Does this permissions request make sense?

Question

I would like to use a vendor's application to enable remote access to a security DVR from an Android phone. The app requires permission for "read phone status and identity". I'm not an Android developer, but that doesn't seem like an appropriate permission, since the application has nothing to do with the phone number or the phone operation. It would work equally well without any phone functionality.

I contacted the developers, and they say: "The application makes that request to get though the firewall on the phone. The program does not store or use that information. If you manual set permissions in the firewall then the program will need the permission."

Does that make sense to anybody? Is there a "firewall" in Android that is somehow related to phone state and identity?

Before I call BS on this response, I wanted to check here with experts just in case there is some obscure relationship.

Answer 1

While the permission might make sense, the explanation does not at all.

To my knowledge, READ_PHONE_STATE has nothing at all to do with a firewall or networking. It is a READ permission (so what could that have to do with passing a firewall?),

• giving access to your IMEI/IMSI and phone number
• lets the app figure out whether a call is in progress
• if a call is in progress, gives access to the phone number of the remote device

I bet the app has the INTERNET permission as well (confirmed as per Google Play link you provided). The app is free of charge. Minimum Android version is 2.0, so READ_PHONE_STATE was not forced on it (it is enforced for Android versions up to 1.6). So I rather assume it carries some ad module which requires this permission: the combination of INTERNET and READ_PHONE_STATE is very common to those (it needs to obtain the ad information, and most likely uses your IMEI to identify you -- in a positive sense, to see what ads have already been shown; but of course it could as well be used otherwise).

If you've already installed that app, you can verify this using e.g. Lookout Ad Network Detector or TrustGo Ad Detector. You could also check with Addons Detector to see if it carries any other module piggie-back (e.g. for analytics, which again would explain READ_PHONE_STATE to identify your device).

Second thought: Why would that app need to get through the phone's firewall (if there were any)? Isn't it supposed to do connections to the outside? If that would require anything else but the INTERNET permission, what should the INTERNET permission stand for?