Hello all,

I was looking for a simple(!) ebook reader, and found the below :

https://f-droid.org/en/packages/com.github.axet.bookreader/

Ofcourse, I checked its permissions - which I now have questions about :

"read the contents of your shared storage
Allows the app to read the contents of your shared storage."

Allright, otherwise it can't read any EPUB files.

"modify or delete the contents of your shared storage
Allows the app to write the contents of your shared storage."

No idea why it would need to do that(1).

"read phone status and identity
Allows the app to access the phone features of the device. This permission
allows the app to determine the phone number and device IDs, whether a call
is active, and the remote number connected by a call."

I can make a couple of guesses to why it would need this, but that doesn't
help me in the slightest. Does any one have a (non-guessed) idea to why I
should allow this ?

(1) Assuming that this is needed to store some configuration (last opened
EPUB, position therein), isn't there some per-app protected storage
available ?
I'm not really happy with the idea that that app would be able to muck
around with files that are his.

Remark: My smartphone runs "Graphene OS", which gives a nice indication
about how I appreciate apps which regard my whole smartphone as their
playground.

I did find some other ebook readers, but as those wanted a*lot* of
permissions (including network, so the app builder could gather "statistical
data" - his words, not mine) I discarded them on sight.

Regards,
Rudy Wieser

On 2024-05-27 21:19, R.Wieser wrote:
> Hello all,
>
> I was looking for a simple(!) ebook reader, and found the below :
>
> https://f-droid.org/en/packages/com.github.axet.bookreader/
>
> Ofcourse, I checked its permissions - which I now have questions about :
>
> "read the contents of your shared storage
> Allows the app to read the contents of your shared storage."
>
> Allright, otherwise it can't read any EPUB files.
>
> "modify or delete the contents of your shared storage
> Allows the app to write the contents of your shared storage."
>
> No idea why it would need to do that(1).

Guessing, to write notes per book.

....

Ask them.

--
Cheers, Carlos.

R.Wieser <address@is.invalid> wrote:
> Hello all,
>
> I was looking for a simple(!) ebook reader, and found the below :
>
> https://f-droid.org/en/packages/com.github.axet.bookreader/
>
> Ofcourse, I checked its permissions - which I now have questions about :
>
> "read the contents of your shared storage
> Allows the app to read the contents of your shared storage."
>
> Allright, otherwise it can't read any EPUB files.
>
> "modify or delete the contents of your shared storage
> Allows the app to write the contents of your shared storage."
>
> No idea why it would need to do that(1).
>
> "read phone status and identity
> Allows the app to access the phone features of the device. This permission
> allows the app to determine the phone number and device IDs, whether a call
> is active, and the remote number connected by a call."
>
> I can make a couple of guesses to why it would need this, but that doesn't
> help me in the slightest. Does any one have a (non-guessed) idea to why I
> should allow this ?

This is the manifest file:
https://gitlab.com/axet/android-book-reader/-/blob/master/app/src/main/AndroidManifest.xml?ref_type=heads

which has the read storage permission, but not write or the phone status
permission. Maybe the latter comes from some library it uses?

It appears to be to support API level 9 (Android 2.3.0) while targeting level 30
(Android 11) - maybe there's something about that which drags in additional
permissions (eg maybe separate read and write didn't exist on 2.3?).

Theo

R.Wieser wrote:

> "modify or delete the contents of your shared storage
> Allows the app to write the contents of your shared storage."
>
> No idea why it would need to do that(1).

Annotate, or remove books?

"R.Wieser" <address@is.invalid> wrote:

> Hello all,
>
> I was looking for a simple(!) ebook reader, and found the below :
>
> https://f-droid.org/en/packages/com.github.axet.bookreader/
>
> Ofcourse, I checked its permissions - which I now have questions about :
>
> "read the contents of your shared storage
> Allows the app to read the contents of your shared storage."
>
> Allright, otherwise it can't read any EPUB files.
>
> "modify or delete the contents of your shared storage
> Allows the app to write the contents of your shared storage."

Didn't see Book Reader listed in their apps page at:

https://f-droid.org/en/packages/

The page you gave just lists versions. Did not see any documentation on
the app. Might it allow you to annotate or modify e-books which would
require the write permission? As noted at:

https://raider.pressbooks.pub/otnmodify/chapter/format-guide-epub-mobi/

An EPUF file is a ZIP file with nested folders with XHTML text, images,
CSS, fonts, and metadata files. Even if Book Reader doesn't let you
modify or change the text, replace images, replace fonts, etc, maybe it
still lets you edit the metadata of the .epub file. It notes that
Calibre, the e-book reader I remember using, can "Edit book".

Without any documentation on that app, no one can determine just
features it has other than perhaps another user of the same app. You
could deny the access to see if the app still functions well enough.

> "read phone status and identity
> Allows the app to access the phone features of the device. This permission
> allows the app to determine the phone number and device IDs, whether a call
> is active, and the remote number connected by a call."
>
> I can make a couple of guesses to why it would need this, but that doesn't
> help me in the slightest. Does any one have a (non-guessed) idea to why I
> should allow this ?

Looks like something you have to ask the app author. They don't provide
documentation, so every permission they want is a guess by the user. Or
get someone to look at the code in the APK to see why it wants those
permissions.

The web site has no information to identify the app author. Unless the
APK has doc files inside with contact info on the author, and assuming
the author is responsive or those contacts are still valid, I don't see
how you'll find the app author to get a hell of a lot more info on his
app.

If I started hunting around for an e-book reader to use with Android,
I'd probably start with Calibre. Besides any help they have at their
web site, there are probably a hell of a lot more Calibre users around
to ask for help than those using the app you mentioned. Alas, there is
no native Android app for Calibre. You have to use ADB and a USB cable
to read an e-book on your desktop, so it's a kludge to use Calibre with
Android.

I've heard of ReadEra, FBreader and Librera, but never used them. I've
only need to read e-books on my desktop. Reading on a smartphone screen
for something as large as a "book" would overly strain my old eye, and
have be constantly zooming in and out. Smartphone display really don't
substitute for desktop monitors.

> I did find some other ebook readers, but as those wanted a*lot* of
> permissions (including network, so the app builder could gather
> "statistical data" - his words, not mine) I discarded them on sight.

Some e-book readers let you specify a URL from where to get the EPUB, or
other format, e-book file, so I can see those requiring network access.
For example, my public library has e-books that I can read locally, but
they are retrieved from their server which also manages how long I can
check-out the e-book from them (they have to share a limited number of
licenses amongst all their patrons).

R.Wieser wrote on Mon, 27 May 2024 21:19:04 +0200 :

> https://f-droid.org/en/packages/com.github.axet.bookreader/

To help Rudy Wieser, even as I'm not sure I understand the problem set,
from Windows, I downloaded & installed the v1.15.3 APK onto my Android.
https://f-droid.org/en/packages/com.github.axet.bookreader/
Name: com.github.axet.bookreader_416.apk
Size: 26618987 bytes (25 MiB)
SHA256: 43B3BA5D52B552D2B87ADB2A2DCBE4CC9C8FCB6C528D2BD31FA54DEBE104A843

It opened onto my Android 13 Galaxy without asking me for any permissions.
intent:#Intent;package=com.github.axet.bookreader;component=com.github.axet.bookreader/.activities.MainActivity;end

When I looked at the permissions using the FOSS Muntashirakon App Manager.
https://muntashirakon.github.io/AppManager/en/
The permissions that it obtains automatically appear to be these;
however mine are always automatically revoked, so they're all in red.
<https://i.postimg.cc/nrRnT8wh/permission.jpg>

Revoked: android.permission.POST_NOTIFICATIONS
Allows the app to show notifications

Revoked: android.permission.READ_EXTERNAL_STORAGE
Allows the app to read the contents of your shared storage

Revoked: android.permission.READ_MEDIA_AUDIO
Allows the app to read audio files from your shared storage

Revoked: android.permission.READ_MEDIA_IMAGES
Allows the app to read image files from your shared storage

Revoked: android.permission.READ_MEDIA_VIDEO
Allows the app to read video files from your shared storage

Revoked: android.permission.READ_PHONE_STATE
Allows the app to access the phone features of the device.
This permission allows the app to determine the phone number
and the device IDs, whether a call is active, and the remote
number is connected by a call.

Revoked: android.permission.WRITE_EXTERNAL_STORAGE
Allows the app to write the contents of your shared storage

Now I needed an ebook to test out the program somehow.
<https://www.google.com/search?q=free+ebook+android+for+dummies>

Arbitrarily, I'll take this 1st hit (as I don't care the file).
<https://libgen.is/search.php?&req=android+for+dummies>

To help, I'll arbitrarily download a PDF, a mobi & an epub sample.

PDF:
<https://libgen.is/book/index.php?md5=BE5B8864711EDE687989AF74AD3AE559>
<https://library.lol/main/BE5B8864711EDE687989AF74AD3AE559>
<https://download.library.lol/main/3452000/be5b8864711ede687989af74ad3ae559/Jerome%20DiMarzio%20-%20Android%20Smartphones%20For%20Dummies%20%28For%20Dummies%20%28Computer_tech%29%29-For%20Dummies%20%282022%29.pdf>

MOBI:
<https://libgen.is/book/index.php?md5=83B63DAFDF5C88B97C39CA06F089185B>
<https://library.lol/main/83B63DAFDF5C88B97C39CA06F089185B>
<https://download.library.lol/main/3858000/83b63dafdf5c88b97c39ca06f089185b/Jerome%20DiMarzio%20-%20Android%20Smartphones%20for%20Dummies-For%20Dummies%20%282022%29.mobi>

EPUB:
<https://libgen.is/book/index.php?md5=71C9F7998BA8FC0D0CFCC4A0BC5FA4D2>
<https://library.lol/main/71C9F7998BA8FC0D0CFCC4A0BC5FA4D2>
<https://download.library.lol/main/3112000/71c9f7998ba8fc0d0cfcc4a0bc5fa4d2/Mark%20Hemmings%20-%20Android%20Smartphone%20Photography%20For%20Dummies-For%20Dummies%20%282021%29.epub>

I only tested this momentarily as I never used an ebook reader
on Android before & then deleted the app & the files afterward.

a. The PDF read into the app just fine, without permission issues.
b. The app didn't see the MOBI file (which I found surprising).
c. The epub read into the app just fine, without permission issues.

To test what formats the suggested app could read, I used Calibre
on Windows to convert the books to a dozen ebook reader formats.
<https://calibre-ebook.com/download_windows>
Notably, the AZW3 (Amazon) format was not read in by that reader.

Carlos,

>> "modify or delete the contents of your shared storage
>> Allows the app to write the contents of your shared storage."
>>
>> No idea why it would need to do that(1).
>
> Guessing, to write notes per book.

I guess thats possible. Not something I would expect from a simple ebook
reader though.

> Ask them.

Good one. Alas, their forum is driven by JS (discourse), and as that is
something I've got disabled ...

Regards,
Rudy Wieser

Theo,

> This is the manifest file: [snip]
>
> which has the read storage permission, but not write or the phone
> status permission. Maybe the latter comes from some library it uses?

I was trying to figure out the legit reasons for the permissions. They
could really be needed.

But yes, thats something thats also something to consider. Third parties
which embed stuff neither the app-maker nor the user have asked for.

By the way: that ebook reader program you referred to which only asks for
read permissions - Is there an APK available of it ? Maybe it already does
what I need from it.

Regards,
Rudy Wieser

Andy,

>> "modify or delete the contents of your shared storage
>> Allows the app to write the contents of your shared storage."
>>
>> No idea why it would need to do that(1).
>
> Annotate, or remove books?

I did not consider the former (which is possible, but not expected of a
simple reader), but was thinking of the latter too.

But in that case, why would it need access to the *whole* shared storage,
and not an app-specific data subfolder ?

.... I just realized I should also take a peek at what the Graphene OS
considers to be "shared storage", and how it (possibly) can help curb
over-zealous (or just not quite trusted) apps.

Regards,
Rudy Wieser

Andrew,

> The permissions that it obtains automatically appear to be these;
> however mine are always automatically revoked, so they're all in red.

Interresting. Though I have a problem with grasping how
"READ_EXTERNAL_STORAGE" doesn't superceede the "READ_MEDIA_*" permissions.

I can understand those READ_MEDIA_* permissions though. EPUB books are just
HTML files zipped up.

Thanks for the testing. It looks like the app does have all its (major)
permissions listed.

Question : what do you have running (OS, apps) that all those permissions
are automatically revoked ?

Regards,
Rudy Wieser

R.Wieser wrote on Tue, 28 May 2024 10:21:05 +0200 :

> Interresting. Though I have a problem with grasping how
> "READ_EXTERNAL_STORAGE" doesn't superceede the "READ_MEDIA_*" permissions.

I admit I'm confused about the permissions myself for that app.
<https://f-droid.org/en/packages/com.github.axet.bookreader/>

Hence I suggest you test yours using the Muntashirakon App Manager.
<https://f-droid.org/en/packages/io.github.muntashirakon.AppManager/>

See if your permissions for that app look like mine (Galaxy, Android 13).
<https://i.postimg.cc/nrRnT8wh/permission.jpg>

> I can understand those READ_MEDIA_* permissions though. EPUB books are just
> HTML files zipped up.

I'm not sure how the app is working with all those permissions revoked.
Also I'm not sure why the app doesn't even *ask* me for any permissions.

> Thanks for the testing. It looks like the app does have all its (major)
> permissions listed.

My suggestion is you install Muntashirakon App Manager and let us know if
you're seeing the same thing I'm seeing, which is that it has no
permissions and yet, the app still has no problem reading PDFs & EPUBs.

> Question : what do you have running (OS, apps) that all those permissions
> are automatically revoked ?

My Galaxy Android 13 isn't rooted so it's the normal Android operating
system, so I'm not really sure why all those permissions are revoked.

When you run the Muntashirakon App Manager on that Book Reader app,
do you see the same (red) "dangerous permissions" blocked that I did?

Andrew,

>> I can understand those READ_MEDIA_* permissions though. EPUB books are
>> just HTML files zipped up.
>
> I'm not sure how the app is working with all those permissions revoked.

Just think of those MEDIA thingies as resources loaded by a webpage. Block
them, and only the text will be there. Which, for the ebooks I'm reading,
isn't a problem.

> Also I'm not sure why the app doesn't even *ask* me for any permissions.

It probably tries to, but its request gets blocked (your app manager?)
before it reaches the OS (which would than show the permissions dialogs).

> My suggestion is you install Muntashirakon App Manager

I'm first going to see if the Graphene OS already has that covered. I just
found something about "storage scopes".

Still no idea why it needs that "read phone status and identity" permission
though. Lets hope it will work with it blocked.

Ah... I just realized it /could/ be to freeze sounds and/or movies inside
an ebook when a call comes in. Though in that case that permission is *way*
to broad.

Regards,
Rudy Wieser

R.Wieser <address@is.invalid> wrote:
> Theo,
>
> > This is the manifest file: [snip]
> >
> > which has the read storage permission, but not write or the phone
> > status permission. Maybe the latter comes from some library it uses?
>
> I was trying to figure out the legit reasons for the permissions. They
> could really be needed.
>
> But yes, thats something thats also something to consider. Third parties
> which embed stuff neither the app-maker nor the user have asked for.
>
> By the way: that ebook reader program you referred to which only asks for
> read permissions - Is there an APK available of it ? Maybe it already does
> what I need from it.

That is the app you downloaded. If you go to F-droid and download the
sources tarball for this app you'll find they match the ones I linked to (it
was easier to link to upstream sources on Gitlab than a tarball)

Theo

On 2024-05-28 09:23, R.Wieser wrote:
> Carlos,
>
>>> "modify or delete the contents of your shared storage
>>> Allows the app to write the contents of your shared storage."
>>>
>>> No idea why it would need to do that(1).
>>
>> Guessing, to write notes per book.
>
> I guess thats possible. Not something I would expect from a simple ebook
> reader though.

My hardware ebook reader does it.

>
>> Ask them.
>
> Good one. Alas, their forum is driven by JS (discourse), and as that is
> something I've got disabled ...

No comment.

--
Cheers, Carlos.

R.Wieser wrote on Tue, 28 May 2024 12:24:05 +0200 :

>> I'm not sure how the app is working with all those permissions revoked.
>
> Just think of those MEDIA thingies as resources loaded by a webpage. Block
> them, and only the text will be there. Which, for the ebooks I'm reading,
> isn't a problem.

I'm not sure what was happening, but it may be important to note that I
downloaded the epub files from Windows and merely copied them to the
sdcard, where, without asking for permissions, the epub reader found them.

>> Also I'm not sure why the app doesn't even *ask* me for any permissions.
>
> It probably tries to, but its request gets blocked (your app manager?)
> before it reaches the OS (which would than show the permissions dialogs).

I don't know. There was no request for permissions, and yet, the epub
reader found the EPUB & PDF files on a folder on my external sdcard.

>> My suggestion is you install Muntashirakon App Manager
>
> I'm first going to see if the Graphene OS already has that covered. I just
> found something about "storage scopes".
>
> Still no idea why it needs that "read phone status and identity" permission
> though. Lets hope it will work with it blocked.
>
> Ah... I just realized it /could/ be to freeze sounds and/or movies inside
> an ebook when a call comes in. Though in that case that permission is *way*
> to broad.

It was odd that no permissions were ever requested, but that's why I would
like others to test it out as maybe it's just the way my Android is set up.

Andrew,

> I'm not sure what was happening, but it may be important to note that I
> downloaded the epub files from Windows and merely copied them to the
> sdcard,

Pretty-much the same here, though I copied them to internal memory - though
into a folder I created for it.

> where, without asking for permissions, the epub reader found them.

In my case I have to select "open file" from the hamburger menu and find the
file itself. There does not seem to be a way to point it to a specific
folder (or if there is I've not found it yet).

> It was odd that no permissions were ever requested, but that's why I would
> like others to test it out as maybe it's just the way my Android is set
> up.

I did not see any permission dialog either, but the images and sounds where
automatically disabled. Sensors where enabled though. In the end I
disabled everything (just to see what would happen).

The most strange (to me) thing is that no *file* permissions where asked,
and although I enabled something called a "storage scope" for the app and
pointed it to a specific folder and files in it, the reader has zero
problems with opening text and html files from other folders. Quite
unexpected.

Regards,
Rudy Wieser

On 2024-05-28 13:37, Andrew wrote:
> R.Wieser wrote on Tue, 28 May 2024 12:24:05 +0200 :
>
>>> I'm not sure how the app is working with all those permissions revoked.
>>
>> Just think of those MEDIA thingies as resources loaded by a webpage. Block
>> them, and only the text will be there. Which, for the ebooks I'm reading,
>> isn't a problem.
>
> I'm not sure what was happening, but it may be important to note that I
> downloaded the epub files from Windows and merely copied them to the
> sdcard, where, without asking for permissions, the epub reader found them.
>
>>> Also I'm not sure why the app doesn't even *ask* me for any permissions.
>>
>> It probably tries to, but its request gets blocked (your app manager?)
>> before it reaches the OS (which would than show the permissions dialogs).
>
> I don't know. There was no request for permissions, and yet, the epub
> reader found the EPUB & PDF files on a folder on my external sdcard.
>
>>> My suggestion is you install Muntashirakon App Manager
>>
>> I'm first going to see if the Graphene OS already has that covered. I just
>> found something about "storage scopes".
>>
>> Still no idea why it needs that "read phone status and identity" permission
>> though. Lets hope it will work with it blocked.
>>
>> Ah... I just realized it /could/ be to freeze sounds and/or movies inside
>> an ebook when a call comes in. Though in that case that permission is *way*
>> to broad.
>
> It was odd that no permissions were ever requested, but that's why I would
> like others to test it out as maybe it's just the way my Android is set up.

Did you try to make annotations?

If it has dictionary, did you use it?

--
Cheers, Carlos.

Carlos,.

> Did you try to make annotations?
>
> If it has dictionary, did you use it?

Why are you thinking that the app offers either ?

Regards,
Rudy Wieser

>> Did you try to make annotations?
>>
>> If it has dictionary, did you use it?
>
> Why are you thinking that the app offers either ?

I just checked, but can't find any indication of a possibility to either.

It gives me the feeling that the requested alter-and-delete permission is
bogus, something that is there because it cannot be seperated from the read
permission.

Regards,
Rudy Wieser

R.Wieser wrote:

> It gives me the feeling that the requested alter-and-delete permission is
> bogus, something that is there because it cannot be seperated from the read
> permission.

If I remember correctly, there is/was an oddity about permissions and
their their grouping, if an app asks you to grant one permission from a
particular group, it can later "grant itself" additional permissions
from that same group, without you having to agree ...

R.Wieser wrote on Tue, 28 May 2024 17:31:25 +0200 :

> It gives me the feeling that the requested alter-and-delete permission is
> bogus, something that is there because it cannot be seperated from the read
> permission.

I manipulate my Android phone from Windows so I was using a mouse when I
just now ran the test below to see what the Book Reader can 'edit'.

In the com.github.axet.bookreader Book Reader, I long pressed on a word
inside an EPUB/PDF to find you can do a bunch of "edits" to the selection.

a. You can stretch both sides of the selection to select more words.
b. Icon 1of4 highlights the selection (where with my mouse buttons
I was able to change both the transparency & the highlight color).
c. Icon 2of4 brings up the Android sharing menu.
d. Icon 3of4 copies the selected set into your Android clipboard.
e. Icon 4of4 unselects the selected set.
f. The hamburger menu allows you to change the fonts in the book
where you can also set the font size based on a slider setting.

Notably, I didn't find a "save" button in the Book Reader.
But when I exited the Book Reader & came back, the larger fonts were saved.

The hamburger menu seems to change depending on the action context.

R.Wieser wrote on Tue, 28 May 2024 16:23:08 +0200 :

>> Did you try to make annotations?
>> If it has dictionary, did you use it?
>
> Why are you thinking that the app offers either ?

The one thing I'd like in an ebook reader is for it to speak the words.
That would entail some kind of Text-to-Speech (TTS) engine I would think.

When I looked at the com.github.axet.bookreader Book Reader, I was
pleasantly surprised there are a ton of seemingly hidden menu features!

One of them is TTS!

a. Open the book to any given page in Book Reader.
b. The hamburger menu changes to the following
Bookmarks, Font, TTS, Open File, Settings, About
c. Tap on "TTS" and a four-part menu shows up.
leftarrow, rightarrow, playarrow & X

The left/right arrows seem to jump to the next word.
The TTS play is weird. It will play an entire selected set.
Otherwise, it plays phrases as it creates its own subsequent selected sets.

The point being there are more (hidden) features when you look deeper.

R.Wieser wrote on Tue, 28 May 2024 14:21:28 +0200 :

>> where, without asking for permissions, the epub reader found them.
>
> In my case I have to select "open file" from the hamburger menu and find the
> file itself. There does not seem to be a way to point it to a specific
> folder (or if there is I've not found it yet).

In my Android 13 Galaxy, I had simply copied the EPUB/PDF files into a
folder on the sdcard that I had created from Windows and then I used the
aforementioned com.github.axet.bookreader Book Reader's top-right
"Hamburger -> Open File" menu's file manager to find the two epubs.

The Book Reader includes its own "file manager", I think.
Once a book was found, it shows up in the white space of the Book Reader.
From then on, it can be clicked without using the Book Reader file picker.

The Book Reader has the option to set a "Sync Folder" but I never set it.

>> It was odd that no permissions were ever requested, but that's why I would
>> like others to test it out as maybe it's just the way my Android is set
>> up.
>
> I did not see any permission dialog either, but the images and sounds where
> automatically disabled. Sensors where enabled though. In the end I
> disabled everything (just to see what would happen).

The EPUB/PDF books that I had tested didn't have sounds, but certainly
those books contained images, which showed up in the Book Reader just fine.

If you have a pointer to a link where I can download an EPUB/PDF with
sounds, I can test that out for you. But you need to provide the link.

> The most strange (to me) thing is that no *file* permissions where asked,
> and although I enabled something called a "storage scope" for the app and
> pointed it to a specific folder and files in it, the reader has zero
> problems with opening text and html files from other folders. Quite
> unexpected.

I'm gonna agree that I don't understand three things about file
permissions, one of which was the com.github.axet.bookreader Book Reader
didn't ask for any.

The second was that the Muntashirakon App Manager showed that there were 7
"Uses permissions" displayed in red, as if they've been denied somehow?
<https://i.postimg.cc/nrRnT8wh/permission.jpg>

POST_NOTIFICATIONS
READ_EXTERNAL_STORAGE
READ_MEDIA_AUDIO
READ_MEDIA_IMAGES
READ_MEDIA_VIDEO
READ_PHONE_STATE
WRITE_EXTERNAL_STORAGE

And the third was that Muntashirakon App Manager showed that the
com.github.axet.bookreader Book Reader's "Permissions" tab showed
"No permissions required" even though the Book Reader was clearly reading
epub/pdf files off of the file system.

If someone else can check that, we can confirm my results are normal.

Andy Burns wrote on Tue, 28 May 2024 17:37:34 +0100 :

> If I remember correctly, there is/was an oddity about permissions and
> their their grouping, if an app asks you to grant one permission from a
> particular group, it can later "grant itself" additional permissions
> from that same group, without you having to agree...

Personally, I admit I never understood how Android does permissions.

To see how other similar apps handled permissions, I arbitrarily installed
*Cool Reader* by Vadim Lopatin with In-app purchases
free,adfree,gsf_req,rated 3.9 star, 265K reviews, 10M+ Downloads
<https://play.google.com/store/apps/details?id=org.coolreader>

Unlike com.github.axet.bookreader Book Reader, Cool Reader asked for
permissions as it required them (i.e., when I opened an epub using it).

In the Muntashirakon "Uses Permissions" tab, it looks very different.
<https://github.com/MuntashirAkon/AppManager>

Cool Reader:
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADVERTISE
android.permission.BLUETOOTH_CONNECT
android.permission.BLUETOOTH_SCAN
android.permission.FOREGROUND_SERVICE
android.permission.INTERNET
android.permission.POST_NOTIFICATIONS
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_MEDIA_AUDIO
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_VIDEO
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
android.permission.WRITE_EXTERNAL_STORAGE
com.android.vending.BILLING

Yet, in the Muntashirakon "Permissions" tab, there's only one item.
com.google.android.gms.auth.api.signin.permission.REVOCATION_NOTIFICATION
Note that I have com.android.vending.BILLING disabled, so my phone
is incapable of processing billing (which turns out to be a nice way
to legitimately get payware apps for free, I found out accidentally).

Andrew wrote:

> Personally, I admit I never understood how Android does permissions.
>
> To see how other similar apps handled permissions, I arbitrarily installed
> Cool Reader
> Unlike com.github.axet.bookreader Book Reader, Cool Reader asked for
> permissions as it required them (i.e., when I opened an epub using it).
>
> In the Muntashirakon "Uses Permissions" tab, it looks very different.

The "old" way was that the manifest file listed perms required, and you
agreed to them at install-time, except there were some perms that apps
got "for free", i think the android version that an app is targetted to
can change the perms it needs/gets, there's a lot of history ...

Then runtime perms came along, which offer you the
grant/grant-while-running-this-app/deny options, I prefer those.

I think the "new" way means (for example if an e-reader app did need to
write annotations back to file) that it would only need to request write
permission if a user actually used the annotation feature ...