r/Android • u/FragmentedChicken Galaxy Z Fold8 • 13h ago

Mishaal Rahman: Apps targeting the next Android release (i.e. Android 18) will no longer be able to directly write to contacts with the WRITE_CONTACTS permission. Here's why that mattersđŸ§”

https://nitter.space/MishaalRahman/status/2115135649875669489
207 Upvotes

90% Upvoted

24 comments sorted by

1

u/PastyPajamas 13h ago

That's cool. I assume the AOSP Contacts app will be updated and will be able to broadly write to contacts? 

1

u/omniuni 13h ago

I'd say that's fairly unlikely. This is a pretty major security hole, and they're providing a clean and much more secure replacement.

1

u/rekh127 7h ago

What does that have to do with the aosp contacts app?

1

u/omniuni 7h ago

Why would AOSP go out of the way to reintroduce a fairly significant security vulnerability that has a perfectly good solution?

1

u/rekh127 7h ago

How does it reintroduce a security vulnerability for a specific app whose whole job is contact management to request the new manage contacts permission?

1

u/_hmj 13h ago

Nice. I hope they also restrict camera permissions. Many apps have camera access just to scan QR codes or barcodes, for which they could rely on the Google Code Scanner instead.

1

u/zunjae 13h ago

I see your point but I don’t like having an app be fully reliant on the play services


Isn’t this why the “one time only” permission exists in android? I can ask permission to use your camera once to scan a QR code

This seems like a better option than a hard dependency on google

1

u/clearlylegallyblind 12h ago

Instead I think:

  • make the qr scanner a part of aosp

  • create a permission that is to scan qr codes so app that's only need camera for scanning codes can rely on the native android system

1

u/_hmj 13h ago

Fair enough! Makes sense

1

u/Maleficus 12h ago

Has been solution for this for like 12+ years. It's called 'Intents', specifically the Camera Intent
https://developer.android.com/media/camera/camera-intents

My guess is that it's not widely used by developers as they don't want users to ever leave their app, even briefly.

1

u/VincentJoshuaET 10h ago

This requires to manually capture a photo though, unlike auto scanning a QR code which is usually the modern implementation

1

u/tadfisher 9h ago

There should be a standard "SCAN_BARCODE" intent or similar so I don't have to bundle MLKit and the barcode scanner lib, or bundle the library that calls out to Play Services to launch the QR scanner. But that ship has basically sailed if it's not available on my lowest supported API target.

1

u/Maleficus 10h ago

For sure it is clunky UX to use Intents for QR scanning feature, but would work well enough. My comment was intended for the parent comment about needing more camera permissions/restrictions more generally rather than QR code scanning specifically.

1

u/zunjae 11h ago

Don’t delete your comment

Send me an app that starts a camera intent for scanning a QR code

1

u/Maleficus 9h ago

Lol so needlessly hostile off the bat there buddy. FYI, I meant to reply to the parent comment, specifically their statement on:

I hope they also restrict camera permissions

Because I actually agree with you that between One-Time Only permissions granting you mentioned, and the Intents functionality I mentioned which removes need to even declare Camera permissions, I don't think we need any further camera permissions. That was the actual point I poorly attempted to make.

As for your app demands, while plenty of QR Code Scanning apps can 'scan from file', it is likely rare for a general purpose QR decoding app to both: not request Camera permission AND use Camera intent rather than file picker intent. Would you like me spend 5mins asking Antigravity to make such an app for you to make a point we both agree on? If so happy have a crack, have wasted more time for less reward before.

1

u/TSPhoenix 2h ago

Isn’t this why the “one time only” permission exists in android?

Yes, but the way revocation of this permission is handled means the users do not know if it has happened or not.

1

u/zunjae 50m ago

Which is totally unrelated to this discussion, but thanks for sharing!

Instruct your AI bot to read more context from this Reddit post

1

u/AbsurdismForTheW 9h ago

Yeah I doubt its about scams, they're just trying to lock out foss alternative apps

1

u/mozilla2012 3h ago

It's becoming clear this is the new Google Way.

Remember when AOSP used to be.... .decent?

1

u/IPv6lovinOpossum 13h ago

What the fuck is this site. Shithole redirected to malware and porn sites when clicking on anything 

1

u/sol-4 4h ago

OP, can you please stop posting deranged websites that redirect to malware and porn? The Twitter nitter idiocy is beyond crazy now. Just don't post stuff from there if you don't like that website instead of redirecting others to malware and porn.