Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Can such an app freely read my emails/calendar/message/docs/etc.?

The "USE ACCOUNTS ON THE DEVICE" permission is also known for developers as android.permission.USE_CREDENTIALS.

Example of such apps: WhatsApp, MightyText.

share|improve this question
    
I found an example of android API of what can be done using this permission: goo.gl/gjkJB. From my understanding as a developer, this means an access to EVERYTHING. Once a user has an account's token, he can access any services accounts offers: Facebook's stream, Google's emails - EVERYTHING. –  kilaka Jan 25 '13 at 15:06
    
And what's your question? Is this dev orientated, if it is, its offtopic, read the FAQ :) –  t0mm13b Jan 25 '13 at 15:13
2  
I meant from user perspective. I think that users are not aware of the intrusiveness behind that permission. –  kilaka Jan 25 '13 at 15:15
7  
I think this is a reasonable question for this site. I certainly would like to know exactly what each of the available permissions is really giving access to. –  Al E. Jan 25 '13 at 16:06
1  
show 4 more comments

3 Answers 3

up vote 22 down vote accepted
+50

Android has a centralized system for managing credentials for online services (such as your Google account). One component is called the AccountManager. Some apps can "act as an account authenticator". This means that they understand how to log into a particular online service, and can log in to that service for the AccountManager. Other apps want to use that login information to identify you or perform actions on your behalf, without you having to enter your password every time.

Example: logging into Google

Your phone has a built-in app that "acts as an account authenticator" for your Google account. It knows how to log into Google, and it has the email and password you entered when you set up the phone. There's also a YouTube app, which wants to log in to show your favourite videos, and to let you comment, but without having to enter your email and password again.

This YouTube app talks to the AccountManager and asks if it has any credentials for a Google account. Asking this question requires the "find accounts on the device" permission. The AccountManager has a list of authenticators installed on the phone, which it consults to answer this question. If it does have any credentials, the app will then ask for what's known as an authtoken for the Google account. This request requires the "use accounts on the device" permission.

The AccountManager then asks you if you want the requesting app (YouTube) to be able to use the requested account (Google account). This might be in a dialog that appears over the app, or in a notification. Alternatively, the app can choose to do nothing if you haven't already answered yes to this question: it might want to ask later at a more convenient time. This step ensures that an app with the "use accounts on the device" permission can't immediately use every account without asking.

If you say yes, the AccountManager forwards the request to the authenticator (the built-in Google app). What happens next is up to the authenticator and the particular service you're logging into. You might need to log in if you haven't previously done that, and logging in might require a username and password, a photo, an SMS, or something else entirely. Whatever the authenticator does, it can either fail, or give an authtoken back to the requesting app.

Further checks

The authenticator and the online service can also control what actions the requesting app can perform. For example, when you connect an app to your Google account, Google lists permissions the app needs (such as "upload videos" for YouTube). Thus, the app can only do the actions listed. However, some services might not have anything like that; for such a service, once you've allowed the app to use your credentials, it can take any action in your name.

Once the requesting app has obtained the authtoken, it can continue to use it to perform actions in your name without any further interaction from you. That is, once you've agreed that Dan's Twitter Client can post to your Twitter feed, it might run in the background and post further tweets without you knowing. You should only grant the app access to your credentials if you trust it not to do that.

Summary

An app with the "use accounts on the device" permission can, once installed, ask you to access an online service (such as Google, Facebook, or Twitter) in your name. You can choose to let it access the service or not. If you do let it access the service, what actions it can take on your behalf might be limited by the service (it's up to the service), and the service might let you revoke that permission later (usually through a list of "connected apps" on the service's website).

share|improve this answer
add comment

I found this example in Android API of what can be done using that permission.

From my understanding as a developer, this means access to EVERYTHING.

Once a user has an account's token, he can access any services accounts offers: Facebook's stream, Google's emails - EVERYTHING.

share|improve this answer
    
I am not 100% sure but I think that there is a "Select Account" screen before the App can access and use the Auth Token. The permission alone is not enough get access to a users account. –  Flow Jan 25 '13 at 15:50
1  
Not quite -- add the word "almost" before it. As the privilege's name suggests: it can use the account information, but not change it. As to my knowledge, it can "authenticate in the name of the user", but without getting to know the credentials themselves. So yes: It could read your mail, maybe even post it on Facebook. But it could not spy on your password. Still, this is a sensitive privilege. –  Izzy Jan 25 '13 at 15:51
    
This answer is incorrect as you are unable to change the password of the account with this kind of access, thereby you do not have access to "everything". –  bigbadonk420 May 28 '13 at 8:25
add comment

The app will not access any services account. Some apps need this permission because they need to open a new account from their app.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.