Can such an app freely read my emails/calendar/message/docs/etc.?
The "USE ACCOUNTS ON THE DEVICE" permission is also known for developers as android.permission.USE_CREDENTIALS.
Example of such apps: WhatsApp, MightyText.
asked Jan 25, 2013 at 15:02
-
1I found an example of android API of what can be done using this permission: goo.gl/gjkJB. From my understanding as a developer, this means an access to EVERYTHING. Once a user has an account's token, he can access any services accounts offers: Facebook's stream, Google's emails - EVERYTHING.– AlikElzin-kilakaCommented Jan 25, 2013 at 15:06
-
TBH, a lot of users do not read the permissions on play store and blindly download, I do not know if they actually do read what the play store tells them prior to download as in listing the permissions, like treating it as a EULA thing and skip it to the Next part... just saying... but you're implying that permission is "OMG, my emails can be snooped on" based on the capitalization of emphasis on the word everything, yes, a bad app can do all sorts with it! Just use common sense :)– t0mm13bCommented Jan 25, 2013 at 15:18
-
That is in relation to anything that has or uses OAuth tokens and credentials such as emails, facebook, calendar, but for the messages as in Text SMS, requires READ_SMS_PERMISSION... just saying...– t0mm13bCommented Jan 25, 2013 at 15:20
-
1@t0mm13b - Giving specific permissions (OAuth) to read messages, for example, is much less intrusive than giving full access to an account.– AlikElzin-kilakaCommented Jan 25, 2013 at 15:32
-
1Related: What do the permissions that applications require mean?– Ryan ConradCommented Jan 25, 2013 at 21:11
Add a comment
|
3 Answers
Android has a centralized system for managing credentials for online services (such as your Google account). One component is called the AccountManager. Some apps can "act as an account authenticator". This means that they understand how to log into a particular online service, and can log in to that service for the AccountManager. Other apps want to use that login information to identify you or perform actions on your behalf, without you having to enter your password every time.
Example: logging into Google
Your phone has a built-in app that "acts as an account authenticator" for your Google account. It knows how to log into Google, and it has the email and password you entered when you set up the phone. There's also a YouTube app, which wants to log in to show your favourite videos, and to let you comment, but without having to enter your email and password again.
This YouTube app talks to the AccountManager and asks if it has any credentials for a Google account. Asking this question requires the "find accounts on the device" permission. The AccountManager has a list of authenticators installed on the phone, which it consults to answer this question. If it does have any credentials, the app will then ask for what's known as an authtoken for the Google account. This request requires the "use accounts on the device" permission.
The AccountManager then asks you if you want the requesting app (YouTube) to be able to use the requested account (Google account). This might be in a dialog that appears over the app, or in a notification. Alternatively, the app can choose to do nothing if you haven't already answered yes to this question: it might want to ask later at a more convenient time. This step ensures that an app with the "use accounts on the device" permission can't immediately use every account without asking.
If you say yes, the AccountManager forwards the request to the authenticator (the built-in Google app). What happens next is up to the authenticator and the particular service you're logging into. You might need to log in if you haven't previously done that, and logging in might require a username and password, a photo, an SMS, or something else entirely. Whatever the authenticator does, it can either fail, or give an authtoken back to the requesting app.
Further checks
The authenticator and the online service can also control what actions the requesting app can perform. For example, when you connect an app to your Google account, Google lists permissions the app needs (such as "upload videos" for YouTube). Thus, the app can only do the actions listed. However, some services might not have anything like that; for such a service, once you've allowed the app to use your credentials, it can take any action in your name.
Once the requesting app has obtained the authtoken, it can continue to use it to perform actions in your name without any further interaction from you. That is, once you've agreed that Dan's Twitter Client can post to your Twitter feed, it might run in the background and post further tweets without you knowing. You should only grant the app access to your credentials if you trust it not to do that.
Summary
An app with the "use accounts on the device" permission can, once installed, ask you to access an online service (such as Google, Facebook, or Twitter) in your name. You can choose to let it access the service or not. If you do let it access the service, what actions it can take on your behalf might be limited by the service (it's up to the service), and the service might let you revoke that permission later (usually through a list of "connected apps" on the service's website).
answered May 28, 2013 at 10:49
I found this example in Android API of what can be done using that permission.
From my understanding as a developer, this means access to almost EVERYTHING provided by the account, except changing the password.
Once a user has an account's token, he can access any services the account offers: post on your Facebook wall, read your Gmail - almost EVERYTHING.
answered Jan 25, 2013 at 15:13
-
I am not 100% sure but I think that there is a "Select Account" screen before the App can access and use the Auth Token. The permission alone is not enough get access to a users account.– FlowCommented Jan 25, 2013 at 15:50
-
2Not quite -- add the word "almost" before it. As the privilege's name suggests: it can use the account information, but not change it. As to my knowledge, it can "authenticate in the name of the user", but without getting to know the credentials themselves. So yes: It could read your mail, maybe even post it on Facebook. But it could not spy on your password. Still, this is a sensitive privilege.– IzzyCommented Jan 25, 2013 at 15:51
-
This answer is incorrect as you are unable to change the password of the account with this kind of access, thereby you do not have access to "everything".– pzkpfwCommented May 28, 2013 at 8:25
-
@pzkpfw: I've updated the answer to include the world "almost" because for many malicious use cases, the attacker wouldn't want to change the password, but rather quietly misuse the account. Commented Jan 8, 2016 at 21:27
The app will not access any services account. Some apps need this permission because they need to open a new account from their app.
