<story><title>Permissions asked for by Uber Android app</title><url>http://www.gironsec.com/blog/2014/11/what-the-hell-uber-uncool-bro/</url></story><parent_chain><item><author>andymcsherry</author><text>There&amp;#x27;s perfectly reasonable explanation for almost all of these permissions, and there&amp;#x27;s nothing in this analysis that suggests they&amp;#x27;re doing otherwise.  The only one that I couldn&amp;#x27;t think of was WRITE_SETTINGS&lt;p&gt;Permissions&lt;p&gt;ACCESS_COARSE_LOCATION &amp;amp;  ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up&lt;p&gt;ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET:  They need to figure out if you have internet and use it&lt;p&gt;WAKE_LOCK: Keep the network running so you can get real-time updates about your driver&lt;p&gt;GET_ACCOUNTS, USE_CREDENTIALS, MANAGE_ACCOUNTS:  For logging in with Google&lt;p&gt;CAMERA: You can take a picture of your credit card for easier entry&lt;p&gt;CALL_PHONE: So you can call your driver&lt;p&gt;MANAGE_ACCOUNTS: So they can add your uber account to your phone&lt;p&gt;READ_CONTACTS: Probably for inviting friends or splitting ride costs&lt;p&gt;READ_PHONE_STATE: Legacy analytics reasons&lt;p&gt;WRITE_EXTERNAL_STORAGE: Probably unnecessary, but they are probably just storing data&lt;p&gt;VIBRATE: For notifications&lt;p&gt;The rest are for push notifications&lt;p&gt;As far as the roottools, I know Crashlytics checks for root so they can provide that data in their console for crashes.  It&amp;#x27;s a pretty useful thing to be able to weed crashes from rooted devices out.  They usually make very little sense and violate the advertised behavior of the SDK.</text></item></parent_chain><comment><author>Aissen</author><text>So, let me disagree with a few of those:&lt;p&gt;- CAMERA: there&amp;#x27;s an intent for that, you don&amp;#x27;t need the permission, although it will require tapping the &amp;quot;take a photo&amp;quot; and &amp;quot;ok&amp;quot; buttons&lt;p&gt;- CALL_PHONE: ditto, although it will require tapping the dial button.&lt;p&gt;- READ_CONTACTS: again, there&amp;#x27;s an intent for that, allowing you to select only the contacts you want to share with the app.&lt;p&gt;- READ_PHONE_STATE: either they want to be compatible with a very old version of Android, or they want to uniquely identify your phone, permanently. They might also want to know who you&amp;#x27;re calling or who&amp;#x27;s calling you in real time&lt;p&gt;Regarding MANAGE_ACCOUNTS, etc: some apps do that, and it seems to be all the rage. Unless you have multiple apps sharing a common account, I don&amp;#x27;t see the point. It&amp;#x27;s just leaks all your configured accounts on the device.</text></comment>
<story><title>Permissions asked for by Uber Android app</title><url>http://www.gironsec.com/blog/2014/11/what-the-hell-uber-uncool-bro/</url></story><parent_chain><item><author>andymcsherry</author><text>There&amp;#x27;s perfectly reasonable explanation for almost all of these permissions, and there&amp;#x27;s nothing in this analysis that suggests they&amp;#x27;re doing otherwise.  The only one that I couldn&amp;#x27;t think of was WRITE_SETTINGS&lt;p&gt;Permissions&lt;p&gt;ACCESS_COARSE_LOCATION &amp;amp;  ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up&lt;p&gt;ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET:  They need to figure out if you have internet and use it&lt;p&gt;WAKE_LOCK: Keep the network running so you can get real-time updates about your driver&lt;p&gt;GET_ACCOUNTS, USE_CREDENTIALS, MANAGE_ACCOUNTS:  For logging in with Google&lt;p&gt;CAMERA: You can take a picture of your credit card for easier entry&lt;p&gt;CALL_PHONE: So you can call your driver&lt;p&gt;MANAGE_ACCOUNTS: So they can add your uber account to your phone&lt;p&gt;READ_CONTACTS: Probably for inviting friends or splitting ride costs&lt;p&gt;READ_PHONE_STATE: Legacy analytics reasons&lt;p&gt;WRITE_EXTERNAL_STORAGE: Probably unnecessary, but they are probably just storing data&lt;p&gt;VIBRATE: For notifications&lt;p&gt;The rest are for push notifications&lt;p&gt;As far as the roottools, I know Crashlytics checks for root so they can provide that data in their console for crashes.  It&amp;#x27;s a pretty useful thing to be able to weed crashes from rooted devices out.  They usually make very little sense and violate the advertised behavior of the SDK.</text></item></parent_chain><comment><author>MarkMc</author><text>Side note: Wouldn&amp;#x27;t it be good if Google required all apps to explain why each permission is necessary, similar to this?</text></comment>