Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop doing stuff or making noise or the like.

However, it also provides an application with your IMEI, phone number, and remote number (number of inbound or outbound calls). This allows a lot of personal information collection, all under the guise of "my weather app needs to know when you're on the phone so it doesn't interfere with calls".

Why is knowing someone is on a call even a special permission? Certainly phone calls are still common enough to warrant providing a permission-free API that all apps can use to not bother a user in-call.

Why would Android hide such a powerful permission that allows detailed personal identification and cross-user tracking behind something that seems so innocuous? It only serves to get users in the habit of allowing permissions and accepting excuses from app developers.

share|improve this question

1 Answer 1

One specific piece of data you can access with the "Phone State" permission is the IMEI/IMSI of your phone/sim card. This number is used to identify your device for target-ads (so the ad provider could tell whether you've already seen an ad). Since showing ads is a common business model in mobile apps, the "Phone State" permission being requested is as well very common. I think it's a logical decision (from an economic point of view) of Google to group this ability with other, somehow similar abilities so users won't be scared of permissions that could obviously harm their privacy. It's definitely possible to give the ability to detect whether the user is on call without a special permission, but that would go against Android's policy of requiring explicit permissions for everything that gets beyond the local concerns of an app.

share|improve this answer
2  
Right, that's the question. It'd be an intentional malicious move by Android/Google. Also, since there's next to no privacy impact in viewing phone is on/off, why would there be a permission for that? –  MichaelGG Apr 3 at 20:40
    
@MichaelGG public static boolean isPhoneOn() {return true;} I know this isn't what you meant but I couldn't resist. –  immibis Apr 3 at 22:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.