1

I need to use of Google Play Store app for my project. This app is prepared by unknown to me Chinese GPS devices' manufacturer and I want to use it to communicate with device.

App is published on Google Play Store but uses old type of privileges. With installation I would agree to share "Device & app history", "Contacts", "Location", "Phone", "Photos/Media/Files", "Camera", "Microphone", "Device ID & call information" and more.

I don't feel comfortable to share all that data with unknown to me manufacturer and with untrusted app (1 star in shop), but I need to use this app (because it connects to my physical device).

Is there secure way to install that app? Can I be sure that for example app won't copy all my contacts to some shady server? (I can't block network for app, because that would also block communication).

How can I mitigate some risks or limit app capabilities? Should I be aware of some other risks (like app accessing Android Pay)?

I have OnePlus 3 with Android Oreo (stock but in open beta).

Improve this question
5
  • What Android version you are running? Is your device rooted? Approaches are different if rooted or not. Do you depend on "smooth updates" for that app? If those are not an issue, the easiest way would be getting hold of the APK (e.g. using Raccoon) and re-pack it without some of the "nasty stuff" (block some of the permissions; start aggressively and block fewer if the app crashes) – see e.g. APK Rebuilder on my Android site.
    – Izzy ♦
    Jan 7, 2018 at 11:23
  • @Izzy I have Android 8.0.0, device is not rooted. I don't care for updates of app. I was hoping for something less aggresive - like limiting app privileges after installation (before running), adding another user profile, adding some limits to app from OS. Thank you for suggestion - I'll probably try that if there isn't simper way to do this.
    – franiis
    Jan 7, 2018 at 12:00
  • Limiting app privileges (or OS limits to the app) on a non rooted Android is limited itself (Google decides what you can limit/withdraw). A different user profile might work (to some degree; e.g. to device IDs it doesn't change a thing), and has its inconveniences in use (you'd always have to switch back and forth). Of course someone might come up with a related solution; shall I write up an answer for my above suggestion meanwhile, so you then can compare in detail?
    – Izzy ♦
    Jan 7, 2018 at 13:36
  • I think your idea is worth an answer. I'll definitely upvote it. However I'll wait with accepting - maybe someone has simpler/faster solution. Thank you one more time.
    – franiis
    Jan 7, 2018 at 23:01
  • Fair enough! Expanded my comments to an answer, giving additional details. Good luck!
    – Izzy ♦
    Jan 8, 2018 at 0:10

1 Answer 1

Reset to default
3

Available approaches differ depending on multiple criteria:

  • Are you using a custom ROM such as LineageOS? It might ship with tools for that. LineageOS e.g. includes Privacy Guard, which let's you restrict apps pretty well.
  • Is your device rooted? Then you could use tools like LBE to achieve the same – which unfortunately is proprietary, so you cannot really say what goes on behind the scenes.
  • Is your device rooted and has the Xposed Framework installed? Depending on your Android version, this might hold some power here. For example XPrivacy – which unfortunately is no longer maintained and not compatible with Android 7+

What's left if your answer is "No" to all above? What ships with "stock Android" doesn't really let you control much. For example, all permissions marked as "normal" can't be regulated – which e.g. includes network access. So to really limit an app here, you'd need to modify the .apk file before installing it. So called APK Rebuilder¹ can do that. Basically, they let you mark which permissions you do not want the app to have, and remove them from the Manifest declaration. That way the app doesn't get them granted. It might then crash when trying to access related functionality – or even might not work at all if you removed too much. So general advice is first remove as much as you think useful – and if things go wrong, make a second, less restrictive build. Continue until it works for you – or drop the app and find an alternative.

Another approach is using a "manager" that sandboxes things. One such is Parallel Space (see this answer for details²). But that approach always has another draw-back: such a manager app requires almost all permissions available, as it needs to manage them for the apps you want to restrict. Which requires a lot of trust – and such manager app better be open source (AFAIR the one I saw was not) so it can be checked by as many eyes as possible.

¹ disclosure: link goes to my Android site
² and thanks to Morrison Chang for helping my brain with the name!

Improve this answer
9
  • LBE? Does that antique run on Nougat? I doubt it does.
    – iBug
    Jan 8, 2018 at 0:49
  • @iBug Depends on which version. The international one definitely not (that stopped with JellyBean already). Not sure for the Chinese version. Just recently stumbled upon a request for Oreo ("after updating … will there be …") which made me guess the reporter was using it on the device before the update, which makes Nougat the likely candidate. Hm, last release 12/2015 makes Nougat unlikely indeed for the same reason as XPrivacy (Nougat API changes). But that's why I wrote "tools like LBE", and why I didn't link it – you'll notice I didn't link XPrivacy either :)
    – Izzy ♦
    Jan 8, 2018 at 7:32
  • @Izzy Just for reference, I've linked to the 'sandbox' type app in this answer here: android.stackexchange.com/a/169048/3573 along with a more technical link, but otherwise your analysis on those is correct.
    – Morrison Chang
    Jan 8, 2018 at 7:37
  • Thanks @MorrisonChang – that is the one! I just remembered "Parallel something", which was not enough for a search :)
    – Izzy ♦
    Jan 8, 2018 at 7:39
  • @Izzy Just went and checked. The current latest version for LBE Security is 6.1.2559 (available in China) while the GP version remains at 6.1.2215. Currently testing the new one out.
    – iBug
    Jan 21, 2018 at 12:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .