Re: Android keyboard: your choice.

R.Wieser, 2024-06-21 11:14:

Arno,
 

An app *must* contain the permission request in the manifest,
regardless if it actually uses it or not.

 
I take that as "regardless if it *directly* uses it or not."

There is no "direct use". Either an app does use an system API which
requires a permission or not. The only way it changed over the years is,
that most permissions have to be granted by the user when first used
while in older versions of Android all permissions in the application
manifest got granted automatically.

But do you recognise that way of doing stuff might be problematic ?   If you
lend your phone to someone a friend or your kid(s) get a hold of it (wanting
to play a game perhaps) they might cause the permission to be asked for, and
than it won't be you answering the question.
 
Time will tell if my phone uses the same "late binding" mechanism.  I hope
not though.

"Late binding" is required for *all* permissions in newer Android
versions. I am not sure when Google changed this, but as far I remember,
Android 6 introduced that.

It will only access contact data, when you enable the setting for it in
the app, otherwise not.

 
:-) You talk as if you are smart enough, but at the same time you seem to
blindly trust an apps honesty in obeying a setting it manages it itself.
I don't.

I don't either - but I can read and understand source code:

<https://github.com/Helium314/HeliBoard>

And yes, I also develop Android software myself:

<https://github.com/arnowelzel/periodical>

<https://f-droid.org/de/packages/de.arnowelzel.android.periodical/>

<https://play.google.com/store/apps/details?id=de.arnowelzel.android.periodical>

[...]

Also see the options in the app - "Suggest Contact names" is a good
hint what the permission for contact reading is used for.

 
You're sounding rather gullible there.  :-(
 
They *tell you* that they will /just/ take the contact names, and leave
everything else (you know, phone numbers, adresses, etc.) alone, and you
believe them ?   Again, I don't.

Who is "they"?

Heliboard is not sold by a company but provided by a bunch of
contributors (at the moment 26 - see
<https://github.com/Helium314/HeliBoard/graphs/contributors>) who spend
their free time to maintain a keyboard app you can use for free.

So you believe all these guys work on that app to spy on you?

Then don't use the app or better don't use smartphones at all - and yes,
I am really serious!

Its not about what they /tell you/ what they are going to do, its about
*whats possible* they could do.

Yes - everything is possible! Even if an app has *no* permissions at all
it still can be harmful since there may be a security bug in Android
which a malicous app can exploit. And yes, I am really serious! See
<https://en.wikipedia.org/wiki/Stagefright_(bug)> about the
"Stagefright" bug which could be exploited just by displaying images.

At some point you have to decide if you trust a system or not. And if
you do not trust a system, then don't use it.

Also, there is a reason why some phone OS-es offer you to provide apps
asking for such a permission a fake list.

Which does not solve the issue, that you still have to trust the OS that
it works as intended.

Better than just assuming that the app does not respect your privacy just
because of an *optional* permission.

 
You sound like you will have no problem with handing off your wallet
(containing money, bank cards and passport) to a random stranger when he
asks for it.

No, I have no problem trusting an open source app I can check of myself.

What ?  You would not trust a random stranger like that ?  But you still
expect me to (blindly) trust a random app ?  Really ?

No I don't expect anything except not being paranoid and trying to
understand *why* I told you that about Heliboard.

--
Arno Welzel
https://arnowelzel.de