Beyond the Prompt: Why Android API 23 Was the Most Important Security Turning Point in Mobile History

When developers talk about Android milestones, certain version numbers carry legendary weight. API Level 23, released alongside Android 6.0 Marshmallow in late 2015, is chief among them.

While everyday users noticed minor visual tweaks and Google Now on Tap, mobile engineers and security experts recognized API 23 for what it truly was: a seismic shift in how mobile operating systems handle user privacy and application permissions.

The Pre-Marshmallow Wild West: Install-Time Permissions

To understand why API 23 was so revolutionary, you have to look back at how Android handled permissions before it.

In the era of API Level 22 (Android 5.1 Lollipop) and earlier, permissions operated on an all-or-nothing, install-time model. When a user went to the Google Play Store and clicked “Install” on an app, a comprehensive list of requested permissions popped up—accessing the camera, reading contacts, reading storage, tracking location, and making phone calls.

This system had critical flaws:

• The “Take It or Leave It” Dilemma: If a flashlight app demanded access to your phone book and location, you had two choices: accept all of them or don’t install the app at all.
• Alert Fatigue: Users became conditioned to blindly hit “Accept” or “Next” on permission dialogs without reading them, paving the way for data-harvesting software to slip past unnoticed.
• Zero Context: An app would request access to the microphone months before you actually tried to record anything, giving no contextual clue as to why the access was required.

Enter API 23: The Runtime Permissions Revolution

API 23 changed the paradigm entirely by introducing Runtime Permissions. Instead of forcing users to grant all permissions upfront during installation, apps targeting API 23 had to ask users for permission at the exact moment the feature was needed.

[User triggers feature] ──> [App checks for permission] 
                                    │
                        ┌───────────┴───────────┐
                        ▼                       ▼
                   [Granted]               [Not Granted]
                        │                       │
                [Execute Action]       [Prompt Runtime Dialog]

Under this new framework:

• A photo-editing app wouldn’t ask for storage permissions until you tried to open your gallery.
• A messaging app wouldn’t request microphone access until you tapped the voice-note button.
• If a user denied a permission, the app had to gracefully handle the restriction rather than crashing or refusing to open.

This user-centric approach restored control to the device owner. It transformed mobile security from a passive legal disclaimer into an active, conversational safety net.

Categorizing Danger: Normal vs. Dangerous Permissions

API 23 also introduced a granular classification system, splitting Android permissions into two distinct buckets:

1. Normal Permissions: These cover areas where your data poses little privacy risk (