Android

34884 readers

1 users here now

DROID DOES

Welcome to the Android community on Lemmy. Here you can participate in amazing discussions and events relating to all things Android.

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Rules

1. All posts must be relevant to Android devices/operating system.

2. Posts cannot be illegal or NSFW material.

3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.

4. Non-whitelisted bots will be banned.

5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.

6. Memes are not allowed to be posts, but are allowed in the comments.

7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.

8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.

Community Resources:

founded 3 years ago

MODERATORS

L3s@lemmy.world

Rooki@lemmy.world

L4s@lemmy.world

Google ML Kit's barcode scanner adds the INTERNET permission and sends diagnostics, even in apps with no network code (lemmy.world)

submitted 3 weeks ago by Marcuz@lemmy.world to c/android@lemmy.world

6 comments fedilink hide all child comments

While checking one of my own apps with Exodus Privacy, I noticed it had the INTERNET permission even though the code never touches the network. The culprit turned out to be Google ML Kit's barcode scanning library, which a very popular Flutter QR scanner uses under the hood. It adds INTERNET and ACCESS_NETWORK_STATE through a Google transport library, and sends diagnostic data to Google when the scanner is opened (device model, app version, an install-scoped ID, latencies, error codes). Google documents this, but you'd never guess it from an app that just reads a QR code.

A few things I took away from it:

A "0 trackers" result on Exodus doesn't mean "no network". Check the permission list too.
If an app that should be offline asks for INTERNET, a QR/barcode feature is worth suspecting.
For developers: ZXing-based scanners decode entirely on-device and don't pull any of this in. You can confirm with the merged manifest or the manifest-merger report in your build folder.

Has anyone else run into libraries quietly adding network access like this? Curious which others are common offenders.

you are viewing a single comment's thread
view the rest of the comments

[–] mannycalavera@feddit.uk 6 points 3 weeks ago (4 children)

Aren't you supposed to check your merged manifest before publishing? To catch things like this?

It's all great assuming apps or libraries behave the way you think they ought to behave but as a developer the responsibility is on you to check what you're publishing.

[–] Marcuz@lemmy.world 4 points 3 weeks ago

That's what I did indeed, thanks for the advice!

load more comments (3 replies)