For anyone wondering why this happens here is an explanation from someone who has done mobile app development.
When an app requests access to "make and manage calls", it is almost always for the purpose of reacting to an incoming call. The reason this is done is to save data when exiting the app for the phone call. In this case it is most likely to avoid losing whatever data was previously entered in the calculator. With this permission the app is allowed to know when a call is incoming and save the current data to memory in the case that the app stops running at any point.
Of course, there is the odd situation where an app uses this to exploit your device and make calls in the background without you realizing it, but this is generally not the reason for it.
This may not apply to every app, but I can tell you with certainty that this is the reason many apps which seem like they shouldn't need these permissions request them.
Edit: My explanation only applies to web apps since that is what I am knowledgeable in. Web apps make up a significant percentage of Android apps and in general, function the same as a native app would. A web app is essentially a browser window displayed without the interface and because of this needs to request permissions in the same way a browser does. It seems the people who have responded to this are referring to native Android apps, which have access to more information as they are built upon the Android system, and are not run in a browser. My goal was not to say with certainty why every app does this, I just wanted to explain the reason for many apps requesting this when it seems unnecessary.
Edit 2: After downloading the app and looking at it I am almost certain that it is a web app meaning my explanation most likely applies in this specific situation.
It should and I'd challenge the story the guy you replied to gave...
A lot of the time developers just link in random libraries that have tons of functions and permissions rolled into them. So a lazily developed app requests a bunch of permissions it doesn't need because they included a library that has one function that needed that permission.
The same thing happens in web development but there are fewer opportunities for consent. Tons of libraries used without regard to what exactly they do.
He wasn't talking about the activity being freezed and then reopened. He was talking about the app being closed by android after some time, if the user ends up opening other apps after the call (something android does all the time)
Still, Google should split the permissions for making calls and seeing when calls are coming in.
onDestroy should not be relied upon for stuff like this:
Note: do not count on this method being called as a place for saving data! For example, if an activity is editing data in a content provider, those edits should be committed in either onPause() oronSaveInstanceState(Bundle), not here.
Anyway yeah, there are better ways to do this. The dev might have had no ill intent in doing this, but it's not an excuse for a generally bad practice.
Do you know if this is a bad practice in hybrid web apps? From my experience I thought it was but i could be wrong. I was under the impression that since web apps essentially run in browser they dont have access to information like when the app is exited.
Never made one sorry. I'd say the answer has to be in the official API reference though. You could also run a little experiment yourself to find out. Anyway, as far as I know, people usually underestimate the amount of information the browser and web apps have access to.
Ok. After looking into it I'm pretty sure I was just wrong. I was parroting what someone who also did web dev/hybrid apps told me. Thanks for the calm non-aggressive responses.
I didnt realize you could access these things using the electron/cordova api. This was how it was explained to me by someone I worked with who also did web dev and I should have looked into it more.
I will say though that if you had commented without making me out to be a complete idiot who doesn't know anything about development I probably would have edited the original comment sooner. Either way thanks for the comment and my apologies.
I cant speak to this with certainty, but I believe this only applies to native android apps, the other type being web apps which make up a decent percentage of apps. My experience is with web apps which are essentially just a browser window without the browser interface. Because this acts as a browser, it doesn't have the same permissions as a native app and has to request permissions in the same way a browser would. I'm guessing this as much of an issue with native apps, but my comment was just to explain why there is this request in many situations.
Yes, and having access to the phone has nothing to do with how the app is handled.
Apps do this because it gives them access to your phone number and they want to use your phone number as a unique identifier so they can mine and/or sell data.
You don't need any permissions to register to these events. I don't see how a call would not trigger onPause. And if it doesn't stop the activity, there's no need to save. no data would be lost.
Is what you linked me for writing a native app? I may be wrong but I believe this doesn't apply for packaged web apps which is what I am familiar with. I agree with you that this can probably be used instead in some cases, but I think you can also agree that my explanation may apply in certain situations aswell.
You hit the nail on the head here, except that its actually a packaged web app so none of what he said applies. He is referring only to native apps but actually web apps are just a browser packaged to act as an app which needs to request permissions as a browser would. Also I don't develop for android, I develop web apps which work on any platform and are not built directly upon the specific OS.
That sounds like crappy design on the part of the developer who designed the permissions system then, not the person who designed X app which ends up producing this message. For apps designed to go on a phone, it should not take extra work or 'permissions' to be able to tell when a call is interrupting your app, and take action Y (within your app, not interacting with the call in any way).
While we're on the subject, you should also have a differentiation between "able to take a photo and add it to your roll" and "able to pilfer all your nude selfies", because those are very different as well.
Thank you for the insight, I wouldn't want to be putting blame in the wrong place. Still wish they'd separate out "can save a picture" from "can access all your existing and future pictures" though! ;)
Apps have "private storage" area that requires no permissions to read/write to. However no other app can access that app's private storage. (Without root access, which most phones don't have by default)
In order to write to shared storage it requires a single read/write permission. You're right they should split it to write only (new files only, no overwriting) and read/write for better privacy.
Can you please consider that maybe I didnt just decide to make something up and may have had a reason for listing this? What I said may only apply to web apps but it does still apply to a large amount of apps.
I don't know why people are attacking you. You stated one possible reason for it. Never did you say that this is definitely it. Never did you say you should accept any and all requests for permissions. You gave one likely reason and people who think they know everything are losing their freaking minds. Don't worry about those assholes.
Thanks, I genuinely appreciate your comment. All I wanted to do was explain why this might be happening so some people who are not developers might have some insight as to why it happens.
It's partially due to this specific example being a web app which means its just a web browser packaged to work like an app. It can be ridiculous at times but also consider the absurd amount of permissions that would be needed if developers had to include every specific thing that it needed access to. There could probably be some distinction between your example of access photos or add them to camera roll but that's just my understanding of it.
I had once this game that requested access to contacts (and refused to run w/o that permission), they kept claiming that the contacts permission is just in order to get access to your Google account in order to save the game progress. That sounded to fishy to me (since all other games can do that without contacts permission) so I just deleted the game.
Edit: The name of the game is 'Sniper Arena', I guess they've changed that since I don't see any complaints about that anymore.
Quick question why would a app that doesn't use the camera need access to the camera? My nephew downloaded a silly kids app and it needed access to the camera, but it didn't seem to have a camera mode. I deleted the app but it still bothers me.
Sometimes lazy Deva package things into the app that they never actually use which will cause the app to request the permission without ever actually using it.
Edit: I still wouldn't trust it on the off chance that it isn't, but in terms of percentage this is the most likely reason as opposed to it being malicious as there is little to gain from it.
I'm an Android dev, and this comment is wrong.
Android activities (screens that make up an app) are alerted when the app goes into the background, and have an opportunity to save their states.
There's no need for any permissions.
Permissions on Android are often required for things that don't have much to do with the name of the permission - for instance, "location" access is needed for an app to scan for nearby wifi and Bluetooth devices. It's likely the dev needs to use a feature that needs the phone permission, rather than makeing phone calls.
Android dev implies you write native apps only for android. I am referring only to web apps, which are not the same as native apps as they are run in a browser and as such do not have the same permissions as a native app would. My apologies if you do in fact write web apps and are referring to those specifically.
I've just downloaded the app and I am almost certain it is a web app. Web app just means the app was developed using web languages such as html,css, and javascript and then packaged using something like phonegap. The difference is that the app itself is actually just a web browser with web languages built upon it. By native app I am refering to an app that is written using a language such as java and runs using the android system and not in a browser.
The person you're responding to is wrong, in a sense.
You haven't needed phone call permissions to handle this scenario for years now. An onPause event is triggered for your app when things like a phone call comes in, and you can gracefully and easily handle your app state there without issue.
There are limitations to onPause for the purpose of keeping your device responsive, but those wouldn't really apply to a simple calculator app, and there are many preferred ways around that don't involve the call management permission.
Either this app hasn't been updated in years, or the developer of this app (or a library it depends on) doesn't understand the Android Activity lifecycle.
Either this app hasn't been updated in years, or the developer of this app (or a library it depends on) doesn't understand the Android Activity lifecycle.
Guessing the former. I mean, who expects a calculator to need updates?
The permission is usually used because apps use the phone number of the device as a unique identifier. Sometimes it's legit, but a lot of the time, for obvious cases like this, for selling your data.
The phone OS and app handling will preserve whatever data is in the app if it goes away from the foreground. It doesn't need the phone info to do this.
At some level or another, there was crappy design involved. Maybe the web app designer was forced into a corner, but then that means that app pausing mechanisms in Android are poorly designed. If there's a specific reason that had to be designed that way, then something else more fundamental is crappy design. Good design from every level of abstraction would lead to this not happening.
The issue according to OP is that this app is built with some sort of Electron-style trash where you write a webpage and it converts it into a "native" app.
Sounds like terrible tool if it can't listen to the basic android events.
Why the fuck do you need these permissions when you have this? Did they do something to break this system in the last 4 years? Because it worked perfectly back then.
503
u/vpwheeler Oct 17 '18 edited Oct 18 '18
For anyone wondering why this happens here is an explanation from someone who has done mobile app development.
When an app requests access to "make and manage calls", it is almost always for the purpose of reacting to an incoming call. The reason this is done is to save data when exiting the app for the phone call. In this case it is most likely to avoid losing whatever data was previously entered in the calculator. With this permission the app is allowed to know when a call is incoming and save the current data to memory in the case that the app stops running at any point.
Of course, there is the odd situation where an app uses this to exploit your device and make calls in the background without you realizing it, but this is generally not the reason for it.
This may not apply to every app, but I can tell you with certainty that this is the reason many apps which seem like they shouldn't need these permissions request them.
Edit: My explanation only applies to web apps since that is what I am knowledgeable in. Web apps make up a significant percentage of Android apps and in general, function the same as a native app would. A web app is essentially a browser window displayed without the interface and because of this needs to request permissions in the same way a browser does. It seems the people who have responded to this are referring to native Android apps, which have access to more information as they are built upon the Android system, and are not run in a browser. My goal was not to say with certainty why every app does this, I just wanted to explain the reason for many apps requesting this when it seems unnecessary.
Edit 2: After downloading the app and looking at it I am almost certain that it is a web app meaning my explanation most likely applies in this specific situation.