1

Generally when you install an application, a list of permission is shown what thing that app can access in your phone. But do they show all the permissions? The app developer don't want you to know some things their app can access like an app can read your contents in SD card but what if it can also read your device ID and MAC Address, will this be written in the list of permissions specially when the developers intentionally want to hide this? Does google allow such apps on play store which hide some app permissions?

Improve this question
2
  • Few OEM company have given that feature in few devices.
    – Harshal Benake
    Aug 17, 2016 at 22:53
  • Do you meam the feature to hide permission?
    – defalt
    Aug 18, 2016 at 3:05

1 Answer 1

Reset to default
1

I've recently picked up Android development myself so I can tell you what I know.

Generally when an app needs access to features it has to declare it in AndroidManifest.xml, or else the system throws exception when the app tries to access the feature. Also, even if the app declares permissions in detail (e.g. it wants to send/receive SMS), Android and Google Play will show the permission groups those permissions belong to (e.g. "phone calls and messaging", or something like that). In that sense when you look at the permission list displayed in Google Play or when installing you gain yourself a knowledge of the maximum this app is capable of doing.

There can be some exceptions, for example a feature not yet natively implemented in Android but by certain manufacturers, but as Android version grows later, these permissions should automatically get added to the apps requirement, even if the app does not explicitly state it. You still get the maximum knowledge.

If any veteran developer spot mistakes in what I said, please do point out, as I'm only a beginner in this field.

Improve this answer
10
  • Can a developer secretly add a permission in its updates without letting that permission to be displayed to user?
    – defalt
    Aug 17, 2016 at 15:58
  • 1
    Requesting internet access no longer requires the user to acknowledge the added permission (if the developer added it in an update). Otherwise adding a permission requires confirmation by the user. However, it is possible to programmatically request extra permissions. This will cause a popup that the user has to confirm in order to grant the permission. However, there are proof of concept "games"/exploits that use clickjacking to get the user to click Android buttons that are cleverly hidden below an overlay created by the malicious app.
    – gertmenkel
    Aug 17, 2016 at 17:59
  • 1
    @gertmenkel Android protects the user against clickjacking/tapjacking (unless some Xposed module is installed). I don't know how secure it is but it generally always works.
    – GiantTree
    Aug 17, 2016 at 19:36
  • @GiantTree more recent versions of android are better protected better against this. However, the problem with Android security is that there are very few devices that still get updates after two years, or even run the latest android version at launch date. For example, according to Google almost 85% of all android devices run Android 5 or lower. Versions up until android 5 are vulnerable to clickjacking by abusing the accessibility framework. Newer versions are still vulnerable if a user (accidentally) gives the app accessibility permissions, which is harder to do now. It's still very viable.
    – gertmenkel
    Aug 17, 2016 at 19:44
  • 2
    @gertmenkel good point, I never use an "old" version of Android because I usually install custom ROMs but your point is very important. I hope one day Google will force manufacturers to push security updates for 2 years or so.
    – GiantTree
    Aug 17, 2016 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .