Who create permissions in apps

[Android Question]

Who puts the permissions of given app.
- the appstore (automatically or by person who review the code)
- compiler or packaging program when the app is created (they are added automatically if you use relevant classes in your code may by?)
- they are added by the developer on his own and he can add some permission and hide some others if he want to cheat.

Which is the right answer? Its very important because sometimes its needed to install apps not from google play or some other good shop but from somewhere you don't know. Then this app in fact can make things you don't know and make big damage to you.

 

[Hadron]

As I understand it (and while I write software I've never developed for Android, so don't have direct experience) the developer specifies the permissions the app requires.

The app can only use the permissions which are specified, so the developer cannot choose to "hide" permissions. Of course the developer could request permissions which the app doesn't need (some do just through being too lazy to work out which are really needed), and if they then added other features which did use those permissions in an update it would not appear that the permissions have changed. And the permissions which could be useful for malware have legitimate uses in many types of application. So the bottom line is you need to answer "yes" to all three of these questions: "am I happy to accept those permissions for this type of app?", "do I trust the developer?" and "do I trust the site I'm downloading from?". The last question is important because the sort of sites that rip off apps often insert malware into them (it's very common with sites that offer paid apps as free downloads).

Although you are reasonably safe on the big app stores, people have sneaked malicious apps onto those before now. So I'd recommend keeping your eyes open even when using those stores, though the chance of meeting malware on them is small.

A couple of links you might find useful:

System Permissions | Android Developers

http://androidforums.com/android-ap...explained-security-tips-avoiding-malware.html

 

[Davdi]

And you can always email the developer to ask why a permission is required if it doesn't seem relevant to the app. For example; a music player wanting to access your contacts and send text (SMS) messages.
I've done this a few times, and always received an informative response.