How to be safe, find trusted apps, & avoid viruses - A guide for those new to Android

[papy72]

I have one question about the security features: how does that list get populated? does the DEVELOPER create that list, or does the OS (based on the code) do it.

I ask because I have an app that backs up it's data to the SD card but the "needs SD card access" was never shown to me when installing it.

 

[Big Cam]

I thought of myself as a pretty safe android user but after reading this I think I'm going to double check a few apps.

 

[alostpacket]

I have one question about the security features: how does that list get populated? does the DEVELOPER create that list, or does the OS (based on the code) do it.

I ask because I have an app that backs up it's data to the SD card but the "needs SD card access" was never shown to me when installing it.

The "write to SD card" permission came in Android 1.6 or 2.0 (I forget which but I'm sure it was one of them). This means the permission was automatically given to any app 1.5 and prior. So if you have a phone with Android 1.5 (like the Droid Eris) you wont see this permission being requested.


The way the permission system works is that an app gets no permissions by default. It must "request" them in a file (called the manifest) bundled with the app. This is how the market knows to warn you about what permissions the app will need and also how the OS knows what permissions to grant the app. If no permissions are requested in the manifest, the OS will not grant the app any.

Hope that helps clear it up.


Edit: I should also mention that I *think* that apps *might* be allowed to write to the SD card for their own data but the SD card permission relates to apps reading and writing to other files not created by the app. I'll have to double check on that for you and will post back.

 

[alostpacket]

I thought of myself as a pretty safe android user but after reading this I think I'm going to double check a few apps.

Diligence is always good, but I actually feel very safe too. I hope that point got across in the guide. That I think apps are generally very safe, but a few good habits of checking the comments and permissions never hurts.

 

[papy72]

Thanks for the info. I am running a moto droid so I'm still unsure why I didn't get the SD security message, but I am satisfied that an app can't access the net without me first approving it.

 

[qwiksilver711]

Fantastic writeup!! Should be a sticky

 

[jameshunt]

great post! very helpful and informative :happy:

 

[zooyork]

real nice break down..

 

[alostpacket]

Thanks for the kind words all -- sorry for the necro I should drop in more often to chat

I'm working on an updated version of this too so hopefully this month I'll post the updates.

 

[debdroid1a]

Thank you!
Very well written and very informative.

 

[alostpacket]

Updated this to the most recent version, sorry I was lax about getting you guys the update to this guide!