I just stumbled upon some permissions which sound clear at first sight (noticed them already quite a while ago, just decided to dig deeper right now). Thinking about possible implications, I'd really like to know what features/data they give access to, as this might get quite personal/sensitive:
com.google.android.gm.permission.READ_GMAIL: often the reason given is "to access attachments" (such as PDF files to be opened with a PDF reader). But is that all? Or could an app equipped with this permission read the entire mail?
com.google.android.gm.permission.WRITE_GMAIL: could an app with this permission write and send mails on my behalf? Or even delete existing mails (including the "written-and-sent one", to hide its activities)?
com.google.android.gm.permission.READ_CONTENT_PROVIDER: one app describes its use as "read Gmail labels and get unread count". Another one writes "Used to update the unread email count on your lockscreen. Email content is not sent to our servers." Which suggests this permission can be used to access the entire mail content. And other contents?
In some source code I found the comment Permission required to access
android.content.ContentProvider, which suggests a lot of content getting accessible this way if it means THE content provider, including contacts and calendars. Not being an Android dev, I cannot really tell without being told first.
google.android.gtalkservice.permission.GTALK_SERVICE: Yes, please?
I've "googled" them all (the above is already the result of my research). And of course I started with my favorite sources when it comes to permissions:
- the permission reference at Android Developers
- explained permissions at AndroidForums.COM
- some framework source code at Github
- more framework source code at Android Source
- our very own reference at What do the permissions that applications require mean?
But the above is all I could come up with. Can somebody shed some more light on those? From a user's perspective, what can be accessed with those permissions, and what are the privacy implications? A "good cop/bad cop" play would be appreciated, naturally :)