SMS/Phone permission - is it working?

Kaziq

Hi, I have just installed Telegram and registered for the first time. It asked for SMS permission and then Phone permission to automatically receive the confirmation code. I have answered 'Don't allow' to both prompts, as I wanted to enter the code manually. Then the app showed the code screen, I have pulled down the notifications to read the code, but when I returned to the app it was on the next screen already, and didn't require the code at all.

I can think of only two possibilities: either the app has a bug and skips the code screen if it doesn't have SMS/Phone permission, or GrapheneOS has a bug and gives the app the SMS permission even though I have told it not to.

Afterwards I checked the app permissions in the system, and the Phone permission is 'Not allowed'. There is no SMS permission in the list at all.

What is going on?

other8026

Kaziq Does Google Play Services have the SMS permission?

Kaziq

other8026 It does. I have removed it and will see what an app will do next time.

Rootus I wouldn't use it if I didn't have to. I suppose it's not the safest comms app out there. I have a problem with another app and unfortunately the author provides support via Telegram only.

Rootus

Why to use Telegram? Go with Signal and Molly. Is Telegram safe anyway?

chinook

Rootus "just because". Why not? They clearly needed or wanted it. They didn't talk about privacy, safety or security, they asked question about SMS permission.

Unnecessary proselytism is unnecessary.

Rootus

chinook Apply your logic to yourself. Why not proselytize, especially, if there are safety concerns with the app? I wish Kaziq well so I made the remark. Now we know that Kazimierz is aware of the safety concerns so it's up to him to use it or not.

DeletedUser495

Kaziq author provides support via Telegram only

I believe 99.9% of Play Store apps provide support email in App support section of their Play Store page. I am sure yours too.

other8026

Kaziq so it's working as expected. They are probably using this https://developer.android.com/identity/sms-retriever#receive-verification-messages

Here's a quote:

When a verification message is received on the user's device, Play services explicitly broadcasts to your app a SmsRetriever.SMS_RETRIEVED_ACTION Intent, which contains the text of the message

So, yes, it appears the permission is working as intended.

Kaziq

DeletedUser495 Thank you, I have overlooked that section. I thought the e-mail would be in 'About the app'.

other8026

Rootus I wish Kaziq well

It's good we have community members watching out for one another, but...

Rootus Why not proselytize

Some may feel it's condescending, even if it's not intended that way.

Either way, based on the way Kaziq responded I get the feeling they might not have taken it that way, so I think all is good here.

Kaziq

I found it very slightly condescending, but I'm not easily offended, so it's okay :)
So far I'm stunned at how helpful this community is aiming to be.