I was using Universal Copy for a while to be able to copy text from fields that are not normally able to be selected, but due to it being able to see all contents on the screen when running, I would disable the it in accessibility settings until needed, which was a pain. I found Copycat, which does the same thing but with only one permission (run at startup) declared, and it states the following:

This app does not use any internet connection at all, So it never syncs any of your saved data anywhere. You can confirm it yourself by checking the app permissions. Your data is safe in your device.

On the surface, this seems great, since it appears there's no concern about giving it the access involved with the accessibility service. However, I know that Android permissions aren't so well-defined, unfortunately, and that if an app has any permission in a category, it has all permissions in that category. Since the "run at startup" permission is in the "Other" category, which is also where the internet permissions are located, it would seem that it would have that access, even though it doesn't specifically request it.

So my question is, is that true, or does an app have to declare a permission in its manifest in order to be able to use it, and does that declaration always mean that permission will show when viewing an app's permissions in the Play Store? IOW, is Copycat truly safe, or could it potentially still be sending information, and the developer is either misguided, which wouldn't exactly be promising, or outright lying, which would clearly be bad? I emailed them a few weeks ago but have not received a response.

P.S. I wasn't sure if this should go on Stack Overflow, since it relates to programming, or not, since it's not related to any specific code.

  • 1
    Android throws an exception error when a feature is requested by an app for which it has no requisite permission declared in its manifest. That said, an update can easily add the Internet permission and since that permission falls in the other category the user is never notified of it, even when sideloading the update. – Firelord Oct 23 '19 at 1:52
  • If I'm understanding you correctly, you're saying since it doesn't declare internet permissions in the manifest (based on the fact they don't show under the permission details on the Play Store page), it can't use them even tho they're in the same category of the one it does declare/request, but it can add it at any time without me being warned b/c it's in the same category? If that's the case, I always check the permissions to see if any new ones have been added before updating apps, so that wouldn't be an issue. – vertigo Oct 24 '19 at 0:38
  • 1
    Android permissions are classified as normal, dangerous, signature, signatureorsystem. There is another concept called permission groups and any permission from any classification can be into a group. What you are referring to as a category is called a permission group technically. If you grant one permission of a group, the system would automatically grant the rest of the permissions from that group, if the app requests them, without seeking user approval. Again, this is limited to a group, so just because an app can access a normal permission doesn't mean it can access all normal.... – Firelord Oct 24 '19 at 6:37
  • 1
    ...permissions unless they are all part of a single permission group. An app must declare all the permissions it wants to access in its manifest, regardless they are into or outside a permission group. – Firelord Oct 24 '19 at 6:37
  • 1
    To supplement @Firelord's comments, it's possible to grant only desired permissions from a permission group using command line tool pm. Also if you have a rooted device, you can trick Android to grant permissions not declared in Manifest (at least up till Android 9): android.stackexchange.com/a/217522/218526 – Irfan Latif Oct 28 '19 at 19:47

A basic Android application has no permissions associated with it by default, meaning it cannot do anything that would adversely impact the user experience or any data on the device. To make use of protected features of the device, you must include in your AndroidManifest.xml one or more tags declaring the permissions that your application needs. At application install time, permissions requested by the application are granted to it by the package installer, based on checks against the signatures of the applications declaring those permissions and/or interaction with the user. No checks with the user are done while an application is running; the app is either granted a particular permission when installed, and can use that feature as desired, or the permission is not granted and any attempt to use the feature fails without prompting the user.

Read more here https://developer.android.com/guide/topics/permissions/overview

  • So to clarify, it only gets the permissions it specifically requests in the manifest, which all of those would show under the permissions info on the Play Store page, and can NOT do things that require other permissions, even if those are in the same category of the one(s) it requests? The link you provided seems to indicate that, I just want to be sure. It's unfortunate Google isn't more clear and upfront about all this. – vertigo Oct 24 '19 at 0:44
  • Absolutely. An Application only uses permissions provided in the manifest and not any other. – Norman Nuthu Oct 25 '19 at 3:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.