34 lines
1.8 KiB
Plaintext
34 lines
1.8 KiB
Plaintext
|
Permissions that can have a large impact on user privacy, tagged as https://developer.android.com/reference/android/Manifest.permission[dangerous by Android], should be requested only if they are really necessary to implement critical features of an application.
|
||
|
|
|
||
|
|
== Ask Yourself Whether
|
||
|
|
|
||
|
|
* It is not sure that <code>dangerous</code> permissions requested by the application are https://developer.android.com/training/permissions/usage-notes#avoid_requesting_unnecessary_permissions[really necessary].
|
||
|
|
* The users are not https://developer.android.com/training/permissions/usage-notes#be_transparent[clearly informed] why and when dangerous permissions are requested by the application.
|
||
|
|
|
||
|
|
You are at risk if you answered yes to any of those questions.
|
||
|
|
|
||
|
|
== Recommended Secure Coding Practices
|
||
|
|
|
||
|
|
* It is recommended to carefully review all the permissions and to use <code>dangerous</code> ones only if they are really necessary.
|
||
|
|
|
||
|
|
== Sensitive Code Example
|
||
|
|
|
||
|
|
In AndroidManifest.xml:
|
||
|
|
----
|
||
|
|
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" /> <!-- Sensitive -->
|
||
|
|
<uses-permission android:name="android.permission.ACCESS_MEDIA_LOCATION" /> <!-- Sensitive -->
|
||
|
|
----
|
||
|
|
|
||
|
|
== Compliant Solution
|
||
|
|
|
||
|
|
----
|
||
|
|
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> <!-- Compliant -->
|
||
|
|
----
|
||
|
|
|
||
|
|
== See
|
||
|
|
|
||
|
|
* https://www.owasp.org/index.php/Mobile_Top_10_2016-M1-Improper_Platform_Usage[OWASP Mobile Top 10 2016 Category M1] - Improper Platform Usage
|
||
|
|
* https://cwe.mitre.org/data/definitions/250.html[CWE-250] - Execution with Unnecessary Privileges
|
||
|
|
* https://developer.android.com/training/permissions/usage-notes[developer.android.com] - App permissions best practices
|
||
|
|
* https://play.google.com/about/privacy-security-deception/permissions/[Google Play] - Privacy, Security, and Deception - Permissions
|