The Android app just prompted for an update and it shows that it needs a new permission to see phone call stuff. Why would that be necessary for this app?

What other permissions does the app require, and why?


1 Answer 1


Required Permission

  1. Modify or delete file contents of your USB storage

    We use this to cache data onto your phone's external storage (normally an SD card) per Google's standards

  2. Full network access

    This one's pretty obvious. We need to access the internet.

  3. Access your contacts

    If you're running Android Marshmallow (6.0) or above, and you attempt to login or register via Google, we use Marshmallow's new permission flow to request access to your accounts. This is described as "Allow Stack Exchange to access your contacts?" in the pop-up. We use this to retrieve a list of Google accounts enabled on your device, so that we can log you in using the one of your choosing.

    There is a new Google Login SDK that will allow us to not require this permission (instead of you telling the SDK which Google account of the user you want to authorize, it takes care of letting the user decide that on their own [or defaulting to an account if there's only one enabled]) but it requires significant back-end modifications to work for us, if/when we switch over to it this permission will be removed.

    This permission was added in version 1.0.76, before this version users on Android Marshmallow were not able to login using their Google accounts at all.

  4. Retrieve running apps

    We use this to check the installation status of Facebook on your phone, to provide that login option or hide it completely. We also use this to bring up a list of applications when you try to open a question or answer in the browser that doesn't include ourselves.

    This permission was removed in version 1.0.2.

  5. Read phone status and identity

    As AI E pointed out in the comments, this is a terrifyingly scary message for a very common requirement. Without this permission we can't access any unique identifier for your device which throws off both our internal analytics and those from our partners (Quantcast, same company used for analytics on the websites). Without this even more basic analytics are questionable.

    Using the phone status permission lets us look at number of unique installs without relying on Google's dashboard for it, it also lets us know if multiple people are using one device, be able to tell the session length for each user in that scenario, etc.

    This permission was removed in version 1.0.2.

We also use some more minor permissions which the Play Store actually hides from you unless you ask for them, they are:

  1. Read contents of your USB storage

    Without this we can't read the cached data we write using the counterpart permission.

  2. Retrieve data from the Internet, view network connections

    Without this we can't check if the phone is connected to the internet before trying to retrieve something, leading to a crash.

  3. Control vibration, prevent phone from sleeping

    These are both required for our notifications and for Google's built-in push notification system.

  4. Find accounts on the device

    This is to give you one-tap login when using your phone's Google account to login to Stack Exchange.

If you have any questions or concerns about any of these permissions, please let me know. I wouldn't want to use an app that was doing something weird with my phone either.

  • Minor 4., "Find accounts on the device", seems obsolete to me. One tap may be nice (if you use Google; I don't, can you share numbers?), but does it really justify this permission?
    – Raphael
    Commented Jan 28, 2014 at 8:03
  • 4
    @Raphael I do :) Commented Jan 28, 2014 at 8:52
  • Yeah, again a badly named permission I guess. Commented Jan 28, 2014 at 11:28
  • What's up with the 'Read Google Play Services configuration' permission? Is that a by-product of the 'Access Accounts' permission?
    – REJH
    Commented Jan 28, 2014 at 14:03
  • @REJH "Read google service configuration" is the same permission as the "Find accounts on the device" one, it's just Google's verbose description of what that same permission does. Commented Jan 28, 2014 at 19:06
  • 4
    prevent phone from sleeping is really not cool for the battery. I am surprised this would be required for GCM. (also, if the app crashes when trying to reach the internet when it is not connected, there is a flaw in the conception. Post your stacktrace, I'm sure we can work this out.)
    – njzk2
    Commented Jan 29, 2014 at 19:41
  • @Raphael I'm exclusively using Google OpenID for SE. The implementation that requires the permission is much better than the workaround they'd have to do otherwise.
    – user98085
    Commented Jan 30, 2014 at 16:11
  • 1
    @FEichinger What, you having to enter your ID manually? That's presumably what everybody else does, so I don't follow. Where I stand, protecting data of everybody outweighs a little comfort for some.
    – Raphael
    Commented Jan 30, 2014 at 16:24
  • 1
    @Raphael the majority of logins using the application have been using Google login. In fact, it's a big negative in the minds of the Google Play's team if we don't use Google login and not having it reduces our chances of every getting the application featured. Commented Jan 31, 2014 at 17:00
  • "System tools: test access to protected storage". From the order you've listed them (and the fact that it's the only one not accounted for) I guess this is the "Read contents of your USB storage" you listed? But it doesn't sound the same at all. Can you explain? Commented Feb 14, 2014 at 9:25
  • For some clarification: 1) the permission to prevent phone from sleeping isn't eating battery. Wrong use of it is :) As for find accounts: it doesn't access the accounts, just lists up available account-handlers. While this doesn't give away any credentials, admittedly this might be a concern towards privacy (which services does the device owner use?). If it were for SE only: fine with me, I trust them enough for that. Unfortunately, I don't trust those 3rd parties for analytics & ads at all, which get access to that as well. So I'm with @Raphael here.
    – Izzy
    Commented Mar 4, 2014 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .