Android trojan steals keystrokes using phone movements (ars technica)

I think a lot of grief could be spared by splitting some permissions. One such is separating out a "connect to advertisement networks" from "connect to the Internet", or even to have a whitelist of IP addresses or domain names attached to the Internet permission. Another possibility would be to just have applications actually describe what the permission is used for in the manifest file so that the market can display it. I currently have two upgrades waiting on my Galaxy Nexus because they add the "read sensitive logs" permission with no explanation of why it is needed. They also don't really make sense to have the permission in the first place (Google Voice and My Verizon) and there's no explanation.