Is it safe to install Launchers for Android which require quite a few permissions?

Question

I have HTC One X with Sense on it. Sense is a bit slow. So I installed Apex Launcher. It was fast but it required quite a few permissions so I uninstalled it. I looked at other Launchers in Google Play like Nova, Go, etc. but all of them had required some or the other permissions which were giving me goosebumps, like

• Service that cost you money: Directly call phone numbers
• Your messages: Access mail information, read your text messages (SMS or MMS)
• Your personal information: Read call log, read your contacts
• Your accounts: Find accounts on this device

So my question is, is it safe to install Launchers for Android which require permissions like they can read your emails, SMS, call number directly? Also Apex launcher cannot create widget on home screen unless the phone is rooted and shows a message - NOTE: Due to limitations of the Android framework, you won't be able to add widgets from the drawer unless Apex Launcher is installed as a system app (root required). Please read the FAQ for more information. Is this the case with all Launchers?

Answer 1

Those permissions (call, SMS) are in most cases used for "quick-access-widgets/shortcuts" the launcher provides. To create a call widget for a contact, the contacts need to be read, which again might need the account data in some cases to retrieve them.

So all those permissions are obviously making sense in context of a launcher. Of course this does not mean they cannot be abused. So I'd either stick with a heavily used / well known app, or have additional protection (PDroid, LBE).

You explicitly mentioned Apex, which I use on some of my devices. On others I use GoLauncher EX. I also use LBE to keep watch. None of these two launchers ever misused these permissions (at least I never got a warning) -- though I must admit I did not check all the logs thoroughly all the time.

Answer 2

I might not be 100% right, but as a launcher I think the permissions are for the following:

• Directly call phone numbers: If the launcher has its own Dialer, you need to give it permissions to be able to do calls, else you would end with a dialer that doesnt dial.
• Access mail information, read your text messages (SMS or MMS): Same as above, launchers many times have direct access to your SMSs, so it can be either displayed or linked to your home screen.
• Read call log, read your contacts: This has to do with the first one, if you let use it the dialer, call logs and contacts should also be used when trying to dial, else you would end having to type the entire number you want to call.
• Find accounts on this device: I suppose this one refers to the Google account if your contacts are stored there.

So if the above permisions are for a Launcher, you shouldn't worry since they're pretty usual.

As for the launcher root issue, I think its a JB issue. I'm using the stock right now, but in Ginger Bread and ICS I was using a non-stock launcher and could add widgets without problems.