Is Orbot android TOR client compromised (permissions to device ID and caller information)?

Question

During today's apps update, ORBOT update asks for aditional permissions: a) photo/media/files, and b) Device ID and caller information.

(Android 5.0.1, current ORBOT (pre-update) 15.2.0-RC-8-multi)

Why would an app, with the main purpose of providing anonymity, actively request permission to access Device ID and caller information?

So far I did not allow it and wonder what is more dangerous, using an outdated version, or granting paradoxical permissions...?

Concrete questions:

1. Do others experience the same request (otherwise it would be a hint that my device is compromised)?
2. Does somebody have the chance to analyze file access and network traffic (if encryption allows - might never find out?) and test if and how ORBOT makes use of these permissions : (a) where it sends ID information, (b) what files it wants to read/write that have not been necessary for a long time?
3. Does somebody have an explanation why ORBOT would legitimately need these permissions? Or is there any information if ORBOT app is compromised, ...? Some other (general, not TOR-specific) causes are listed in Falco's answer here, but I cannot believe ORBOT's programmers (thanks!) would accept them (by mistake / lazy&incompetent coding / needed to get access to legitimate functions...)?

Thanks for helping!

Answer 1

Why would an app, with the main purpose of providing anonymity, actively request permission to access Device ID and caller information?

Quoting the Play Store listing: "NEW OPTIONAL PERMISSION: "Write External Storage" and "Read Phone State" need to support Hidden Services backup and background services. No personal data is read, stored or transmitted."

Do others experience the same request (otherwise it would be a hint that my device is compromised)?

They should, since those permissions are in the source tree.

Does somebody have the chance to analyze file access and network traffic (if encryption allows - might never find out?) and test if and how ORBOT makes use of these permissions : (a) where it sends ID information, (b) what files it wants to read/write that have not been necessary for a long time?

If you are concerned as to what Orbot does, review the source code, then build from that source code. You are not required to trust what is delivered via whatever app distribution channel that you are using, nor are you required to make sense of encrypted-by-design network traffic and such.

Does somebody have an explanation why ORBOT would legitimately need these permissions?

See above. My understanding is that they added Tor hidden service support, and for that they needed those permissions.

Since the targetSdkVersion is 25, ideally they should be prompting you for those permissions only if you use functionality in the app that needs them. That's the experience that I get, installing the latest from the Play Store on a Nexus 5X — while the permissions show up in Settings, they have not asked for them, and so do not have them. This is perfectly normal behavior on Android 6.0+.

Answer 2

Thanks for asking and caring. We understand users can be alarmed by new permissions request, and should have done a better job of explaining what they are for.

From here: https://twitter.com/guardianproject/status/873045668369055744

"Orbot asks for new permissions that are only used if you enable the Hidden Service features."

More details are coming. This only really effects you if you are on earlier versions of Android, that don't allow you to "deny" permissions when they are requested.