R.Wieser, 2024-06-24 09:39:

[...]> The end result ? Especially with privacy related permission I
don't allow
> what I do not see any need for and can be done differently. Which, for this
> case, I explained that several days back.

Well - if a keyboard app offers to use the names of your contacts as
word suggestion, this can not be done differently.

But feel free to ask someone to fork the app and create a version which
does not have the contact name integration and thus doesn't need contact
access either.

Also keep in mind, that the permission is not active by default when
installing the app and you can manually disable it as well.

[...]
>> I also repeatetly suggested *not* to trust me blindly but to ask someone
>> else
>> who is able to understand the source code of Heliboard
>
> I do not have anyone in my neighbourhood who could, or even wanted to do
> that. They just install the stuff and trust it into high-heaven.

Then don't use the app and look for something else since you don't
believe anyone anyway.

--
Arno Welzel
https://arnowelzel.de

Andy Burns, 2024-06-24 12:56:

> Arno Welzel wrote:
>
>> Andy Burns wrote:
>>
>>> Do their lists of dumped permissions correspond with f-droid's list or
>>> the list from aapt2?
>>
>> Yes - see for yourself:
>>
>> <https://f-droid.org/en/packages/helium314.keyboard/>
>
> I did look, which is why I asked ... the f-droid list is not identical
> to the aapt2 list.

It is! Don't get confused by the naming of the permissions. There are 6
permissions - both listed in F-Droid and PMX.

--
Arno Welzel
https://arnowelzel.de

Arno Welzel wrote:

> Don't get confused by the naming of the permissions.

A good reason for f-droid to be consistent in providing them *all* in
recognisable android.permission.XXXXX_YYYYY_ZZZZZ format, as well as
their "cuddly" interpretation ...

Andrew,

> We'd need more data which is why the best way to answer your question
> is for you (or anyone else who is curious to obtain that answer) to
> install
> the app & test it and then let us know what it reported.

Kiddo, its really you. *You* do not understand something, and than *we*
need more data.

Newsflash kiddo, *we* don't. *You* do.

And than you refuse to "let us know what it reported" when you installed it
yourself, but are telling/demanding from us to copy your (alledged) work AND
THAN REPORT WITH IT BACK TO YOU ?

Why ? You already have that report, so why would you need our copy of it ?
What would our reports tell you what yours doesn't ?

Ah, you have no idea ? Yeah, why am I not surprised

Ofcourse, there are, rather obvious, reasons why our reports could well be
different from yours. The fact that you nonetheless ask for them means
that, nonwithstanding your years mucking around with technology, you do not
understand much about basic science.

But, just keep telling people who give you a correct answer but one which
doesn't align with your preconceptions that they didn't understand the
question (yes, I read some posts in your other "Tell me how-and-why I'm
right" thread too). You do not need people who honestly answer your
question, you just need "Yes men". And that means you will stay (a
special kind of) stupid.

Than again, maybe all you are out for is to declare yourself to be smarter
than everybody else, because your questions are *so good* that nobody
understands them. Who knows.

Regards,
Rudy Wieser

Arno,

> Well - if a keyboard app offers to use the names of your contacts
> as word suggestion, this can not be done differently.

You're stuck on a technological solution where a simpler one already exists.

Do you have a pet ? Are you going to put its name in that contacts list
too ? If not, how /do/ you get its name in that exclusion list ?

And yes, I already mentioned that earlier in this thread.

> But feel free to ask someone to fork the app and create a version which
> does not have the contact name integration and thus doesn't need contact
> access either.

Or do the more obvious, and look for an already existing app which doesn't
require it. And IIRC, I alread mentioned one.

> Then don't use the app and look for something else since you don't
> believe anyone anyway.

I *thought* we had a discussion about a permission and how its easily a
privacy risk. I guess I was wrong.

I also tried to explain how my trust needs to be of another, higher level
than yours and how your 'trust' (being able to inspect and understand the
sourcecode) looks to be anything but. For some reason you had little to
say to that.

I think we should end this thread.

Regards,
Rudy Wieser

R.Wieser, 2024-06-27 10:53:

> Arno,
[...]
>> Then don't use the app and look for something else since you don't
>> believe anyone anyway.
>
> I *thought* we had a discussion about a permission and how its easily a
> privacy risk. I guess I was wrong.

No - that's just asbout privacy risks. If an app does have permission
you don't like, then don't use it. What's the problem with that?

> I think we should end this thread.

Indeed. Next time just do not ask why an app may ask for certain
permissions - just don't use it, instead of starting lengthy discussions
about that.

--
Arno Welzel
https://arnowelzel.de

R.Wieser wrote on Thu, 27 Jun 2024 10:28:47 +0200 :

>> We'd need more data which is why the best way to answer your question
>> is for you (or anyone else who is curious to obtain that answer) to
>> install
>> the app & test it and then let us know what it reported.
>
> Kiddo, its really you. *You* do not understand something, and than *we*
> need more data.

I installed the app. I posted a screenshot of the results. You did neither.

If you don't know how to use Android enough to install an app and post the
screenshot when you ask what the app reports, then that's the end of it.

It's your issue that you can't do the simplest things on Android; not mine.

Andy Burns wrote on Thu, 27 Jun 2024 08:52:49 +0100 :

>> Don't get confused by the naming of the permissions.
>
> A good reason for f-droid to be consistent in providing them *all* in
> recognisable android.permission.XXXXX_YYYYY_ZZZZZ format, as well as
> their "cuddly" interpretation ...

I agree with both Arno (that they're all there on F-Droid -only scattered)
and with Andy (that F-Droid made some of them cuddly, which is confusing).

Luckily, more than one tool can be used to reporter permissions on an app;
however, most require the app APK to already be installed on Android.

The tools Arno & Andy are discussing I think can be used BEFORE the APKs
are installed (such as the F-Droid description and the output from ).
<https://developer.android.com/tools/aapt2>

I have Android Studio installed from years ago, but I couldn't figure out
how to install aapt2 so I gave up at this point below in the maven repo.
<https://maven.google.com/web/index.html?q=aa#com.android.tools.build:aapt2>
<https://maven.google.com/web/index.html?q=aa#com.android.tools.build:aapt2:8.6.0-alpha08-11315950>

It's simpler to use permission-reporting tools AFTER the APK is installed.
1. PMX
<https://f-droid.org/de/packages/com.mirfatif.permissionmanagerx/>

2. Permission Manager
<https://github.com/YourStreet/android-permission-manager>
<https://play.google.com/store/apps/details?id=in.yourstreet.permissionmanager>
(I have this installed but I don't see an APK there anymore.)

3. Muntashirakon App Manager
<https://github.com/MuntashirAkon/AppManager/releases>

If someone can explain how to install aapt2 to run on an APK,
let me know; otherwise I'll stick with the three tools above.

Andrew wrote:

> It's simpler to use permission-reporting tools AFTER the APK is installed.

There's a problem with that approach (though not applicable in this
instance)

if you install an app which has both READ_CONTACTS permission and
INTERNET permission, by the time you've checked the permissions, your
entire contact list is already circulating in
China/Russia/Somethingistan ...

Andy Burns, 2024-06-28 10:54:

> Andrew wrote:
>
>> It's simpler to use permission-reporting tools AFTER the APK is installed.
>
> There's a problem with that approach (though not applicable in this
> instance)
>
> if you install an app which has both READ_CONTACTS permission and
> INTERNET permission, by the time you've checked the permissions, your
> entire contact list is already circulating in
> China/Russia/Somethingistan ...

No, since the app has to be started first. An app will not get started
automatically just because you have installed it.

--
Arno Welzel
https://arnowelzel.de

On 29/06/2024 10:23, Arno Welzel wrote:
> Andy Burns, 2024-06-28 10:54:
>
>> Andrew wrote:
>>
>>> It's simpler to use permission-reporting tools AFTER the APK is installed.
>>
>> There's a problem with that approach (though not applicable in this
>> instance)
>>
>> if you install an app which has both READ_CONTACTS permission and
>> INTERNET permission, by the time you've checked the permissions, your
>> entire contact list is already circulating in
>> China/Russia/Somethingistan ...
>
> No, since the app has to be started first. An app will not get started
> automatically just because you have installed it.

if it installs a service it will ...

Andy Burns, 2024-06-29 11:33:

> On 29/06/2024 10:23, Arno Welzel wrote:
>> Andy Burns, 2024-06-28 10:54:
>>
>>> Andrew wrote:
>>>
>>>> It's simpler to use permission-reporting tools AFTER the APK is installed.
>>>
>>> There's a problem with that approach (though not applicable in this
>>> instance)
>>>
>>> if you install an app which has both READ_CONTACTS permission and
>>> INTERNET permission, by the time you've checked the permissions, your
>>> entire contact list is already circulating in
>>> China/Russia/Somethingistan ...
>>
>> No, since the app has to be started first. An app will not get started
>> automatically just because you have installed it.
>
> if it installs a service it will ...

No, not even a service will start automatically. The app must be invoked
by the user once in any case.

Only when the app has a android.intent.action.BOOT_COMPLETED intent
filter (and the respective permission to recieve this event), it may use
this to start a service automatically when you *reboot* your device. But
just installing something will *never* automatically start it.

--
Arno Welzel
https://arnowelzel.de

Andy Burns wrote on Fri, 28 Jun 2024 09:54:12 +0100 :

>> It's simpler to use permission-reporting tools AFTER the APK is installed.
>
> There's a problem with that approach (though not applicable in this
> instance)
>
> if you install an app which has both READ_CONTACTS permission and
> INTERNET permission, by the time you've checked the permissions, your
> entire contact list is already circulating in
> China/Russia/Somethingistan ...

Thanks for that warning, which I fully agree with you is the problem of
checking permissions *after* the app is installed - as it can do harm.

As you're aware, I'm different from most people though, in that I have
already long ago put in place an amelioration procedure for that problem.

What I do is I make sure the default contacts sqlite database is populated
with garbage, which is easily done using various tools that do that for me.
Fake Contacts
Create fake phone contacts, for data-poisoning.
<https://f-droid.org/en/packages/me.billdietrich.fake_contacts/>

Of course, once I abandoned the employment of the default sqlite contacts
database, I had to rely upon only the best of the SMS/MMS & phone apps
which can import/export my "real" personal contacts vcard VCF files.

I'm sure you and Arno understand what I said above, but I'd wager that only
one out of a million Android owners would understand a word I said above.

Arno Welzel wrote on Sun, 30 Jun 2024 10:03:41 +0200 :

>>>> if you install an app which has both READ_CONTACTS permission and
>>>> INTERNET permission, by the time you've checked the permissions, your
>>>> entire contact list is already circulating in
>>>> China/Russia/Somethingistan ...
>>>
>>> No, since the app has to be started first. An app will not get started
>>> automatically just because you have installed it.
>>
>> if it installs a service it will ...
>
> No, not even a service will start automatically. The app must be invoked
> by the user once in any case.
>
> Only when the app has a android.intent.action.BOOT_COMPLETED intent
> filter (and the respective permission to recieve this event), it may use
> this to start a service automatically when you *reboot* your device. But
> just installing something will *never* automatically start it.

I defer to Arno's and Andy's experience (the "A's" on this ng are stellar!)
however - I will state a test I ran which shocked me when I ran it.

1. Make sure you know EXACTLY what is in your contacts database
(e.g., put a test entry that is unambiguously brand new).

2. Make sure you do NOT have a Google Account (or any account) set up
on the phone (where the Google Account is the culprit here).

3. Then, install the Google GMail app, and simply run it the first time
(i.e., log into the GMail app to get your IMAP-stored email messages).

Guess what just happened.

Exactly what Andy said would happen.

By default, you got NO SAY in what would happen to your contacts.
You can *change* the default after the fact - but the damage is done.

Google, by default, did two very lousy things in my tests of this.
1. Google unilaterally *created* an account on the Android phone!
2. Google unilaterally *uploaded* your sqlite contacts db to that account!

Of course, after that happens, you can then modify the Google Gmail app to
NOT upload your contacts - but it's already too late by that time period.

Just as Andy said it would be.

Andrew, 2024-07-04 07:12:

> Arno Welzel wrote on Sun, 30 Jun 2024 10:03:41 +0200 :
>
>>>>> if you install an app which has both READ_CONTACTS permission and
>>>>> INTERNET permission, by the time you've checked the permissions, your
>>>>> entire contact list is already circulating in
>>>>> China/Russia/Somethingistan ...
>>>>
>>>> No, since the app has to be started first. An app will not get started
>>>> automatically just because you have installed it.
>>>
>>> if it installs a service it will ...
>>
>> No, not even a service will start automatically. The app must be invoked
>> by the user once in any case.
>>
>> Only when the app has a android.intent.action.BOOT_COMPLETED intent
>> filter (and the respective permission to recieve this event), it may use
>> this to start a service automatically when you *reboot* your device. But
>> just installing something will *never* automatically start it.
>
> I defer to Arno's and Andy's experience (the "A's" on this ng are stellar!)
> however - I will state a test I ran which shocked me when I ran it.
>
> 1. Make sure you know EXACTLY what is in your contacts database
> (e.g., put a test entry that is unambiguously brand new).
>
> 2. Make sure you do NOT have a Google Account (or any account) set up
> on the phone (where the Google Account is the culprit here).
>
> 3. Then, install the Google GMail app, and simply run it the first time
> (i.e., log into the GMail app to get your IMAP-stored email messages).
>
> Guess what just happened.

Better: do NOT RUN it without checking its permissions first!

> Exactly what Andy said would happen.
>
> By default, you got NO SAY in what would happen to your contacts.
> You can *change* the default after the fact - but the damage is done.

Yes, because you just did what many users do - install an app and run it
without giving a shit, what will happen then.

Also see here:

<https://play.google.com/store/apps/details?id=com.google.android.gm&hl=en>

Click on "See details" in the "Data safety" box:

<https://play.google.com/store/apps/datasafety?id=com.google.android.gm&hl=en>

So why is it surprising for you?

> Google, by default, did two very lousy things in my tests of this.
> 1. Google unilaterally *created* an account on the Android phone!
> 2. Google unilaterally *uploaded* your sqlite contacts db to that account!

Yes, because you use a phone with Google services and use an app from
Google on it. Why does this surprise you? The normal way to use an
Android phone with Google services is to use a Google Account on it.

If you don't want to have this, use LineageOS *without* any Google
services (these are not included in LineageOS) and use F-Droid as the
source for apps. This works in many cases. Only if you need banking apps
or payment this is usually not suitable. But even for LineageOS you can
install one of the GApps-Packages or maybe even a Google Play Services
replacement may work for some Banking apps.

--
Arno Welzel
https://arnowelzel.de