Can such an app freely read my emails/calendar/message/docs/etc.?
The "USE ACCOUNTS ON THE DEVICE" permission is also known for developers as android.permission.USE_CREDENTIALS.
|show 4 more comments|
Android has a centralized system for managing credentials for online services (such as your Google account). One component is called the
Example: logging into Google
Your phone has a built-in app that "acts as an account authenticator" for your Google account. It knows how to log into Google, and it has the email and password you entered when you set up the phone. There's also a YouTube app, which wants to log in to show your favourite videos, and to let you comment, but without having to enter your email and password again.
This YouTube app talks to the
If you say yes, the
The authenticator and the online service can also control what actions the requesting app can perform. For example, when you connect an app to your Google account, Google lists permissions the app needs (such as "upload videos" for YouTube). Thus, the app can only do the actions listed. However, some services might not have anything like that; for such a service, once you've allowed the app to use your credentials, it can take any action in your name.
Once the requesting app has obtained the authtoken, it can continue to use it to perform actions in your name without any further interaction from you. That is, once you've agreed that Dan's Twitter Client can post to your Twitter feed, it might run in the background and post further tweets without you knowing. You should only grant the app access to your credentials if you trust it not to do that.
An app with the "use accounts on the device" permission can, once installed, ask you to access an online service (such as Google, Facebook, or Twitter) in your name. You can choose to let it access the service or not. If you do let it access the service, what actions it can take on your behalf might be limited by the service (it's up to the service), and the service might let you revoke that permission later (usually through a list of "connected apps" on the service's website).
I found this example in Android API of what can be done using that permission.
From my understanding as a developer, this means access to EVERYTHING.
Once a user has an account's token, he can access any services accounts offers: Facebook's stream, Google's emails - EVERYTHING.