8

I've looked at many (not all) of the dozens of links here.

Is there a list that explains the risks involved with each granted application permission type?

Most of these are not worth the time to read and just regurgitate using the same vague, indeterminate descriptions already used by the phone.

I've googled for specifics, but can find no detailed information on this privacy warning.

Please don't reply with generic blog articles and endless lists of links.

I'm looking for one hard core detailed reference on this warning:

Read phone state and identity

Here's what mine says:

  1. Allows the application to access the phone features of the device...

    What specifically is a "phone feature" and what is not? Is wifi a phone feature, text message stack, etc

  2. An application with this permission can determine the phone number and serial number of this phone...

    Right. This is clear.

  3. Whether a call is active...

    Understood.

  4. The number that the call is connected to...

    Is this giving the company permission to spy on my friends?

  5. and the like...

    Yep, it really says this. Please define "the like".

Obviously #1, #4 and #5 are the things that concern me - the language of this warning says that the game developer gets access to all the identity information of anyone who calls you... And the like.

Therefore, to me, it clearly says you are exposing yourself and your contacts to spammers and worse. And it looks like the app can scoop up your contacts whether you are playing the game or not.

In other words, unless you are willing to give the developer the identities/contact info of anyone who calls you (or you call), subjecting them to spam or worse, you should not d/l the app.

Correct?

Improve this question
1
  • Reading phone state is useful for getting unique device id's from the telephony API. This can be used in provisioning devices, for instance.
    – IgorGanapolsky
    Commented Aug 29, 2016 at 13:08

1 Answer 1

Reset to default
5

With this permission an app can...

  • read your IMEI/IMSI (to identify your device/SIM), #2 in your list
  • read your phone number (from the SIM)
  • which provider is used (again, the SIM)
  • see whether a call is active (#3) and if so, phone number of the remote party (#4)

Your #1 is simply an introductionary phrasing. With Android 1.6 and before, this permission was required to detect whether there was a call being processed (so a game or media player could pause). This is no longr the case since 2.0 (basically even not with 1.6, but due to a bug this permission was still automatically "injected" by the SDK).

In newer versions, it is mostly used to...

  • identify your device for target-ads (so the ad provider could tell whether a certain ad was already shown to you)
  • rightfully by call-blockers and similar apps which need to determine the remote phone number
  • for several statistics and other technical apps (again, rightfully)

And well, in a way it gives someone the possibility to spy. Some malware uses it (in connection with other permissions) to create a profile of you.

I'd say in most cases the dev is not interested in this, but it's rather the ad module requiring this permission. Concerning this, please also see: What information does stock Android send to Google by default, and how do I opt-out? -- which also covers the ad-modules stuff.

Improve this answer
6
  • 2
    Thanks very much. #4 and #5 are the ones that should raise concerns for games like subway surfer or fruit ninja. These are not call blocking apps so why do they need the identities of people calling me. I am not in favor of sending companies the phone numbers of my friends. It's like people are selling out each other for a few scooby snacks.
    – user1501974
    Commented Jul 7, 2013 at 22:34
  • What bothers me most are games targeted at kids to pick up their contacts. I remember cigarette companies marketing to children. People need to understand that they are trading freedom and privacy (theirs and their contacts) for "free". I couldn't find any apps that firewall access to contacts and personal info, either.
    – user1501974
    Commented Jul 7, 2013 at 22:57
  • Have you followed above link? Mentions several such "privacy protectors": LBE, PDroid/OpenPDroid, XPrivacy. CyanogenMod will even ship with its own "PrivacyGuard" soon, Paranoid already does. Handycap with those: your device must be rooted, or you'd even need a custom ROM. Both might void your warranty (outside EU, at least). So it's another trade: privacy for warranty. But in case of a custom ROM, you even get rid of the "base sniffers" (see e.g. Motorola is Listening).
    – Izzy
    Commented Jul 8, 2013 at 5:28
  • This is still a major concern, and one can only feel that Google is doing this intentionally. So many apps request this permission "so they can properly run in the background" or "stop when you get a call" or some similar excuse.
    – MichaelGG
    Commented Mar 7, 2014 at 7:34
  • This answer mentions that since 1.6/2.0, this permission is no longer required for pausing audio when a call is active, but doesn't actually say why, i.e. how to otherwise do it. So I did some searching and found this.
    – vertigo
    Commented Sep 12, 2020 at 4:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .