Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Once in a while I read that MANAGE_ACCOUNTS Permission is needed (actually it is called "KONTEN HINZUFÜGEN ODER ENTFERNEN" as I have a German phone. I guess the text below is something like "Add or remove accounts, create accounts and set passwords, use accounts on the device" in English).

I'm asking this question because I wanted to install the GitHub-App.

I think I found a very similar question which I would like to include here:

  1. What does it mean they can create accounts?
  2. Why would Amazon (Kindle app) / GitHub even need this?
  3. Are there any risks?
share|improve this question
    
I've also found an explanation by the Guardian, why they request some permissions: guardian.co.uk/mobile/insideguardian/android-app-permissions But I would like to get a more detailed answer, especially when it comes to potential risks. –  moose Apr 23 '13 at 18:49
add comment

2 Answers

up vote 14 down vote accepted

In short, GitHub is using the internal Account System manager to store your GitHub credentials. This works the exact same was as adding a Google account or an Exchange account. Essentially, you are logging in with your credentials and they are stored in the Account Manager, which prevents you from having to re-enter these credentials again in the future.

This is most useful when the credentials are used across multiple applications as you only have to login once. For example, Google Chrome will access your account via the Account Manager instead of forcing you to login again (the yellow dialog that pops up at the bottom asking if you want to sign in with your locally held Account on your phone when visiting gmail or another Google website on your phone's Google Chrome browser).

What does it mean they can create accounts?

They can created local accounts on your phone for their application (and only their application). Here's an example of a list on my phone:

Screenshot
Screenshot (Click image for larger variant)

Why would Amazon (Kindle app) / GitHub even need this?

It simplifies credentials in Android. It's the recommended method to do this.

Are there any risks?

There shouldn't be. If an app uses the AccountManager and say, wants to use your Google account, then it will have to explicitly ask you for permission as it needs an auth token to use that account. See more info on the SDK documentation.

share|improve this answer
3  
When there is no risk, why isn't every APP allowed to use account manager by default? –  moose Apr 26 '13 at 8:18
1  
@Moose that's a good question. As an Android dev, I've had zero experience using the AccountManager, but I believe the correct answer is that it technically lets you attempt to access any of the accounts listed on your phone (although it should still ask for permission to allow access to that account on first use, as far as I know) –  Bryan Denny Apr 26 '13 at 13:45
1  
I just browsed the API docs. Basically an app would enumerate existing accounts and it may filter them by type, e.g. "all google accounts". If an account is missing it would create one. These actions require permissions GET_ACCOUNTS and MANAGE_ACCOUNTS. However (!), nothing seems to restrict apps from using any account they like, e.g. to impersonate you on a google account instead of your github account. Apparently apps can even get the account password, if it was stored in the account manager. If that is true, there is a big risk for those permissions. You have to fully trust the app author. –  deepc Jun 30 '13 at 1:45
    
Wait a sec, @BryanDenny: You say there should be no risks. But doesn't the permission to "add or remove accounts" imply such an app could e.g. delete any established account from the device? What does prevent it from setting a different password on some other account (causing e.g. a "lock" for "too many attempts" lateron)? While I see the requirements, I miss the security layer being pointed out (e.g. the user must confirm such changes somehow, or be able to restrict it to a given account/type). Is there such a thing? I never noticed any related "popup" or the like. –  Izzy Aug 15 '13 at 17:17
add comment

To manage accounts, Android uses several permissions; some of them are easily misunderstood. A very good explanation on using accounts can e.g. be found in Dan's answer on the question What can an app do with the “USE ACCOUNTS ON THE DEVICE” permission?. Let me try to sum up the permissions involved and what they mean:

  • ACCOUNT_MANAGER: This permission is reserved for system apps. An account-manager is the service working behind the scenes and taking care everything works as expected.
  • AUTHENTICATE_ACCOUNTS: An app using this permission usually provides an interface to deal with a certain account type (which is not known by the pre-installed Android system), such as Dropbox. As shipped, Android does not know how to login to Dropbox and how to deal with a Dropbox account – so the Dropbox app provides the mechanism. Additionally, an "account authenticator" might restrict the actions an app can perform with the account (so it would e.g. be possible to administrate this via some web interface offered by the service).
  • GET_ACCOUNTS: Obtain a list of available accounts. This way an app which wants e.g. to use Dropbox for storage can check if a fitting account is available. It must verify this before using it.
  • MANAGE_ACCOUNTS: The API documentation is not that clear about this permission. But according to Bryans answer, an app can only delete/modify an account it created itself. Of course it can create any new account, and manage that.
  • USE_CREDENTIALS: This app may use the "credentials" to log into an account. In most cases, "credentials" just means the corresponding authenticator creates a fitting token and hands that over (though, how to deal with that is left to the authenticator). When using an account for the first time, the Account Manager should make sure the user is asked whether he permits this. Again, Dan's answer explains this part well.

I hope I was able to shed some light. This was something which made me nervous as well, so I took two days to dig into it. If I got something wrong, please point it out in the comments so I can correct it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.