Google needs to break up its all-or-nothing approach to permissions