The Android documentation on Permission Groups states that
If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same permission group, the system immediately grants the permission without any interaction with the user. For example, if an app had previously requested and been granted the READ_CONTACTS permission, and it then requests WRITE_CONTACTS, the system immediately grants that permission.
Isn't this a security risk? Reading contacts so the app lets me share something with friends is less risky than altering existing contacts, which can be maliciously used, for example, to change every contact's email address to something resembling the original email, but actually leading to the attacker's account, which can continue forwarding the email exchange, unbeknownst to both parties.
The documentation emphasizes the point farther below:
Once again, the system just tells the user what permission groups the app needs, not the individual permissions
Again, a Yelp-like app should be allowed to call a business, or an ordering app can legitimately place a call to the delivery person, but that means the app can also silently read the user's private call logs and send them to whatever adware is bundled with it, since INTERNET is a normal permission that doesn't require user consent. Call logs to certain numbers can be used as basis for blackmailing the user, or (probably more commonly) can serve as very valuable information for advertisers to figure out the user's demographic profile and social network.
The user's convenience (i.e. not bugging the user too much, in Android M's runtime permissions system) seems like a weak reason. Legit apps without a reason to read the call log, won't ask for the permission, so all of the choices below will only ask the user once, but have different security results:
- "Can this app make a phone call" (individual permission)
- "Can this app access the phone, redirect outgoing calls (!), and read your contacts list" (current group permission with accurate wording, but unnecessarily scary as most apps will only make calls)
- "Allow [this app] to make and manage phone calls" (wording for group permission in Android M, unnecessarily vague)
Are there good reasons why permissions don't need to be more granular?