24

Termux:API app has a command termux-sms-list to list SMS messages on the Termux terminal. However, the wiki says that it is not supported anymore because of Google.

Usage of this API is no longer allowed by Google and we had to disable it to prevent delisting of Termux:API application from the Google Play.

But still, banking apps that use OTP authentication using SMS can still auto-read the incoming SMS and enter the password without user interaction.

So what makes them different API-wise?

1

1 Answer 1

25

Google blocks apps from (mis)using Call Log and/or SMS permissions if they are not the core functionalities of the apps, with some exceptions and alternatives.

SMS (termux-sms-list and termux-sms-send) and Call Log (termux-call-log) are not the main purpose of Termux:API app, thus the developer had to remove the permissions to prevent the app from being removed on the Play Store.

From Play Console Help,

If your app does not require access to Call Log or SMS permissions, you must remove these permissions from your app's manifest. Details on policy compliant alternative implementation are also detailed below.

When should you access these permissions

You should only access Call Log or SMS permissions when your app falls within permitted uses and only to enable your app’s critical core functionality.

Core functionality is defined as the main purpose of the app. This may comprise of a set of core features, which must all be prominently documented and promoted in the app's description. Without the core feature(s), the app is "broken" or rendered unusable.

There are some temporary exceptions that the developer can apply for (detail on the same help page), but in the end, it's up to Google's discretion to allow it or not.

On the other hand, Google also provides an alternative exclusive for reading OTP SMS, called SMS Verification APIs which utilizes Google Play Services. This doesn't require an app to request SMS permission, but the device needs to have Play Services working.

Though, the restriction is mainly limited to the Google Play Store's policy. Apps hosted on alternative markets or self-hosted may ignore this and just use the Android permissions as before without worrying about delisting, though users may feel uncomfortable with such privacy-invasive permissions.


In short, API-wise, the difference is:

  1. Termux:API used Android's permission system, which is restricted by Google Play Store's policy now.
  2. Banking (and other) apps utilize Google Play Service's SMS Verification API, exclusively for reading OTP SMS targeted for their own apps only.
2
  • 17
    It's perhaps worth noting that in case of SMS verification the app does not and cannot read any of the SMS messages - Play Services service looks for the OTP string, parses it out and passes only the OTP code to the app. It does not forward any other SMS content to the app.
    – Mavrik
    Nov 25, 2019 at 22:30
  • TL;DR Google read the SMS and parses the OTP. The App only communicates with the Google service that only provides the parsed OTP token. This also means that Google API will fail with strange OTP SMSes, although I'm pretty sure it works 99.9% of the time and if it fails it means your SMS has extra data in a weird format that shouldn't be there in a plain OTP SMS message in the first place.
    – Bakuriu
    Nov 26, 2019 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .