Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It only takes a minute to sign up.
Sign up to join this community
I'm pretty paranoid with the android apps and if I think an app requires too much, unnecessary permissions, I simply don't install the app. However, I feel like I'm missing out lately.
For example, I prefer to use browser for facebook, and I refuse to update my twitter client that requires excessive permissions.
So how can I distinguish a possibly malicious application from a decent application that requires lots of permissions? When am I safe and when should I be suspicious installing an app?
Well, there's a lot of questions in one. Let's handle a few:
If your concern is major applications, such as Facebook, Twitter, etc., from major publishers and services, then as long as you're downloading updates from the Play Store, there's no reason to assume you're downloading a possible malicious application. The apps are all digitally signed and scanned by Google. While malware HAS gotten onto the Play Store, it doesn't get on there as updates to major, legitimate apps. It ends up on there as its own unique app from shady publishers, or updates to apps that got sold to a new publisher, etc. If a major app like Twitter or Facebook wants a new permission, you can feel confident it's for a feature and not malicious.
What that doesn't tell you is whether or not you're comfortable feeling paranoid about how that major publisher intends to use that permission. Some people strongly distrust Facebook, and are unwilling to hand those sorts of permissions to them, even though the app isn't strictly malicious, as it's the company they have an issue with. That's more of a personal judgment call than anything else.
The other priority is to familiarize yourself with what the permissions actually mean (here's a good place to do that from Google), and get a basic understanding of how apps actually function. Some sound scary until you understand why they're necessary. An example was someone I found upset over a keyboard app requiring permission to monitor everything they type, oblivious to the fact that without that permission, it couldn't function as a keyboard. Understanding how apps need to communicate over the network, or be aware of incoming call status in order to pause a game, or being able to review contacts in order to try to suggest new friends based on people you know, or needing access to the camera because they can take photo notes or do video chat, etc., will help you parse which permissions fit within the mission of the app and which ones seem like a stretch to possible data-mining. Google's descriptions tend to focus on the worst-possible scenarios because they have to allow for them. But dialing back and recognizing that, yes, this permission does allow for scenario Z, but it's also the only way they can do scenario A, which is right in line with the goal of the app, will help you figure out when you're being a little paranoid.
READ_PHONE_STATE (see also Why do so many applications require permission to read the phone state and identity?)
– Izzy♦
Feb 6 '15 at 19:19
Be suspicious when the app requires an permission that is not related to what app offer especially things like send SMS/MMS or do calls and be very suspicious if is anything related to things like "show alerts as system level" or "modify global settings" or "interact between users" and be extremely cautios and suspicious about the permission "download files without notification" (like google+).
About the major apps and company's i will say only that they indeed have privacy issues so is all about you feeling ok with that or not , like i don't have facebook at all but you using it on your mobile browser is no different from using their app except that an app give then more access to your system to abuse but your mobile browser already leaks enough data to track and identify you especially if you use chrome mobile and accepts their cookies and most pages today have the nasty facebook widget to track you too if you don't block them so its all about what you choose (to use them or not)
And if you download apks from Internet be extremely careful and download then directly from the their official site or xda-developers and in a connection you believe you are not in danger of man in the middle attacks if you want scan it a good AV can detect some androids malware already ( virustotal will say you that apks that do root have rootkit already)
Obs: The permissioms may look different on your phone but the meaning should be the same
