Question about SD cards, apps, and security

[Android Question]

When an app is installed and has access to your SD card, can that app access anything on the SD card? Photos, etc.

As I understand it the SD cards are a FAT file system which does not allow for file system permissions because they are removable and need to be accessible once inserted into another device. Does this make any data stored on the SD card readable by potentially malicious apps that have access to or are installed on the SD card?

 

[Hadron]

In principle, yes. With Android 4.4 apps can only write to their own areas of the SD card, but can still read from others (on a rooted device there are ways of bypassing the write restriction too). With earlier versions any app could read or write to any part of the SD card.

But bear in mind that most apps store their data in the phone's internal storage rather than a removable sd card, which Google think is really just for media (though users often disagree!). The internal storage will be ext4 format rather than fat32, so finer-grained access control is possible.