Re: ebook-reader permissions - no explanation given

Andy Burns wrote on Tue, 28 May 2024 19:25:13 +0100 :

The "old" way was that the manifest file listed perms required, and you
agreed to them at install-time, except there were some perms that apps
got "for free", i think the android version that an app is targetted to
can change the perms it needs/gets, there's a lot of history ...

I just looked in Muntashirakon (which is the best App Manager by far),
and it has a "Manifest" button, which provides that data (see below).

Then runtime perms came along, which offer you the
grant/grant-while-running-this-app/deny options, I prefer those.

See below where the ReadERA app seems to do that just-in-time permissions.

I think the "new" way means (for example if an e-reader app did need to
write annotations back to file) that it would only need to request write
permission if a user actually used the annotation feature ...

Thanks for helping out as I never understood Android permissions, and, as
you noted, not only do they change over time, but Android permissions may
also have nested complexities which can depend on how apps are written.

In testing a few ebook readers just now, I noticed one app that seemingly
did permissions in a more sophisticated way as you noted above was ReadERA.

I've only tested these apps for a minute or two each, but I like that one
out of the few that I searched for with the Skyica App Finder app today.
 <https://play.google.com/store/apps/details?id=org.readera>
 <https://f-droid.org/en/packages/com.github.axet.bookreader/>
 <https://play.google.com/store/apps/details?id=org.coolreader>
 <https://play.google.com/store/apps/details?id=com.kevinzuccaro.epubreader>
 <https://play.google.com/store/apps/details?id=com.gzhi.neoreader.r2.main.free>

For example, ReadERA has the following Muntashirakon Manifest related tags.
  <permission
    android:name="org.readera.permission.TierSync"
    android:protectionLevel="0x00000002">
  </permission>
  <uses-feature
    android:glEsVersion="0x00010001"
    android:required="true">
  </uses-feature>
  <uses-permission
    android:name="android.permission.WAKE_LOCK">
  </uses-permission>
  <uses-permission
    android:name="android.permission.ACCESS_NETWORK_STATE">
  </uses-permission>
  <uses-permission
    android:name="android.permission.INTERNET">
  </uses-permission>
  <uses-permission
    android:name="android.permission.READ_EXTERNAL_STORAGE">
  </uses-permission>
  <uses-permission
    android:name="android.permission.WRITE_EXTERNAL_STORAGE">
  </uses-permission>
  <uses-permission
    android:name="android.permission.MANAGE_EXTERNAL_STORAGE">
  </uses-permission>
  <uses-permission
    android:name="android.permission.FOREGROUND_SERVICE">
  </uses-permission>
  <uses-permission
    android:name="android.permission.POST_NOTIFICATIONS">
  </uses-permission>
  <uses-permission
    android:name="android.permission.RECEIVE_BOOT_COMPLETED">
  </uses-permission>
  <uses-permission
 android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE">
  </uses-permission>

But it's easier to use the Muntashirakon tabs than to eye-grep parse the
manifest file, at least for me it is.

Thanks for letting me know though, that the Manifest is the cat's meow
on finding which permissions an app might ask to set while in use.