2

A recent update to the Android app somehow bypasses the need for granting the contacts permission to sign in via Google. How was this done?

ME

  • I suspect that you already gave them permission in a previous version of the app. – Robert Harvey Oct 10 '16 at 15:13
  • @RobertHarvey I disabled the permissions and reinstalled just to test that. What's more, the app specifically mentions that they've bypassed this in the What's new section on the play store. – Dan Brown Oct 10 '16 at 15:15
  • 1
    You're misreading. It's not bypassing anything. It says it will no longer ask you for unnecessary permissions. Meaning it no longer asks because it doesn't need that permission for Google sign-in. Newer versions of Android only require you to grant permission the first time the app tries to use it, not at install time. If you never hit a point where the app needs to use it, then it never asks for it. – animuson Oct 10 '16 at 15:40
  • @animuson I removed the old version, Installed the new version, ensured app permissions had been reset, and it did not ask. Look up at my question too, It actually is the point of the update (wait one sec) – Dan Brown Oct 10 '16 at 15:42
  • Again, you've completely misread everything. The point of the update was to make it so Google sign-in didn't require the permission because it wasn't necessary. We're not magically gaining the permission without your consent, we're simply not using it. – animuson Oct 10 '16 at 15:43
  • @animuson It also needs the storage permission (nothing new) which i did have to regrant. – Dan Brown Oct 10 '16 at 15:45
  • As would be expected, because it needs that permission in order to do pretty much anything. If at any point the app ever does anything that requires access to your Contacts, then it will ask you to grant it at that time. Until then, it won't ask because there's no point in granting an app permission it's not using. – animuson Oct 10 '16 at 15:46
  • @animuson what, after a complete removal of an app? With the permissions disabled?? – Dan Brown Oct 10 '16 at 15:48
  • Yes, that's how Android works now. It now asks you to grant permissions as an app attempts to use them. This change was made a long time ago. Our app is not attempting to use your Contacts and therefore you are not asked about it. This is Android core functionality and is not specific to our app. – animuson Oct 10 '16 at 15:50
  • 1
    But why isn't it asking for permission to use features it doesn't use? – Won't Oct 10 '16 at 15:51
  • @animuson Yes, but in previous versions, the contacts permission was asked for. The recent update phased this out. The question is how they did that, especially since this is the only thing the update was for (alongside other bug fixes) – Dan Brown Oct 10 '16 at 15:52
5

We migrated over from using an older version of the Google Sign In SDK to the newest version. That's it.

In the past, we used to ask for the permission which would let us access the Android OS's logged in account's Google account. We no longer use this, and instead rely entirely on the Google Sign In SDK. It's not a bypass, it's just that the new SDK doesn't require us to have or ask for that extra permission.

Here is some more info on Google Sign In, if you're interested: https://developers.google.com/identity/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .