To many permissions

Eatmyshorts

When I download a app from sandboxed playstore and click permissions and go to all permissions i t shows "other app capabilities" with way more capabilities for example signal has permissions to access contacts, precise location, disable your screen lock and a bunch more. Why would a app like signal need all that and does it mean it automatically has access to all of that?

Xtreix

Eatmyshorts Its informations on authorizations are misleading and should normally be rewritten.

Eatmyshorts for example signal has permissions to access contacts, precise location, disable your screen lock and a bunch more.

No, Signal has access to contacts, location etc. only if you specifically grant it these accesses, just revoke these accesses in the app settings, use contact scopes and storage scopes and it will be extended to microphone, camera, location and more once GrapheneOS has been ported to Android 16, which will soon be the case, experimental versions on Android 16 are available. Disable your screen lock probably refers to the ability to unlock Signal via your fingerprint, but this would need to be confirmed.

GrapheneOS

Eatmyshorts You're misunderstanding how Android's permission model works. That shows a list of what the app is capable of requesting, not what is required to use the app. It doesn't get access to those things based on installing it. You would need to explicitly grant access to permission groups for Contacts, Location, etc. for the app to have access to them. Most of those permissions are grouped into the standard permission groups. Others are handled by special access permission toggles, where all the sensitive ones are off by default. Many are handled with case-by-case requests for consent such as Bluetooth pairing. Others are handled by the battery optimization mode (Restricted vs. default of Optimized vs. Unrestricted). There are ones considered not at all sensitive like vibration or requesting info that's available another way anyway. It's quite pointless to look at the list of everything the app is capable of requesting when that's not how stuff is granted to an app.

Eatmyshorts

Xtreix But why does it say all of those permissions when you click all permissions? Cause Instagram had something with "send messages without owners knowledge" and a lot more that damn near makes it look like a RAT

SgtSurehand

Eatmyshorts these are requested, not granted permissions. Permissions with user facing toggles can be revoked.

GrapheneOS

SgtSurehand All of the standard permission groups are disabled by default. There's no need to revoke them, they're already disabled by default. All of the sensitive special access permission groups are disabled by default too. The low level permission request definitions are grouped into these. Others require case-by-case consent. Only the most non-sensitive ones don't have either an off-by-default toggle or case-by-case consent system. Some of the most sensitive ones have multiple layers, such as the permission for installing/updating apps requiring the user to go to a page and grant it rather than doing it via a dialog and then each installation requiring approval along with updates only avoiding requiring approval in addition to the toggle when the app is the current installer already.

fid02

It's really confusing users that Android doesn't explain what the "All permissions" screen for apps actually list. You're excused for not understanding that it's a list of permissions that the app declares that it can request and/or will use, and not permissions that the app currently has access to on your device.