What does permission "MANAGE_ACCOUNTS" mean?

Question

Once in a while I read that MANAGE_ACCOUNTS Permission is needed (actually it is called "KONTEN HINZUFÜGEN ODER ENTFERNEN" as I have a German phone. I guess the text below is something like "Add or remove accounts, create accounts and set passwords, use accounts on the device" in English).

I'm asking this question because I wanted to install the GitHub-App.

I think I found a very similar question which I would like to include here:

1. What does it mean they can create accounts?
2. Why would Amazon (Kindle app) / GitHub even need this?
3. Are there any risks?

Answer 1

In short, GitHub is using the internal Account System manager to store your GitHub credentials. This works the exact same was as adding a Google account or an Exchange account. Essentially, you are logging in with your credentials and they are stored in the Account Manager, which prevents you from having to re-enter these credentials again in the future.

This is most useful when the credentials are used across multiple applications as you only have to login once. For example, Google Chrome will access your account via the Account Manager instead of forcing you to login again (the yellow dialog that pops up at the bottom asking if you want to sign in with your locally held Account on your phone when visiting gmail or another Google website on your phone's Google Chrome browser).

What does it mean they can create accounts?

They can created local accounts on your phone for their application (and only their application). Here's an example of a list on my phone:

^{Screenshot (Click image for larger variant)}

Why would Amazon (Kindle app) / GitHub even need this?

It simplifies credentials in Android. It's the recommended method to do this.

Are there any risks?

There shouldn't be. If an app uses the AccountManager and say, wants to use your Google account, then it will have to explicitly ask you for permission as it needs an auth token to use that account. See more info on the SDK documentation.

Answer 2

To manage accounts, Android uses several permissions; some of them are easily misunderstood. A very good explanation on using accounts can e.g. be found in Dan's answer on the question What can an app do with the “USE ACCOUNTS ON THE DEVICE” permission?. Let me try to sum up the permissions involved and what they mean:

• ACCOUNT_MANAGER: This permission is reserved for system apps. An account-manager is the service working behind the scenes and taking care everything works as expected.
• AUTHENTICATE_ACCOUNTS: An app using this permission usually provides an interface to deal with a certain account type (which is not known by the pre-installed Android system), such as Dropbox. As shipped, Android does not know how to login to Dropbox and how to deal with a Dropbox account – so the Dropbox app provides the mechanism. Additionally, an "account authenticator" might restrict the actions an app can perform with the account (so it would e.g. be possible to administrate this via some web interface offered by the service).
• GET_ACCOUNTS: Obtain a list of available accounts. This way an app which wants e.g. to use Dropbox for storage can check if a fitting account is available. It must verify this before using it.
• MANAGE_ACCOUNTS: The API documentation is not that clear about this permission. But according to Bryans answer, an app can only delete/modify an account it created itself. Of course it can create any new account, and manage that.
• USE_CREDENTIALS: This app may use the "credentials" to log into an account. In most cases, "credentials" just means the corresponding authenticator creates a fitting token and hands that over (though, how to deal with that is left to the authenticator). When using an account for the first time, the Account Manager should make sure the user is asked whether he permits this. Again, Dan's answer explains this part well.

I hope I was able to shed some light. This was something which made me nervous as well, so I took two days to dig into it. If I got something wrong, please point it out in the comments so I can correct it.