Re: Android keyboard: your choice.

Andrew, 2024-07-04 07:12:

Arno Welzel wrote on Sun, 30 Jun 2024 10:03:41 +0200 :
 

if you install an app which has both READ_CONTACTS permission and
INTERNET permission, by the time you've checked the permissions, your
entire contact list is already circulating in
China/Russia/Somethingistan ...

>
No, since the app has to be started first. An app will not get started
automatically just because you have installed it.

>
if it installs a service it will ...

>
No, not even a service will start automatically. The app must be invoked
by the user once in any case.
>
Only when the app has a android.intent.action.BOOT_COMPLETED intent
filter (and the respective permission to recieve this event), it may use
this to start a service automatically when you *reboot* your device. But
just installing something will *never* automatically start it.

 
I defer to Arno's and Andy's experience (the "A's" on this ng are stellar!)
however - I will state a test I ran which shocked me when I ran it.
 
1. Make sure you know EXACTLY what is in your contacts database
   (e.g., put a test entry that is unambiguously brand new).
 
2. Make sure you do NOT have a Google Account (or any account) set up
   on the phone (where the Google Account is the culprit here).
 
3. Then, install the Google GMail app, and simply run it the first time
   (i.e., log into the GMail app to get your IMAP-stored email messages).
 
Guess what just happened.

Better: do NOT RUN it without checking its permissions first!

Exactly what Andy said would happen.
 
By default, you got NO SAY in what would happen to your contacts.
You can *change* the default after the fact - but the damage is done.

Yes, because you just did what many users do - install an app and run it
without giving a shit, what will happen then.

Also see here:

<https://play.google.com/store/apps/details?id=com.google.android.gm&hl=en>

Click on "See details" in the "Data safety" box:

<https://play.google.com/store/apps/datasafety?id=com.google.android.gm&hl=en>

So why is it surprising for you?

Google, by default, did two very lousy things in my tests of this.
1. Google unilaterally *created* an account on the Android phone!
2. Google unilaterally *uploaded* your sqlite contacts db to that account!

Yes, because you use a phone with Google services and use an app from
Google on it. Why does this surprise you? The normal way to use an
Android phone with Google services is to use a Google Account on it.

If you don't want to have this, use LineageOS *without* any Google
services (these are not included in LineageOS) and use F-Droid as the
source for apps. This works in many cases. Only if you need banking apps
or payment this is usually not suitable. But even for LineageOS you can
install one of the GApps-Packages or maybe even a Google Play Services
replacement may work for some Banking apps.


--
Arno Welzel
https://arnowelzel.de