Android 6+ and account permissions: where have they gone to?

Question

I was just browsing the Android Developers Permissions list, and noticed most of the account permissions are gone – in fact, all but GET_ACCOUNTS as it seems. What does that mean, what implications does it have to the end-user – and what else got messed up (apart from the fact there's practically no INTERNET permission anymore)?

As usual, I tried my best Google-Fu but found no answers. Instead, some unanswered questions asking the same. I cannot put it into better words than these:

Marshmallow dropped several Account permissions, including MANAGE_ACCOUNTS and USE_CREDENTIALS, but kept GET_ACCOUNTS. I haven't seen much documentation of what this means for the user in practice, though. I assume that the app that creates an account can automatically use/manage it. However, if a 3rd party app wants to log in with a Google/Facebook/etc account that it did not create:

• Does it still have to request my interaction/approval the first time each account is accessed/used, or can it just use my accounts automatically now?
• If I deny the GET_ACCOUNTS permission, can the app still prompt me to log in with an account from my Nexus? Or do I have to grant the app permission to view all of my accounts in order to let it use one of them?

Additionally: if access to accounts is still protected (which I hope it is!) – which permission is protecting it now?

---

Related questions (whose answers might need to be updated now):

• What does permission “MANAGE_ACCOUNTS” mean?
• What can an app do with the “USE ACCOUNTS ON THE DEVICE” permission?
• In Android 6, how to deny an app permission to access the network?
• What do Android application permissions mean?

---

Summing up information collected in the (cleaned-up) comments

The following details came up in the comments. They are not answering my question, but give valuable hints – which is why I'm including them with my question (credits given to their authors):

• "there's practically no INTERNET permission": It's still there, but automatically granted to each app. No way to revoke it with on-board tools/settings. Which is why I linked to In Android 6, how to deny an app permission to access the network? above. Why that's important? See below.
• Dan Brown points out that access to accounts is now bound to some _CONTACTS permission. Indeed, using an app to "login with Google" prompts: "Allow X to access your contacts?"
  
  It's not clear whether you grant read access only (bad enough) or even write access. So now even a cloud storage app (like Dropbox, Mega, etc) gets access to your contacts – which is why always granting INTERNET becomes a privacy nightmare.
  As it's now obvious this part of the account permissions went to contacts (kudos to Dan for the pointer!), I'd really like to read some details on that: how was it changed, why was it changed, what are the implications, how to deal with it.
  Update: As the latest version of the SE app no longer requires to access contacts, Dan created a dedicated question concerning this app on the main Meta, which might be worth checking: How does the new sign-in system work for the Android app? In short, they are using a new version of the "Google Sign In SDK", which no longer requires contacts access. As that only affects Google Sign-In, it doesn't answer my question, though.
• Dan also pointed out that apps use their own account managers. That was already the case before MM – and the reason why there was the MANAGE_ACCOUNTS permission (see above): they registered their service with Android, so other apps could use it.
• As I already mentioned with my question, GET_ACCOUNTS is the only surviving account permission. It was already required before MM, and probably still serves the same purpose: In order to use an account, our app first needs to know that it's there – so it has to obtain a list of available accounts to start with. If something has changed in this regard, please include it with your answers.

Answer 1

The "dangerous" permissions are listed in Table 1 on this permissions page. There are also "normal" permissions, listed here. Normal permissions are automatically granted to the app.

The dangerous permissions are partitioned into groups. Before Android 6, the Android Store would present the list of groups (though it included "normal" permission, too) and you could either choose to download and accept all the permissions or not download. With Android 6, you accept the permission when you run the app, not when you download it. Rather than accept individual permissions you accept or deny an entire group.

When you run the app and grant a permission, the permission stays granted indefinitely. If you want to revoke it, you can. Go to Android Settings > Apps > your app > Permissions. Then click the green slider-button for the permission you want to change.

As for the behavior in the app, the big change is from the developer's point of view. Before Android 6, the app did not need to check whether a permission was granted (all were automatically granted when you download the app). With Android 6, if the app has been granted a permission, it can do the associated action. If not, it will either crash or, if the developer wrote additional code, it may do something more elegant.

You do have concerns about account access. I'm not sure what to say except that with Android 6, the app cannot get account information without you accepting access to contacts. See the table.

This is a general answer and you many need to post more specific questions for additional details. Hope this helps.