I have recently installed an Android app from the Play Store. While registering in it, I realized that it was able to read my message of OTP without even asking for my permission to read the message.

I have AOSP Extended 5.8 with the August security patch. It's an Android Oreo 8.1 based custom rom.


Verification by OTP uses a different API which doesn't need read SMS permission. You can read more here Perform SMS Verification on a Server

Hence, the app isn't reading your SMS but using a separate channel to read specially formatted text messages

I learnt of this when an Xposed module to block permissions did not work as I expected (similar case) and the developer explained the reason

  • How it is decided that which app can use api to read which text? There must be something that prevents X app to read text of Y app by using API's.
    – Ankk98
    Sep 15 '18 at 10:28
  • 1
    Also, if you read the linked API it talks about hash and coding which means only the authorized app can read
    – beeshyams
    Sep 15 '18 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.