During today's apps update, ORBOT update asks for aditional permissions: a) photo/media/files, and b) Device ID and caller information.
(Android 5.0.1, current ORBOT (pre-update) 15.2.0-RC-8-multi)
Why would an app, with the main purpose of providing anonymity, actively request permission to access Device ID and caller information?
So far I did not allow it and wonder what is more dangerous, using an outdated version, or granting paradoxical permissions...?
- Do others experience the same request (otherwise it would be a hint that my device is compromised)?
- Does somebody have the chance to analyze file access and network traffic (if encryption allows - might never find out?) and test if and how ORBOT makes use of these permissions : (a) where it sends ID information, (b) what files it wants to read/write that have not been necessary for a long time?
- Does somebody have an explanation why ORBOT would legitimately need these permissions? Or is there any information if ORBOT app is compromised, ...? Some other (general, not TOR-specific) causes are listed in Falco's answer here, but I cannot believe ORBOT's programmers (thanks!) would accept them (by mistake / lazy&incompetent coding / needed to get access to legitimate functions...)?
Thanks for helping!