App manages to know the OTP despite not having SMS permissions

pariahkite

I Installed this app using Aurora Store but did not give it any special permissions. It only had Network and Sensors permissions. It requires registration using a phone number and SMS OTP. So started the registration process and received the SMS notification. The OTP was instantly auto-filled into the app somehow despite the app not having any SMS permissions! What could have happened?

I don't have Google Play services or Google Play installed and I am on the owner profile. I do have Google Play and Google Play services installed in another profile and the latter does have SMS permissions in that profile.

muhomorr

Apps can receive SMS that are tagged with the app's hash without holding any permission. Check the SMS OTP message, it should contain an 11-character alphanumeric sequence.

pariahkite

muhomorr thanks, yes the SMS does have an 11-character hash.

However, I checked the docs for the feature you're referring to, and it says:

Add the Google Play services dependency for the SMS Retriever API

So isn't Google Play services required for this to work?

muhomorr

pariahkite I wasn't referring to the Play services SMS Retriever API. AOSP has a similar API, it's fully independent of Play services. Google does promote the Play services API over the AOSP API.

muhomorr

See the following AOSP commit from 2019: https://github.com/GrapheneOS/platform_frameworks_opt_telephony/commit/fc4452e4f3c1519dd2cd0dc6e1173336c24ea08a