Re:2FA app with 10k Google Play downloads loaded well-known ...
by alexbakker on Friday January 28, 2022 @01:47PM
(#30118726)
> android.permission.INTERNET is frankly hilarious since that permission no longer does anything (every app has access to the internet).
This is incorrect. If an app doesn't specify this permission in its manifest, it cannot access the internet.
Re:2FA app with 10k Google Play downloads loaded well-known ...
by UncleMeat on Friday January 28, 2022 @03:33PM
(#30119954)
Is that true? I was under the impression that this changed years ago since virtually every app requested it anyway.
Apps could always send content over the internet by sending an intent to a browser with relevant GET parameters to whatever server is consuming the data.
Re:2FA app with 10k Google Play downloads loaded well-known ...
by mdp2021 on Saturday January 29, 2022 @08:25AM
(#30126089)
Investigating, but the Android Developers page at https://developer.android.com/training/basics/network-ops/co... still states that
«To perform network operations in your application, your manifest must include the following permissions: ... .INTERNET and ... .ACCESS_NETWORK_STATE»
Though yes, applications (with particular regard to those that did not open network sockets internally) could use intents to have other applications perform network operations.
The permission model is messy but made much worse by the volume of SDK code that is actually in most apps today. SDKs ship as big blobs with their own manifests and if you build in the SDK then you are collecting their permissions even if you aren't using the code that needs it. And given that virtually zero consumers choose apps based on permissions, there is little incentive to pare down the list to the minimum needed.
android.permission.RECEIVE_BOOT_COMPLETED is really the only thing suspicious in that list since this is used for a few more old school malicious behaviors. Complaining about android.permission.INTERNET is frankly hilarious since that permission no longer does anything (every app has access to the internet).