1

I would like to use an application which is able to blacken my screen (AMOLED) so it consumes nearly no power (of course, while running an app, that cannot be run in the background). The application has other features, too, like proximity sensor driven blackening.

To make the app able to provide all the features, one has to enable it as an accessibility service (e.g. such services are able to lock usage of "Recents" button and so on). Accessibility services can monitor the users interactions and observe what (s)he types. This is a security risk (think of a keylogger).

Looking at the manifest file, the following permissions are required: RECEIVE_BOOT_COMPLETED, VIBRATE, SYSTEM_ALERT_WINDOW, BIND_ACCESSIBILITY_SERVICE, USE_FINGERPRINT, BILLING. My understanding is that given there is no network accessibility, this app (or at least this version) is unable to send user data to anywhere, so it cannot steal anything. Is this right?

Any other related comments are welcome.

Improve this question
5
  • AFAIK it cannot do so stealthily but still could utilize intents provided by other apps that do ahve network permissions, such as e.g. the browser. While theoretically this would be possible, in practice, I've never heard an app doing that. Also, if there's another app by the same developer present, data could be shared to that.
    – Izzy ♦
    Mar 17, 2018 at 10:50
  • But if it tries to utilize intents, then I will notice "something", not? Can I somehow block intents coming from that app? The very same developer has no other apps and my mobile only has a very limited set of apps made by well-known, big developers like Google, Samsung, Facebook. How exactly could this data sharing take place?
    – user1724641
    Mar 17, 2018 at 14:15
  • As I wrote, I cannot remember having heard of such a case, but it's technically possible. And if it e.g. would utilize the browser, that should be recorded in the browser's history. If you'd happen to watch your screen at that very moment, you should notice it. I guess as that could be detected that way, it's hardly ever tried. And as acejavelin pointed out in his answer, the BIND_ACCESSIBILITY_SERVICE could pose additional risks.
    – Izzy ♦
    Mar 17, 2018 at 17:50
  • Yes, but my understanding is that BIND_ACCESSIBILITY_SERVICE without network access (apart from intents and other possibilities we discussed before) cannot really send any data to the outside work and thus cannot really steal anything.
    – user1724641
    Mar 17, 2018 at 20:14
  • That's correct. I should have written "additional risks other than that" ;) It might e.g. be used to "remote-control" other apps and push their buttons.
    – Izzy ♦
    Mar 17, 2018 at 20:54

1 Answer 1

Reset to default
1

Yes, it could potentially steal your data...

BIND_ACCESSIBILITY_SERVICE can be a dangerous permission as it can allow to the app to view data in any active window, and any data you enter, among other things. More information can be found here.

In the information page for the app you linked, it clearly states how this permission is used and why it's necessary for this kind of app (kudo's to the dev, many apps do not explain why they request dangerous permissions, sometimes purposely). The best thing to do is look at reviews for potential "issues" which does not seem to be the case with this application.

Be aware that although many apps have the permission to "steal" your information, legitimate apps generally do not without clearly stating so in their terms and conditions.

The rest of the permissions are mostly benign...

  • RECEIVE_BOOT_COMPLETED - Self-explanatory
  • VIBRATE - Self-explanatory
  • SYSTEM_ALERT_WINDOW - Allows apps to create windows on top of other apps
  • USE_FINGERPRINT - Allows the app to use the fingerprint scanner hardware (but not the fingerprint data, so pretty safe)

  • BILLING - Allows for in-app purchases

    Source

I don't believe network access has to be implicitly defined any more, but I could be wrong... It would have to be implied with the "BILLING" permission, although I have no reference for that.

Improve this answer
4
  • It seems that internet permission is implicitly there (in the manifest) for years. Do you think it would be enough to block app's network access using a 3rd party app? (kind of firewall)
    – user1724641
    Mar 17, 2018 at 15:48
  • @user1724641 If I think an app is doing that, I get rid of the app, not try to stop it. Remember, although some permissions can be used maliciously, legitimate apps use them appropriately.
    – acejavelin
    Mar 17, 2018 at 16:40
  • I do not think this app would do that based on the reviews (score and textual) and developer "work statement". However, one can never be suspicious enough when it comes to personal/financial data. Precautions must be taken - still better than being totally lost when ones banking data gets into the hand of hackers. On the other side, I also need 'switch-off-screen' functionality.
    – user1724641
    Mar 17, 2018 at 17:47
  • 1
    @acejavelin the BILLING permission does NOT imply network permissions (and yes, the latter are still required explicitly though the Playstore app doesn't list them for being "normal", there's nothing like an "implicit INTERNET permission). See it's complete name and you'll find out it's provided by the Playstore app (…vending.BILLING), which has network access. // Besides, more details on permissions can be found in my permission list, often with some additional context ;)
    – Izzy ♦
    Mar 17, 2018 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .