Android applications, when they are installed from any source other than a local USB cable, will prompt the user with a list of the permissions the application requests via its manifest. The user must agree to allow the application to have those permissions; otherwise, the installation is abandoned.
Some applications will ask for many more permissions than would seem necessary for the application to work. Your average tip calculator, for example, probably does not really need Internet access, or to know where you are via GPS, or to be able to read your device’s contacts.
Why might an application ask for those things?
It could be that it is explicitly malware – something designed to pilfer contacts for spammers, for example.
It could be that the application is displaying ad banners as a form of revenue. The ad network’s software might require Internet access to download ads and send back data about ad behavior…with the user bearing the costs and lost privacy.
It could be that the application is using a so-called “analytics” service. These collect information about individual device owners, such as their location when an application is used, and send it back to a common server. Developers can then learn many details about how their application is used…again, with the user footing the bill, in the form of added data transfer fees, worse battery life, and lost privacy.
If you use an Android device, take a good look at the permissions an application asks for. If you cannot justify in your mind why the application needs those permissions, cancel the installation.
If you write Android applications, understand that each additional permission your application requires is one more barrier to adoption. Try to ask for as few permissions as possible. Since you cannot ask for permissions “on the fly”, this may mean you have two editions of your application: a “lite” one that needs few permissions if any, and a “full” one that does more but requires more permissions.
In particular, though, as a developer, be wary of third-party libraries that require you to grant certain permissions in your Android application in order to use them. Yes, the services those libraries provide may be compelling…but at what cost? If they need Internet access, are you sure you know what information they collect and distribute? Remember: you may be liable if your application is caught violating privacy laws, even if it is not your code causing the violations.
The best answer, short of not using any such library, is to use libraries that are open source and, ideally, send their data solely to a community-managed service. If you can validate what data is collected and sent, and if you have some measure of faith that the data will not be used for privacy-violating purposes, you will be much safer than libraries hidden behind code obfuscation, encrypted packets, and no-reverse-engineering-allowed licenses.
