0

Generally when you install an application, a list of permission is shown what thing that app can access in your phone. But do they show all the permissions? The app developer don't want you to know some things their app can access like an app can read your contents in SD card but what if it can also read your device ID and MAC Address, will this be written in the list of permissions specially when the developers intentionally want to hide this? Does google allow such apps on play store which hide some app permissions?

  • Few OEM company have given that feature in few devices. – Harshal Benake Aug 17 '16 at 22:53
  • Do you meam the feature to hide permission? – defalt Aug 18 '16 at 3:05
1

I've recently picked up Android development myself so I can tell you what I know.

Generally when an app needs access to features it has to declare it in AndroidManifest.xml, or else the system throws exception when the app tries to access the feature. Also, even if the app declares permissions in detail (e.g. it wants to send/receive SMS), Android and Google Play will show the permission groups those permissions belong to (e.g. "phone calls and messaging", or something like that). In that sense when you look at the permission list displayed in Google Play or when installing you gain yourself a knowledge of the maximum this app is capable of doing.

There can be some exceptions, for example a feature not yet natively implemented in Android but by certain manufacturers, but as Android version grows later, these permissions should automatically get added to the apps requirement, even if the app does not explicitly state it. You still get the maximum knowledge.

If any veteran developer spot mistakes in what I said, please do point out, as I'm only a beginner in this field.

  • Can a developer secretly add a permission in its updates without letting that permission to be displayed to user? – defalt Aug 17 '16 at 15:58
  • 1
    Requesting internet access no longer requires the user to acknowledge the added permission (if the developer added it in an update). Otherwise adding a permission requires confirmation by the user. However, it is possible to programmatically request extra permissions. This will cause a popup that the user has to confirm in order to grant the permission. However, there are proof of concept "games"/exploits that use clickjacking to get the user to click Android buttons that are cleverly hidden below an overlay created by the malicious app. – gertmenkel Aug 17 '16 at 17:59
  • 1
    @gertmenkel Android protects the user against clickjacking/tapjacking (unless some Xposed module is installed). I don't know how secure it is but it generally always works. – GiantTree Aug 17 '16 at 19:36
  • @GiantTree more recent versions of android are better protected better against this. However, the problem with Android security is that there are very few devices that still get updates after two years, or even run the latest android version at launch date. For example, according to Google almost 85% of all android devices run Android 5 or lower. Versions up until android 5 are vulnerable to clickjacking by abusing the accessibility framework. Newer versions are still vulnerable if a user (accidentally) gives the app accessibility permissions, which is harder to do now. It's still very viable. – gertmenkel Aug 17 '16 at 19:44
  • 2
    @gertmenkel good point, I never use an "old" version of Android because I usually install custom ROMs but your point is very important. I hope one day Google will force manufacturers to push security updates for 2 years or so. – GiantTree Aug 17 '16 at 19:46
2

Android will prevent the app from accessing anything, which requires a permission not requested by the app.

That means if a permission is not displayed in the list, the app cannot access the information protected by it.

  • What if a permission is not displayed in the list and app is "secretly" accessing that permission ? How google knows what permission app can access? – defalt Aug 17 '16 at 15:56
  • @user334283 if the app tries to access anything without permission android will prevent access and throw a SecurityException (the app will crash). Google simply displays all requested permissions. – saibotu Aug 17 '16 at 16:13
  • Does this exception handling is also valid for rooted and custom ROMs? – defalt Aug 17 '16 at 17:08
  • @user334283 There should be no difference on custom roms. However if you grant root permissions to an app, it has access to everything. – saibotu Aug 17 '16 at 17:12
  • @saibotu only through the given root context, though. An app with root permissions cannot use APIs, if it did not ask for permission explicitly. Otherwise, it has full access to all your files, memory and storage. – GiantTree Aug 17 '16 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.