not tech-savvy, forgets passwords, uses phone for calls only.
Design their lock screen:
  Lock type: _________________ (balance security + simplicity)
  Auto-lock timer: ____ seconds/minutes
  Biometrics: _________________
  Emergency contacts on lock screen: _________________
  Find My Device: Enable for them? _________________

Scenario C — Teenager:

Heavy social media, downloads many apps, shares phone with friends.
Design their lock screen:
  Lock type: _________________
  Parental controls needed? _________________
  Most important security advice: __________________________________

Exercise 4.2 — Full Permission Audit — Real Device (20 min)

Objective: Perform a complete permission audit on your own phone.

PERMISSION AUDIT WORKSHEET

LOCATION ACCESS:
├── "Allow all the time": _________________________
├── "Allow while using": _________________________
├── "Ask every time": _________________________
└── Suspicious findings: _________________________

CAMERA ACCESS:
├── Apps that have it: _________________________
├── Should NOT have it: _________________________
└── Actions taken: _________________________

MICROPHONE ACCESS:
├── Apps that have it: _________________________
├── Should NOT have it: _________________________
└── Actions taken: _________________________

CONTACTS ACCESS:
├── Apps that have it: _________________________
├── Should NOT have it: _________________________
└── Actions taken: _________________________

SMS ACCESS:
├── Apps that have it: _________________________
├── Justifiable: _________________________
└── Actions taken: _________________________

SUMMARY:
├── Total permissions revoked this session: ____
├── Apps uninstalled: ____
└── New security score (estimate): ____/100

Exercise 4.3 — App Privacy Label Comparison (10 min)

Objective: Compare privacy labels of similar apps before installing.

Pick 3 apps from the SAME category (e.g., Messaging, Weather, VPN):

APP 1: __________
  ─ Data Used to Track You: ________________
  ─ Data Linked to You: ________________
  ─ Data Not Linked to You: ________________

APP 2: __________
  ─ Data Used to Track You: ________________
  ─ Data Linked to You: ________________
  ─ Data Not Linked to You: ________________

APP 3: __________
  ─ Data Used to Track You: ________________
  ─ Data Linked to You: ________________
  ─ Data Not Linked to You: ________________

VERDICT: Which is most privacy-friendly? ________________