4 ms·

I believe[1] so, based upon my reading of [2]. Personally, I'd be less worried about an app phoning home, and more worried about an app changing my connection t

I believe[1] so, based upon my reading of [2]. Personally, I'd be less worried about an app phoning home, and more worried about an app changing my connection to an adversarial network that could sniff on traffic, etc.[3] [1] Would love if someone with more Android expertise could chime in and confirm/deny [2] https://stackoverflow.com/questions/4374862/how-to-programatically-create-and-read-wep-eap-wifi-configurations-in-android/4374934#4374934 https://stackoverflow.com/questions/4374862/how-to-programat... [3] Note that I have little Android development experience, and have not actually tried creating a malicious proof-of-concept

jm_l 10y ago
FYI, The permission BLUETOOTH_ADMIN allows applications to discover and pair bluetooth devices, but Android system services still handle the necessary user interactions to confirm and complete the process. CHANGE_NETWORK_STATE allows apps to choose which already-enabled medium to send traffic over, but to overwrite settings the app would require WRITE_SETTINGS which is a runtime permission granted by the user. CHANGE_WIFI_STATE can send the user directly into the "Add network" Wi-Fi settings screen, but cannot change the connection without user input. Also, in general, the normal permissions are pretty heavily vetted for attack vectors. I would say that if there is a problem with Android's permissions system its that users don't read important permissions they grant, not that apps can get them without consulting the user (they can't).