Claims by a reddit user

FreakyFreddy

on a discussion on reddit a user wrote:

Many third parties apps can get around android permissions setting due to its open source. Meta can still use data in the backgroud even the background data toggle is turned off. There is another app can still see my pictures without permission. And I don't know how many of them can do that.

If you use FCM, Google can still see the contents of most apps.

i imagine the FCM comment can be somewhat true if an app sends unencrypted push notifications

but he didn't provide any evidence for any of these claims, so is it safe to assume he's wrong? (At least when it comes to graphene i guess)

raccoondad

FreakyFreddy but he didn't provide any evidence for any of these claims, so is it safe to assume he's wrong?

People can do this thing online called "lying"

fid03

FreakyFreddy Many third parties apps can get around android permissions setting due to its open source. Meta can still use data in the backgroud even the background data toggle is turned off.

It's not clear to me which toggle they're referring to.

It sounds like they're expecting a toggle that completely prevents any and all sending of data in the background. I cannot find anything in the Android developer documentation about a data exfiltration toggle. It's quite transparent that such a toggle doesn't exist.

As to the claim that third-party apps get around the standard Android permission toggles – such as Location and Contacts – no evidence for that has been presented. The statement that it has any relevance to code being open doesn't make any sense.

FreakyFreddy There is another app can still see my pictures without permission.

Not clear what they're observing that makes them think that. It's a common misconception that the Android photo picker gives an app access to view all your photos without having given the app Photos or Storage permissions. For example, when I want to upload a photo to a chat in Discord, Discord will trigger the Android photo picker, letting me select the specific ones I want to upload. But Discord only gets to view the photos that I specifically select and confirm it to view, not my entire photo collection.

https://developer.android.com/training/data-storage/shared/photo-picker

FreakyFreddy If you use FCM, Google can still see the contents of most apps.

Again, not clear what they're referring to by contents of apps, and not clear how they think this is supposed to work.

Generally, when coming across types of claims like these, extraordinary claims provided without evidence, I just ignore them and move on. If they don't substantiate their claims it's usually safe to assume that they don't know what they're talking about. Or I will sometimes research the statements to find out if they're right. If they are asked to substantiate, justify and provide evidence for their claims, and they don't do that, it's even more safe to assume that they don't know what they're talking about.

Byku

FreakyFreddy Many third parties apps can get around android permissions setting due to its open source.

BS. What does open source have to do with anything he describes?

FreakyFreddy Meta can still use data in the backgroud even the background data toggle is turned off.

This is true though. Background data toggle is not a privacy feature but a bandwidth saving feature. It only works under certain conditions: Data Saver is on, you are on an metered network etc.

FreakyFreddy There is another app can still see my pictures without permission. And I don't know how many of them can do that.

I think he is confusing photo picker interface with apps being able to see pictures.

FreakyFreddy If you use FCM, Google can still see the contents of most apps.

It can see the contents of push notification if it's being sent unencrypted as plain text. Otherwise it can see push notification being delivered to this specific app ID. Apps can opt to send empty push notifications like Signal does.

littlerack

FreakyFreddy is it safe to assume he's wrong?

Its definitely safe to assume that user knows nothing about anything he/she is talking about (unless it's on purpose) even on high level, most likely is subject to conspiracies and is just dumb to open one's mouth instead of thinking first, before making all those allegations about AOSP.
That happens, don't consume and spread trash, try to use your brain, like to assess "it's open-source thus it's by default easy to trick it" nonsense.

DeletedUser633

Idk, ask him.

router99

raccoondad your comment doesn't mean he is wrong, either. It's my hope he is wrong, but I have noticed oddities myself, even with the permissions disabled for Instagram in a separate profile.

monozygote

I had some doubts around something like this (sans all the open source nonsense) about the technical working of Android system.

I thought that system picker was like a one time read/write grant to the app and the permission dies with the app - ie closing the app releases the permission so next time when the app is started again it'll not have access to the said files/dirs and must ask the user again via system file picker.

Then I found out that the apps can ask the OS for takePersistableUriPermission for the content uri that was shared with them and for such a grant OS doesn't flag anything to the user, which if true is a bit surprising to me because it's silently happening without the user being involved.

That grant will persist across reboots etc and the only reliable way to get rid of it is to uninstall -> reinstall the app.

So net-net, I thought that the only way an app permanently has access to a standard files/dirs or document provider's files/dirs was via explicit access permissions which you can then fine tune with GOS's storage-scopes AND you can easily alter/revoke whenever (eg. from app's profile settings), BUT when accessing via system-file-picker that permission is only transient so nothing to alter/revoke. Turns out this is NOT the case (correct me if wrong ofc) and the content-uri permission granted this way can be silently permanent (takePersistableUriPermission) without user involvement and difficult/impossible to alter/revoke without uninstall/reinstall dance.

littlerack

monozygote are you an Android apps developer?

monozygote

littlerack

are you an Android apps developer?

No, but a software dev in general - I mostly know nothing about android - just reading stuff here and there and forums like these.

monozygote

Ofc I understand that if it was a file/dir "written" by the app then that app will always have access to it, but didn't realise that it can be the case of read-only operations too - eg. if FB is given a content uri of a dir via system-file-picker, it can (via the post just above) have permanent/future access to that dir (and thus any new/old files there) across app-sessions and even reboots.

Would be happy (and relieved) to know if that's wrong ^^^ but can't find much.

littlerack

monozygote so should you maybe ask first from knowledgeable users instead of making claims and (unintentionally) support spread of nonsense like in OP? Cheese...

monozygote

littlerack

so should you maybe ask first from knowledgeable users

I'm asking though:

[...] correct me if wrong ofc
[...] Would be happy (and relieved) to know if that's wrong ^^^ but can't find much.

and I consider many forum users here to be knowledgeable.

But yeah you are right, I should have made it a separate post and asked for confirmation of this OS <-> app behaviour more explicitly.

monozygote

I've created a topic here now: https://discuss.grapheneos.org/d/31297-is-app-access-to-filesdirs-via-system-file-picker-permanent-and-unalterable.

Happy to have my posts removed from this thread now as it was more of a hijack than in relation to what the OP was on about.

schklom

Many third parties apps can get around android permissions setting due to its open source. Meta can still use data in the backgroud even the background data toggle is turned off.

AFAIK (not an expert, just amateur), FCM sends a wakeup call with the notification content to apps that register for it.
I believe Background data is about Internet, not about a connection to other apps. So Meta is not relying on a workaround, since what they do is the normal way to do things in Android.

There is another app can still see my pictures without permission.

Why not name the app, or give a link to it, or a video? I can also claim things without any evidence: the Earth is flat, are you convinced?

is it safe to assume he's wrong?

Big claims require more than zero evidence, so yes, assume he's wrong.

secrec

FreakyFreddy He's justifying his position by saying "due to its open source". Aside from being grammatically incorrect, being open source has no relevance at all to the statement he is making.

He's also probably not even aware of what "background data" means. For instance, a message being sent through FCM, seems like "background" data, but its not even being transferred through that application. Probably just getting confused because he expects that without background data, how can it receive data to launch a notification? There's also something called a "foreground service" which gets around background data restrictions by running the "background" thread in a mode that Android recognizes as "foreground". Yes, its kind of a cheat, but its understood what it means and how it impacts things, so its not subversive.

Some application can see his pictures without permission. Maybe its asking some other application for the pictures? Maybe its getting those pictures via network instead of from local? Not enough explanation is supplied to address that at all.

Plus, you got this on "Reddit". Not exactly known as the ultimate source of high quality information.

FreakyFreddy

Thanks for the replies everyone

I don't know all the intricacies of Android so its reassuring to get so much feedback