Android applications privacy and security concerns

Question

If a user wants to install some applications from play store, is it sole responsibility of the user to decide whether the apps may harm or not? Should the user be worries regarding permissions? For example, if an application asks permission to read contacts, can user be assured that it does not misuse that permission (like, sending to third party)? How google regulates applications and prevent malicious applications? Are all play store applications safe?

Answer 1

In short: You can't be assured that an app won't phone home without further steps. Not on Android nor on iOS, period. If you want to minimise your risk, only install official Play Apps through the store itself, see their permission grants upon install and stick only to popular/high volume apps or to big publishers.

Google's Play store is less curated than Apple's one. Additionally, Android allows to access much more APIs than iOS does (e.g. replacing the keyboard or stock SMS app and so on). Also Google allows you to install apps from other sources in contrast to Apple. Most people see this as more freedom (not meant cynically) while it has its drawbacks.

• In early 2012, Google announced its Bouncer, an internal Google Play malware scanner service that all submitted apps have to pass before they get published.

• Starting with Android 4.2 Google also announced an option to have all installed apps remotely checked for malware by Google (regardless if from Google's Play store or not).

• While I personally don't like them (for their bloat and battery sucking), you can install AntiVirus software like Avast. For improved battery, switch off everything realtime and only have it scan newly installed apps.

If you're rooted you can do more:

• Install an outbound per-app internet firewall (DroidWall)
• Control/withdraw permissions (LBE, Privacy Blocker, PDroid, Permissions denied)
• Install an ad blocker (AdAway)

Answer 2

Answer, no. Not all play store applications are safe.

The reason behind this is that Google does not screen apps entered to the Google Play store - they just appear, with no verification process.

It is the responsibility of the user to judge whether or not an app is safe to install - and the permissions help you with that.

If you have an app that is a calculator, you would be wise to be suspicious if it asked for the read sms permission.

So, there isn't a way to tell if it misuses the permission or not - and those are the risks.

Google does delete apps from Google Play from time to time, however it is never publicized when they do, and it is normally because they are:

• Viruses
• Go against their terms
• Hacking tools

So the only thing you can do is use your common sense.