How to avoid leaking private data to apps without rooting my phone?

Question

The majority of apps on the Play Store require access to things like location, contacts, call log, identity, SMS, etc., even when the app functionality clearly doesn't need this information to work.

I read somewhere that for rooted devices there's an app that can provide fake data to other apps, thus protecting the users privacy.

But I don't want to root because of security issues (I haven't really researched it much, but I don't think there's much control over what goes into the modified system images).

Is there a solution to this? At the moment I just don't install apps that require too much, which leaves me with very feel options in some cases.

Ideally there would be some way to block the access to certain data, even when I install apps that want that access.

Thanks.

Answer 1

Simple answer is no.

Also, I'd like to point out that there's many, many reasons apps will ask for these sorts of permissions, and I can promise you, they're not all stealing your private information. For instance, the SMS permission is commonly used to detect conformation codes that an app may send you.

If you are installing calculator apps that require your call log, contacts and SMS, then just download another app.

People these days are getting far too scared over nothing.

Answer 2

A rooted stock ROM is a security risk, and apparently the reasons to root have disappeared over the past few years. You can have the behavior you describe, however, if you are willing to install a custom ROM, assuming your device is supported. Specifically, CyanogenMod 12 has Privacy Guard, which gives you fine-grained control over what permissions each app has.

Overview including mention of Privacy Guard
https://wiki.cyanogenmod.org/w/Why_Mod%3F

Supported devices
https://wiki.cyanogenmod.org/w/Devices#vendor=;

You may first need to root your current ROM to unlock the bootloader, in order to install a customer recovery and then CyanogenMod, but once installed, Privacy Guard prevents the need for root access, so it is not enabled by default. You can easily enable it under Developer Options in those cases when you do need it, but run without it under normal use.

I found a couple of articles that explain the options well, although they are more than a year old: http://www.xda-developers.com/protecting-your-privacy-app-ops-privacy-guard-and-xprivacy/
http://www.cnet.com/news/why-android-wont-be-getting-app-ops-anytime-soon/

Answer 3

In fact, there is an application called SRT AppGuard that runs without root privileges and can monitor and even revoke permissions from third-party applications.

The reason this works without root is the following: When you choose to monitor an application, this app is first found on the device, then its code is instrumented in a way that everywhere in the code where a call to a permission protected funtion is made the AppGuard system first checks if you have allowed this, and then the instrumented app is installed again. So they are effectively injecting additional permission checks that you control into the application. You could for example allow internet access, but block SMS and location. Of course, such rewriting approaches are not 100% stable, so for a small number of apps this might not work. But for all other cases, this provides you the possibility to monitor and block access to specific critical resources. There is a free version, so you can try it out.