6

The tag info says that it's "A library used by Google apps and many third-party apps to provide location and social functionality".

Does this mean that if I refuse to provide the location to an app, the said app can still retrieve my location through Google Play Services?

  • 1
    I'm no Android developer, but apps can typically exchange info via intents, thus not needing an expressed permission. Going by this, your doubt may definitely be reality. – Grimoire Nov 6 '17 at 15:37
1

To my understanding, there are 2 way to retrieve the current location from an Android developer's perspective:

  1. The Android framework location API: android.location This is "the old way" and developers are encouraged to adapt the newer API:

  2. The Google Play services location API.

To access the former, an application has to request permissions to use them:

Unless noted, all Location API methods require the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permissions.

To access the latter, developers still have to request the same permissions:

Apps that use location services must request location permissions. Android offers two location permissions: ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION. The permission you choose determines the accuracy of the location returned by the API. If you specify ACCESS_COARSE_LOCATION, the API returns a location with an accuracy approximately equivalent to a city block.

So, no, the service does not offer a way to bypass permission checks. Both ways require the same permissions.

| improve this answer | |
0

No, the service/libraries still require permissions requests just like everything else.

See the Play Services SDK documentation for more info. But some relevant excerpts:

...Once you’ve declared the APIs that you want to use ... ensure that you have the required permission before calling an API.

...

If the call returns false this means the permissions aren’t granted and you should use requestPermissions to request them.

... when you call connect(), Google Play services validates that it has all the necessary permissions needed. ... connect() fails when any permission groups needed by Google Play services itself are missing.

| improve this answer | |
  • Well, you kind of confirm my fears... If I refuse a permission to an app, but Google Play Services has it, your quotes kind of say they act independently and therefore the bypass actually exists. If not, would you clarify how? Thank you anyways for taking the time to look this up in the SDK documentation. – Olivier Grégoire Nov 10 '17 at 9:27
  • As far as I can tell, it is still per app. The request permission call comes from the app, as the library to call out to Play Services is still within the app context. Though I haven't confirmed this with testing yet... I could be interpreting the docs wrong? – Mufasa Nov 10 '17 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.