35

Android has a centralized system for managing credentials for online services (such as your Google account). One component is called the AccountManager. Some apps can "act as an account authenticator". This means that they understand how to log into a particular online service, and can log in to that service for the AccountManager. Other apps want to use ...


27

You won't be able to achieve success through the native mechanism of Android. Cody Toombs at Android Police has very well pointed this out in the article: Android M Will Never Ask Users For Permission To Use The Internet, And That's Probably Okay. In the section Normal and Dangerous Permissions of the document Permissions Overview, Google has noted: ...


27

You cannot see that just by checking an app's permissions: those permissions ad modules require for their job are the same the app itself might need for another job. You can, however, look up the app at AppBrain: for each app, that site lists up what ad modules (and other libraries) are used. You find that scrolling down to the "Libraries" section. AppBrain ...


25

The Chrome page in the app store says this about the new permissions: This version requests two new permissions, Camera and Modify Audio Settings, to support WebRTC, an experimental feature under development. WebRTC itself is designed to expose your camera and mic to the browser, so that web-apps can implement video-conferencing and other multimedia ...


25

You could use NetGuard (see my list of Internet Firewalls for other alternatives), which works without root and lets you block internet access for apps selectively (WiFi or mobile data, and even always or only if screen is off). It's from the dev of XPrivacy, so it has to be good ;) NetGuard (source: Google Play; click images for larger variants) ...


23

How it currently CAN be done During my morning routine reading my RSS feeds, I stumbled on a review at N-Droid, discussing an app named APEFS. This app is developed by German students (hence its description on the Playstore is in German, even if you set the language to English). But for our non-German readers, a short description here: Basically, APEFS is ...


23

The technical name of this permission is SYSTEM_ALERT_WINDOW: Allows an application to open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications. This permission allows an app to show a "popup" window above all other apps, even if the app is not in the foreground. A malicious developer/advertiser could use it to show very ...


22

You don't need an external tool for this. On the versions of the Play Store with the new "simplified" permissions dialog, you can still find a full list of permissions from the app's store page (the screen with the icon at the top, description, screenshots, &c.). Scroll down to the bottom of the page. Under "Additional Information" you'll see "...


21

This is all the available permissions that an application can require. Of this list, there are some that can only be "requested" by "System" applications. Applications that are not system applications will not be able to request permissions to "System Permissions". Only applications that are in the /system/app location and signed with the System key can ...


19

Google blocks apps from (mis)using Call Log and/or SMS permissions if they are not the core functionalities of the apps, with some exceptions and alternatives. SMS (termux-sms-list and termux-sms-send) and Call Log (termux-call-log) are not the main purpose of Termux:API app, thus the developer had to remove the permissions to prevent the app from being ...


18

This question has been bothering me quite some time. So now, finally, I decided to get to the bottom of the issue. The Playstore has an app named permission.READ_PHONE_STATE, which requests READ_PHONE_STATE as the only permission, and does nothing else than printing out all data it can access with or without using it. I've installed that on my LG Optimus 4X,...


18

In short, GitHub is using the internal Account System manager to store your GitHub credentials. This works the exact same was as adding a Google account or an Exchange account. Essentially, you are logging in with your credentials and they are stored in the Account Manager, which prevents you from having to re-enter these credentials again in the future. ...


17

Found an answer to my own question! Might as well share how I did it (DO IT AT YOUR OWN RISK, it worked fine for me). Needs root obviously. Using a root-enabled file manager, navigate to /system/etc/permissions Edit platform.xml and find the WRITE_EXTERNAL_STORAGE permission. Add an additional group definition for this permission...<group gid="media_rw" /...


16

General information You might want to take a look at What do the permissions that applications require mean? -- our "community wiki" which hopefully becomes such a ressource one day. Next to that, you might want to take a look at App Permissions Explained – What Do They Really Mean?, a blog article at AndroidPIT giving at least some short explanations. ...


15

I had sent this question as an email to WhatsApp support too, and I've now received a reply from them with complete explanations of the permissions. Pasting that reply below: Thanks for your message. We strive to keep this information as up to date and as accurate as possible. However, at times, it is possible that Google or your handset maker may change, ...


14

More than two years have passed since this question was asked. Still, there's no „official solution” available. Despite its promises, APEFS (introduced in my previous answer over a year ago) has not returned. So I decided to create my own solution: For almost 4 years now, I maintain listings of „Android apps by purpose”, i.e. grouped by their use cases. In ...


14

In his answer, Dan already pointed to my list of apps by real-life topics, which offers some extras as well. Currently, it only covers a small subset of what's available on Google Play, though (for some numbers: ~10,000 apps = ~1% of Google Play, including roughly 5% of the apps available in Aptoides (curated) main repository, and a third of the apps ...


14

Verification by OTP uses a different API which doesn't need read SMS permission. You can read more here Perform SMS Verification on a Server Hence, the app isn't reading your SMS but using a separate channel to read specially formatted text messages I learnt of this when an Xposed module to block permissions did not work as I expected (similar case) and ...


13

XPrivacyLua is a module for Xposed framework which does exactly what you need. It is free and open source. Works on rooted devices. It's the successor of XPrivacy. Install Xposed from here: https://forum.xda-developers.com/showthread.php?t=3034811 You can then download the XPrivacyLua module from the Xposed repo through the Xposed Manager app, or manually ...


13

Why currently  this can't be done When a developer performs the upload of his application to Google Play, the application manifest file gets read to a database, from where the search for apps is performed. To allow searching for applications based on their permissions, one would have to access the database and collect data that concerns the ...


13

No. You should request the app developer to do so. On UNIX like systems, permissions are managed with something called UIDs. Every process has one and it dictates what they can access. Moreover, there are also groups that have permission that their members can use. When an app has permissions like Write to SD card they're put into a group that has this ...


13

There is always the possibility of a vulnerability in some app that could cause your computer/phone to be hacked. Browsers are notorious for having bugs that allow the computer to be infected with a virus simply by viewing a page. In fact, one method to jailbreak an early Apple iOS device was to simply browse to a page that delivered a payload via a bug in ...


13

Yes, it can, but only on Android 4.3 and lower. This is used for example in Whatsapp. When you activate the app, Whatsapp sends an SMS to the number you reported, and the app intercepts it quietly and reports to the servers that it has received the SMS. This is how the account is tied to your number. Of course, this can be used in harmful apps also. If an ...


12

GiantTree is right. If the "floating hearts or animated movements" are supposed to appear on top of other apps, then this permission is needed. If that's not what it does or if that's not what you want (i.e., if it's only supposed to be for editing GIFs inside the app), then you should remove/not install the app — such overlays can be used to ...


10

Many ad publishers use this permission to get the Phone ID for all sorts of tracking purposes. There are other ways to get a unique ID, but unfortunately they are buggy in older Android versions (the story is more complicated, see e.g. https://stackoverflow.com/questions/2785485/is-there-a-unique-android-device-id or http://android-developers.blogspot.com/...


10

As things stand Android 4.3 and below without Hangouts app : Any app with SMS_RECEIVE permission can read/abort an incoming SMS (ala Whatsapp) Android 4.3 and below with Hangouts (SMS mode turned on) : Any app with SMS_RECEIVE permission can read but not abort an incoming SMS Android 4.4 and above : Any app with SMS_RECEIVE permission can read but not ...


10

While your question targets a development issue (which is off-topic here), the answer is relevant for users as well, so I'm going to answer it: DeviceID: This is the serial of the device, which should persist even a factory reset. AndroidID: This will be set at the first boot (either with a brand new device, or after a factory reset). As implicated, it does ...


9

Yes there is, though it's not really elegant and it's a REALLY bad idea to do it. The app that you do it to, will more than likely break if you revoked a permission and it tries to use it. If this wouldn't be enough you will lose your app data and you won't be able to update from the Play Store. With that said it's not that hard to do. You need apktool. ...


9

I am such an idiot. A picture is worth a thousand words: When I bought my device, about a year ago, I turned on the feature "SIM change alert - Send SMS when SIM card is changed". I completely forgot about it later, and it only came back to me today. Of course the recipients I defined were my own number and my wife's. The lead I followed was @roxan's ...


9

I believe the app has to be made with API 23 (aka Marshmallow's API) and the user has to be on 6.0 Marshmallow or higher for what you want to take effect. However, you can still go into Settings - Apps and change each app's permissions individually, or go into Advanced under Apps (the gear icon) and change them by category. Source: Android Developers - ...


Only top voted, non community-wiki answers of a minimum length are eligible