2

I was using Universal Copy for a while to be able to copy text from fields that are not normally able to be selected, but due to it being able to see all contents on the screen when running, I would disable the it in accessibility settings until needed, which was a pain. I found Copycat, which does the same thing but with only one permission (run at startup) declared, and it states the following:

This app does not use any internet connection at all, So it never syncs any of your saved data anywhere. You can confirm it yourself by checking the app permissions. Your data is safe in your device.

On the surface, this seems great, since it appears there's no concern about giving it the access involved with the accessibility service. However, I know that Android permissions aren't so well-defined, unfortunately, and that if an app has any permission in a category, it has all permissions in that category. Since the "run at startup" permission is in the "Other" category, which is also where the internet permissions are located, it would seem that it would have that access, even though it doesn't specifically request it.

So my question is, is that true, or does an app have to declare a permission in its manifest in order to be able to use it, and does that declaration always mean that permission will show when viewing an app's permissions in the Play Store? IOW, is Copycat truly safe, or could it potentially still be sending information, and the developer is either misguided, which wouldn't exactly be promising, or outright lying, which would clearly be bad? I emailed them a few weeks ago but have not received a response.

P.S. I wasn't sure if this should go on Stack Overflow, since it relates to programming, or not, since it's not related to any specific code.

Improve this question
7
  • 1
    Android throws an exception error when a feature is requested by an app for which it has no requisite permission declared in its manifest. That said, an update can easily add the Internet permission and since that permission falls in the other category the user is never notified of it, even when sideloading the update.
    – Firelord ♦
    Oct 23, 2019 at 1:52
  • If I'm understanding you correctly, you're saying since it doesn't declare internet permissions in the manifest (based on the fact they don't show under the permission details on the Play Store page), it can't use them even tho they're in the same category of the one it does declare/request, but it can add it at any time without me being warned b/c it's in the same category? If that's the case, I always check the permissions to see if any new ones have been added before updating apps, so that wouldn't be an issue.
    – vertigo
    Oct 24, 2019 at 0:38
  • 1
    Android permissions are classified as normal, dangerous, signature, signatureorsystem. There is another concept called permission groups and any permission from any classification can be into a group. What you are referring to as a category is called a permission group technically. If you grant one permission of a group, the system would automatically grant the rest of the permissions from that group, if the app requests them, without seeking user approval. Again, this is limited to a group, so just because an app can access a normal permission doesn't mean it can access all normal....
    – Firelord ♦
    Oct 24, 2019 at 6:37
  • 1
    ...permissions unless they are all part of a single permission group. An app must declare all the permissions it wants to access in its manifest, regardless they are into or outside a permission group.
    – Firelord ♦
    Oct 24, 2019 at 6:37
  • 1
    To supplement @Firelord's comments, it's possible to grant only desired permissions from a permission group using command line tool pm. Also if you have a rooted device, you can trick Android to grant permissions not declared in Manifest (at least up till Android 9): android.stackexchange.com/a/217522/218526
    – Irfan Latif
    Oct 28, 2019 at 19:47

1 Answer 1

Reset to default
1

A basic Android application has no permissions associated with it by default, meaning it cannot do anything that would adversely impact the user experience or any data on the device. To make use of protected features of the device, you must include in your AndroidManifest.xml one or more tags declaring the permissions that your application needs. At application install time, permissions requested by the application are granted to it by the package installer, based on checks against the signatures of the applications declaring those permissions and/or interaction with the user. No checks with the user are done while an application is running; the app is either granted a particular permission when installed, and can use that feature as desired, or the permission is not granted and any attempt to use the feature fails without prompting the user.

Read more here https://developer.android.com/guide/topics/permissions/overview

Improve this answer
2
  • So to clarify, it only gets the permissions it specifically requests in the manifest, which all of those would show under the permissions info on the Play Store page, and can NOT do things that require other permissions, even if those are in the same category of the one(s) it requests? The link you provided seems to indicate that, I just want to be sure. It's unfortunate Google isn't more clear and upfront about all this.
    – vertigo
    Oct 24, 2019 at 0:44
  • Absolutely. An Application only uses permissions provided in the manifest and not any other.
    – Norman Nuthu
    Oct 25, 2019 at 3:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .