Giving Wi-Fi Control to Apps... Seriously??

dcd-graphenediscuss

While reviewing the apps installed on GrapheneOS, I found something very curious. Go to Settings > Apps > Special app access > Wi-Fi control. Look at how many apps are there, and without asking me, they have secured the permission "to turn WiFi on or off, scan and connect to WiFi networks, add or remove networks, or start a local-only hotspot". YIKES!

Here's a short list of apps that have this permission turned ON by default:

Amazon Shopping, Audible, F-Droid
Google Play, Google Maps, Grubhub, Kindle, McDonalds
OneNote, Signal, Toyota, AT&T Visual Voicemail, Walmart, Wendy's

Here's some apps where I DO want it to be able to control Wi-Fi:
In each of these apps, the app needs to turn WiFi off so it can connect directly to the device, configure the device's WiFi so the device can connect to the WiFi network, then enable the phone's WiFi. In the case of the Roborock and myDyson apps, this is probably only needed once for the life of the connected device. For SmartLife, it's needed each time a new smart device would be added to the WiFi network.

MyDyson
SmartLife
Roborock
Zepp (formerly Amazfit): this is needed so the phone can turn on Bluetooth to pair an Amazfit watch

[deleted]

The system is AOSP based. In android there are different types of permissions (runtime etc.) There are also some permissions which are automatically granted even though they are not necessary for an app to run (internet access, sensors...). Nevertheless, in GOS you can turn them off, if you want to. (It would be nice to have a toggle which would deny all specific permissions and one could whitelist only those apps which need them to run :-) )

In the case of special app access be aware of an upstream bug (discussed in couple of topics here) where these special app access permissions might be reset to default after applying the system update.