1. Find an app in the Google Play store
  2. Click on Install
  3. App is installed without any permissions granted, except for the default settings (SDK >= 23)
  4. Run the app without giving any extra runtime permissions

Now, what can the app know about me and my phone?

Severe exploits aside, can an invasive app use tricks to bypass limitations? Like web trackers adapted to use canvas fingerprinting and localstorage.

In Android 6.0 Marshmallow, applications will not be granted any permission at installation time. Instead, application has to ask user for a permission one-by-one at runtime.

  • Well, first that quote is a lie (or have you ever granted the INTERNET permission to any app?) Permissions with protectionLevel "normal" (so what Google feels to be normal) are usually granted implicitly. AFAIR that includes e.g. READ_PHONE_STATE as well; so see my answer here for some additional details. – Izzy Apr 29 '18 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.