Re: Android keyboard: your choice.

Arno Welzel wrote on Sun, 30 Jun 2024 10:03:41 +0200 :

if you install an app which has both READ_CONTACTS permission and
INTERNET permission, by the time you've checked the permissions, your
entire contact list is already circulating in
China/Russia/Somethingistan ...

>
No, since the app has to be started first. An app will not get started
automatically just because you have installed it.

 
if it installs a service it will ...

 
No, not even a service will start automatically. The app must be invoked
by the user once in any case.
 
Only when the app has a android.intent.action.BOOT_COMPLETED intent
filter (and the respective permission to recieve this event), it may use
this to start a service automatically when you *reboot* your device. But
just installing something will *never* automatically start it.

I defer to Arno's and Andy's experience (the "A's" on this ng are stellar!)
however - I will state a test I ran which shocked me when I ran it.

1. Make sure you know EXACTLY what is in your contacts database
   (e.g., put a test entry that is unambiguously brand new).

2. Make sure you do NOT have a Google Account (or any account) set up
   on the phone (where the Google Account is the culprit here).

3. Then, install the Google GMail app, and simply run it the first time
   (i.e., log into the GMail app to get your IMAP-stored email messages).

Guess what just happened.

Exactly what Andy said would happen.

By default, you got NO SAY in what would happen to your contacts.
You can *change* the default after the fact - but the damage is done.

Google, by default, did two very lousy things in my tests of this.
1. Google unilaterally *created* an account on the Android phone!
2. Google unilaterally *uploaded* your sqlite contacts db to that account!

Of course, after that happens, you can then modify the Google Gmail app to
NOT upload your contacts - but it's already too late by that time period.

Just as Andy said it would be.