Help understanding Whatsapp's permissions

Question

Whatsapp has been nagging me for the past few days that I have to upgrade it to continue using it. With the Facebook acquisition and the Play Store no longer marking the permissions that are "NEW" separately, I'm on a toss up between an upgrade and an uninstall; I'm hoping further information about the permissions will help.

First of all, does anyone know which permissions were added after Facebook's acquisition?
And among the permissions listed, what does "find accounts on this device" allow the app to do? Does "receive text messages" allow the app to read any existing or new incoming SMS messages? And as a minor curiosity, why would it need the "retrive running apps" list?

Here's the permission list from the Play Store:

This app has access to:

In-app purchases

Device & app history

• retrieve running apps

Identity

• find accounts on the device
• add or remove accounts
• read your own contact card

Contacts/Calendar

• read your contacts
• modify your contacts

Location

• approximate location (network-based)
• precise location (GPS and network-based)

SMS

• receive text messages (SMS)
• send SMS messages

Phone

• directly call phone numbers

Photos/Media/Files

• modify or delete the contents of your USB storage
• test access to protected storage

Camera/Microphone

• record audio
• take pictures and videos

Wi-Fi connection information

• view Wi-Fi connections

Device ID & call information

• read phone status and identity

Other

• receive data from Internet
• read sync statistics
• prevent device from sleeping
• full network access
• control vibration
• run at startup
• view network connections
• connect and disconnect from Wi-Fi
• use accounts on the device
• create accounts and set passwords
• modify system settings
• read sync settings
• toggle sync on and off
• install shortcuts
• uninstall shortcuts
• read Google service configuration
• change your audio settings

Answer 1

I had sent this question as an email to WhatsApp support too, and I've now received a reply from them with complete explanations of the permissions. Pasting that reply below:

---

Thanks for your message. We strive to keep this information as up to date and as accurate as possible.
However, at times, it is possible that Google or your handset maker may change, deprecate or remove various permissions.

Category: Your messages

Permission: Receive text messages (android.permission.RECEIVE_SMS)
Explanation: We use this to be able to read the SMS we send to your phone to verify your phone number.

Category: Storage

Permission: Modify or delete the contents of your USB storage (android.permission.WRITE_EXTERNAL_STORAGE)
Explanation: We store your media and chat history backups on the USB storage.

Category: System Tools

Permission: Modify system settings (android.permission.WRITE_SETTINGS)
Explanation: We need this to read your settings, we do not write any settings, but there is only a write settings permission which includes the ability to read settings.
Permission: install shortcuts (com.android.launcher.permission.INSTALL_SHORTCUT)
Explanation: We use this to install a WhatsApp shortcut or conversation shortcut on your homescreen.
Permission: uninstall shortcuts (com.android.launcher.permission.UNINSTALL_SHORTCUT)
Explanation: We use this to make sure we do not create duplicate shortcuts on your homescreen.

Category: Your location

Permission: approximate (network-based) location (android.permission.ACCESS_COARSE_LOCATION)
Explanation: We use this so that you can send your location to your friends.
Permission: precise (GPS) location (android.permission.ACCESS_FINE_LOCATION)
Explanation: We use this so that you can send your location to your friends.

Category: Services that cost you money

Permission: directly call phone numbers (android.permission.CALL_PHONE)
Explanation: We need this so that we can have the "Call" ability in the app.
Permission: send SMS messages (android.permission.SEND_SMS)
Explanation: You may send an SMS by using our tell a friend feature to tell a friend about WhatsApp.

Category: Camera

Permission: Take pictures or videos (android.permission.CAMERA)
Explanation: We use this to allow you to take pictures from inside WhatsApp. Read more here

Category: Microphone

Permission: record audio (android.permission.RECORD_AUDIO)
Explanation: We use this to allow you to record Voice Notes to send to your friends.

Category: Your accounts

Permission: Add or remove accounts (android.permission.MANAGE_ACCOUNTS)
Explanation: We use this to add a WhatsApp account to your device to show your WhatsAppable contacts.
Permission: create accounts and set passwords (android.permission.AUTHENTICATE_ACCOUNTS)
Explanation: We use this to add a WhatsApp account to your device.
Permission: use accounts on the device (android.permission.USE_CREDENTIALS)
Explanation: We need this permission to read and write your WhatsApp credentials.
Permission: find accounts on the device (android.permission.GET_ACCOUNTS)
Explanation: This is necessary to find which accounts to check for WhatsApp contacts.
Permission: read Google service configuration (android.providers.gsf.permission.READ_GSERVICES)
Explanation: This is used for Google Maps integration in WhatsApp location sharing.

Category: Your social information

Permission: modify your contacts (android.permission.WRITE_CONTACTS)
Explanation: This is necessary so that we can add the WhatsApp button into your contacts so you can send a WhatsApp to your friends from anywhere in your phone.
Permission: read your contacts (android.permission.READ_CONTACTS)
Explanation: We use this in order to automatically add all your friends that have WhatsApp installed on their phones.

Category: Your personal information

Permission: read your own contact card (android.permission.READ_PROFILE)
Explanation: We use this to try and set a default profile name.
Permission: read call log (android.permission.READ_CALL_LOG)
Explanation: This permission is not needed but is granted transitively from READ_CONTACTS because we support old versions of Android.
Permission: write call log (android.permission.WRITE_CALL_LOG)
Explanation: This permission is not needed but is granted transitively from WRITE_CONTACTS because we support old versions of Android.

Category: Phone calls

Permission: read phone status and identity (android.permission.READ_PHONE_STATE)
Explanation: We need this so that we don't annoy you when you are on the phone.

Category: Your applications information

Permission: run at startup (android.permission.RECEIVE_BOOT_COMPLETED)
Explanation: We use this to make sure the app is running to make sure you get your messages on time. Permission: retrieve running apps (android.permission.GET_TASKS)
Explanation: We need this in order to see if you are running any Task Killers, which may cause problems with our application.

Category: Sync Settings

Permission: read sync settings (android.permission.READ_SYNC_SETTINGS)
Explanation: We use this to make sure you get your messages on time.
Permission: read sync statistics (android.permission.READ_SYNC_STATS)
Explanation: We use this to debug possible problems in getting your messages on time. Permission: toggle sync on and off (android.permission.WRITE_SYNC_SETTINGS)
Explanation: We use this so that we can make sure your WhatsApp contacts are up to date.

Category: Development tools

Permission: test access to protected storage (android.permission.READ_EXTERNAL_STORAGE)
Explanation: We store data onto the external storage. The permission is granted transitively by android.permission.WRITE_EXTERNAL_STORAGE. We have no idea why Google describes the permission thusly.

Category: Affects Battery

Permission: control vibration (android.permission.VIBRATE)
Explanation: to notify you of a new message, we may vibrate your phone.
Permission: prevent phone from sleeping (android.permission.WAKE_LOCK)
Explanation: We need this to make sure that when a friend sends you a file, it doesn't get broken by your phone going to sleep.

Category: Network communication

Permission: full network access (android.permission.INTERNET)
Explanation: Without this we wouldn't be able to send your chat messages.
Permission: google play billing service (com.android.vending.BILLING)
Explanation: We use this to allow you to pay for the WhatsApp subscription.
Permission: receive data from internet (com.google.android.c2dm.permission.RECEIVE)
Explanation: We use this to make sure that you get your messages on time.
Permission: view wifi connections (android.permission.ACCESS_WIFI_STATE)
Explanation: We use this to check and see if you are on a Wi-Fi that WhatsApp won't work on.
Permission: view network connections (android.permission.ACCESS_NETWORK_STATE)
Explanation: We use this to diagnose your network connection and have the app react accordingly to ensure you get your messages on time.
Permission: full network access (android.permission.INTERNET)
Explanation: We need this to open socket connections to our servers in order to make sending and receiving messages fast.

Answer 2

The entire "Identity" permissions are for push notification system, which is implemented using Google Cloud Messaging on android and requires a valid Google account to be present on the device.

The "SMS" & "Phone" permissions are for activation of WhatsApp account when it is freshly installed on a device and to send a calling action when you press the phone number of a particular WhatsApp contact.

I guess the "Device & app History" permission must be for managing the RAM usage by WhatsApp itself. This should vary from one android version to another.

Rest of the permissions are more or less self explanatory, but in case you want detail for any of them, then just put a comment, I'll explain it to you.

I'd recommend that you upgrade your WhatsApp application as they remove the support for previous versions after a while.

Also, Android Police have uploaded the APK for latest Play Store build which shows old and new permissions in a better way.

WhatsApp maintains a little higher version of their app than that available on the Play Store over here (just in case you're interested).

Answer 3

First, for general questions on what a permission stands for (and what an app might do with it), you can find a good overview on my Android site. Took me quite a lot of research to collect all available information, and it's still incomplete; I cannot understand there's no official source on that for end-users.

To your explicit questions:

• Yes, with RECEIVE_SMS an app could theoretically "eat" your messages, i.e. sneak them away under your nose so you wouldn't even notice there was one.
• GET_ACCOUNTS is needed to find accounts you've registered with from your device. The API makes that mandatory if you want to use an account (USE_CREDENTIALS permission). Though it looks quite suspect if an app requests the former but not the latter: what for would it need to know available accounts, if it doesn't want to use one? For further details, please also see What can an app do with the “USE ACCOUNTS ON THE DEVICE” permission? I'm wondering that USE_CREDENTIALS is missing from your list, as Whatsapp will certainly need that: It also has the MANAGE_ACCOUNTS permission (to create/manage your Whatsapp account on your device), which might imply the other (not sure about that due to lack of documentation).
• The GET_TASKS permission is another one which often raises my eyebrow. While it's pretty clear why a process manager (or task killer) would need that, I see no reason why Whatsapp should be interested in that. Which does not automatically mean there is no such reason; it would e.g. make sense if an app needs to check whether a companion app is running, for some shared actions (I'm not an Android dev, so I've got to leave this part to someone else).

Sorry that I don't continue my explanations for the complete list of permissions you've posted, but that would get quite long. Be welcome to visit the first link in my answer to find out more details for yourself. And, of course, if this raises specific questions, Android.SE is the right place to ask them!