Unexpected permission detected: OTHER_SENSORS

woddahSehT

I get this message (not 1:1 but kinda) from fdroid now, every time I do an update on any app.
Is that normal?
Because this is a new occurrence on my device.
So it's at least not normal to me.

rustybird

https://gitlab.com/fdroid/fdroidclient/-/issues/2914

matchboxbananasynergy

As can be seen on the issue linked above, this is in no way specific to GrapheneOS as F-Droid members initially try to claim there, and this happens with the POST_NOTIFICATIONS permission too, which comes from Android.

They initially broke automatic updates due to this, and now show this confusing toast notification.

I have personally explained this along with the POST_NOTIFICATIONS example to their team, which hopefully was the reason they stopped breaking automatic updates, but they should fix this toast notification, too.

Perhaps they will now that they've been convinced once again that it has nothing to do with GrapheneOS.

Watermelon

matchboxbananasynergy I think the issue stems from them (non-seriously) considering it a security issue that the repository claims an app has X permissions but the app actually requests X+Y permissions. This is very stupid because Android doesn't grant (dangerous) permissions at install-time anymore like ancient Android versions, and shouldn't they verify the checksum of the package or the signing key anyway? That's a stupid security warning and it's not really done for security because they clearly don't care about how confusing it appears to users who don't know what the warning and all the permissions stuff means.

EDIT: Also it's hypocrisy that they claim GrapheneOS implemented the Sensors permission improperly when they're the ones who're notorious for implementing their app improperly.

Watermelon

Watermelon I read the linked issue again and noticed that one of the F-Droid developers mentioned more than once that the user should be informed if the repository lies about an app's permissions. Can anyone think of a reason why that'd make sense security-wise? If a repository isn't to be trusted, one shouldn't install any app from it at all, because malware can still abuse its permissions or exploit the OS to escape the sandbox, or just mistreat the data that it handles within the app even without excessive access. And if it is to be trusted, then why do users need to be "informed" in case the repository "lies" about the app's permissions?