Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I just stumbled upon some permissions which sound clear at first sight (noticed them already quite a while ago, just decided to dig deeper right now). Thinking about possible implications, I'd really like to know what features/data they give access to, as this might get quite personal/sensitive:

  • com.google.android.gm.permission.READ_GMAIL: often the reason given is "to access attachments" (such as PDF files to be opened with a PDF reader). But is that all? Or could an app equipped with this permission read the entire mail?
  • com.google.android.gm.permission.WRITE_GMAIL: could an app with this permission write and send mails on my behalf? Or even delete existing mails (including the "written-and-sent one", to hide its activities)?
  • com.google.android.gm.permission.READ_CONTENT_PROVIDER: one app describes its use as "read Gmail labels and get unread count". Another one writes "Used to update the unread email count on your lockscreen. Email content is not sent to our servers." Which suggests this permission can be used to access the entire mail content. And other contents?
    In some source code I found the comment Permission required to access android.content.ContentProvider, which suggests a lot of content getting accessible this way if it means THE content provider, including contacts and calendars. Not being an Android dev, I cannot really tell without being told first.
  • google.android.gtalkservice.permission.GTALK_SERVICE: Yes, please?

I've "googled" them all (the above is already the result of my research). And of course I started with my favorite sources when it comes to permissions:

But the above is all I could come up with. Can somebody shed some more light on those? From a user's perspective, what can be accessed with those permissions, and what are the privacy implications? A "good cop/bad cop" play would be appreciated, naturally :)

share|improve this question
1  
Have you seen the Google Play Services permissions? "Add additional permissions at any time." I can't answer why they are there, and how this came about but anecdotally Google seem to be adding permissions to all gApps lately. It could be unifying the frameweork services/games/mail/talk/plus and so on. But it is very odd and very alarming. I've been told, off the record, that Chrome has more code around personalisation, logging etc than actual internet browsing. I don't know at all if that is true. Certainly there is a shift in 'all the permissions!' lately. –  RossC Mar 20 at 13:40
    
Could you give a little more information about where you're seeing these permissions? I could do a little digging for you, but I'll need at least the full name of each permission to start (including the android.permission. or whatever at the start). Bear in mind that any app can define new permissions to control how other apps use that app's features. –  Dan Hulme Mar 20 at 13:52
1  
@RossC Yeah, that's correct. But the 4 above are already around for some time – so I'm not asking about the "latest fancies". Being offered by the Google Apps themselves (see my edit), they are not mentioned in the AOSP manifests; and GApps being proprietary code, there's not much to look into for investigation. // I share your opinion about "alarming" (those bells are one thing behind my question). And though your Chrome example looks "exaggerated", I'm totally buying it... –  Izzy Mar 20 at 14:17
    
It's not surprising that Chrome contains more code on the side features than browsing. The majority of the code for rendering pages is in WebKit (now Blink) and V8 and the main browsing window is basically the same as with Chromium project. –  Lie Ryan Mar 20 at 22:12

1 Answer 1

The Android permission system has so flaws... Any app that wants to use any part of a particular permission must accept access to all parts of that permission. For example, I created an app that started off using no permissions. Eventually, I wanted to add the capability to export the database to the SD card. I had to add the permission that allowed me to write to the SD card. That permission gives me full access to the SD card to write, delete, snoop, etc. So, yes, those apps can do all those things you fear with those permissions. No real way around it if you need those apps. But, to be fair, the other option (iOS) is all apps have ALL permissions, without ever informing you of which of those they intend to use, no matter how rough - grained.

share|improve this answer
    
Sorry, but that does not answer my question. I know what permissions are, and why they are needed in general. I was asking for details on the mentioned permissions explicitly, not for a general explanation. –  Izzy Mar 24 at 15:25
    
@LeBeau The SD Card is normally formatted as FAT32 (just like USB sticks are) so that it can be read on any common computer system. FAT32 has no security, so once you have access to the SD card you have access to the whole thing. This isn't Android's fault it's a design limitation of the file system. –  GAThrawn Mar 26 at 13:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.