4 ms·

These permissions on Android are incredible, how did it even get to the Play store? For those who want a tldr: The android app for olympics allows the develop

These permissions on Android are incredible, how did it even get to the Play store? For those who want a tldr: The android app for olympics allows the developers to get all your contacts, listen to your microphone, wifi & bluetooth device connections, location, files. It starts at startup, can hide and reorder itself, can REMOTELY download files and trigger all kinds of tracking and spoofing. Basically, anyone who installs this app on their device will throw away all the privacy not just while the app is installed, but also possibly long-term since with the amount of permissions, you cannot be sure it won't leave a remotely downloaded trojan horse in your device after dumping all your files, contacts and listening to your conversations. From controlling the narrative to spying on other teams and coaches, anything goes with this one. And it's not just that this permission list is batshit insane (remember that batman scene with all the phone data giving him a full 3D image of the city? that level of batshit insane) - its insane Google is allowing this to be published.

AnssiH 5y ago
> The android app for olympics allows the developers to get all your contacts, listen to your microphone, wifi & bluetooth device connections, location, files. It starts at startup, can hide and reorder itself, can REMOTELY download files and trigger all kinds of tracking and spoofing. Most of those trigger a specific Android permission popup at runtime to grant access when actually needed/used. The app doesn't them just by the user installing it.
- wishawa 5y ago
  This is correct. And it is normal practice for not-truly-native apps (apps using React Native, Ionic, etc.). By declaring every permission in the manifest, they can add new features that would require those permissions without by just updating the javascript code over the air (no play store update / google play review needed).
  - Larrikin 5y ago
    It's not standard anymore. Google has started requiring lengthy documents you have to fill out justifying the more sensitive permissions and will stop letting you publish if they find things you have left out. This applies to new and old apps. They've become a liability to leave in. Basically killed the entire beacon industry since some people used those to track exact location.
    - wishawa 5y ago
      I’m using the [Expo SDK](https://expo.io https://expo.io) and it declares a whole bunch of permissions yet goes through review fine without any explanation.

AnssiH 5y ago

> The android app for olympics allows the developers to get all your contacts, listen to your microphone, wifi & bluetooth device connections, location, files. It starts at startup, can hide and reorder itself, can REMOTELY download files and trigger all kinds of tracking and spoofing. Most of those trigger a specific Android permission popup at runtime to grant access when actually needed/used. The app doesn't them just by the user installing it.

wishawa 5y ago
This is correct. And it is normal practice for not-truly-native apps (apps using React Native, Ionic, etc.). By declaring every permission in the manifest, they can add new features that would require those permissions without by just updating the javascript code over the air (no play store update / google play review needed).
- Larrikin 5y ago
  It's not standard anymore. Google has started requiring lengthy documents you have to fill out justifying the more sensitive permissions and will stop letting you publish if they find things you have left out. This applies to new and old apps. They've become a liability to leave in. Basically killed the entire beacon industry since some people used those to track exact location.
  - wishawa 5y ago
    I’m using the [Expo SDK](https://expo.io https://expo.io) and it declares a whole bunch of permissions yet goes through review fine without any explanation.