With Android 6.0, a bunch of permissions and permission groups have been removed:
Groups gone
While on a first glance this doesn't seem important (isn't it rather a way to organize permissions?) – thinking twice reveals a major importance here: Starting with Android 6 (and with the Playstore even before that), if an app update requests a permission from a group where it already held one from in a previous installed version, this "new permission" is not brought to the awareness of the user. With Android 6, it is even granted automatically then. Also keep in mind that the user (with "native Android capabilities") can only revoke access to entire groups, not to single permissions – so fewer groups mean less flexibility, up to a uselessness of the entire feature.
According to the link mentioned above, the following groups have been removed:
ACCOUNTS
, AFFECTS_BATTERY
, COST_MONEY
, DISPLAY
, MESSAGES
, NETWORK
, PERSONAL_INFO
, PHONE_CALLS
, SCREENLOCK
, SOCIAL_INFO
, SYSTEM_CLOCK
, SYSTEM_TOOLS
, USER_DICTIONARY
, WALLPAPER
Permissions gone
Less permissions covering more ways to access personal data mean a nightmare for privacy. Concerning accounts, I've raised this question already: Android 6+ and account permissions: where have they gone to? As we found out there, what before was dealt with by the no longer existing USE_CREDENTIALS
permission, now got moved to contacts (not sure whether read or write): so if you wish to "login with Google" (or any other account holder), you need to give the app full access to your contact list! The popup on the screenshot there ("Allow Stack Exchange to access your contacts?") popped up immediately on tapping the "Login with Google" button.
So next to most account permissions (except for GET_ACCOUNTS
, all of them are gone), which are dealt with in my other question already linked, the following permissions have been removed:
ACCESS_MOCK_LOCATION
(now one has to configure a single app handling the MOCK_LOCATION I've seen mentioned?), CLEAR_APP_USER_DATA
, GET_TOP_ACTIVITY_INFO
, HARDWARE_CONTROLS
, HARDWARE_TEST
, INJECT_EVENTS
, INTERNAL_SYSTEM_WINDOW
, READ_HISTORY_BOOKMARKS
, READ_PROFILE
, READ_SOCIAL_STREAM
, READ_USER_DICTIONARY
, SET_ACTIVITY_WATCHER
, SET_ORIENTATION
, SET_POINTER_SPEED
, STATUS_BAR
, SUBSCRIBED_FEEDS_READ
, SUBSCRIBED_FEEDS_WRITE
, VOICEMAIL
, WRITE_HISTORY_BOOKMARKS
, WRITE_PROFILE
, WRITE_SMS
, WRITE_SOCIAL_STREAM
What does that mean for users and their privacy?
This is my main concern here. Unfortunately (one could almost say "as expected"), there was no official statement made on that – or I had already been aware of those changes a while ago. I hope some of our members who happen to be developers as well have deeper insight, and can help us out with some explanations and advice:
- have those groups/permissions simply be removed (or did some simply got renamed/replaced by others)?
- how is the data previously covered by them protected now?
- what are the implications for users and their privacy, and what can we do about it?
- concerning the "do about it": sure there's root, XPosed and Xprivacy (how does the latter cope with those changes?) – but I also mean "the average user" without root here.