Android Q permissions bring more privacy, could allow app downgrades

Android Q is set to get some new permissions that should provide users with some more privacy, and revert the background location access changes from Android Oreo.

According to XDA Developers, which obtained an Android Open Source Project (AOSP) version of Android Q, Google’s next big OS update has new permission regarding clipboard access.

Currently, Android allows every app to access your clipboard. It’s a necessary part of the copy and paste function — if an app can’t read your clipboard, you can’t paste anything in that app.

Unfortunately, the other part of this is that apps can read the clipboard in the background. Considering many people likely copy sensitive information like passwords on their phones, that access could be dangerous. It wouldn’t be difficult for a malicious app to scrape that data.

Google hopes to change that behaviour in Android Q with a new ‘read_clipboard_in_background’ permission. Further, that permission carries a ‘signature’ protection level, meaning only apps signed by the OEM can utilize the permission.

Q could allow users to downgrade apps

XDA also spotted two permissions that could be related to downgrading an app. Labelled ‘package_rollback_agent’ and ‘manage_rollbacks,’ the permissions feature protection levels of signature and ‘installer’ on top of signature, respectively.

In other words, only a platform-signed app with the ability to install apps can use these permissions. That means apps like the Google Play Store or other first-party app stores like Samsung’s Galaxy Apps.

Further, the permissions allow these apps to inform an app if it was downgraded, similar to how an app learns it was upgraded.

This could be a potentially useful feature for when an app update has a severe bug. Users could easily roll back to an older, stable version until the developer fixes the app.

Bringing back access to background location

After removing the ability for apps to access location in the background, Google added a new permission in Android Q that will allow an app to access location data in the background. However, the permission comes with a warning for users that reads “app will always have access to the location, even when you’re not using the app.”

There are also new permissions coming that revolve around external storage access. Currently, if you grant an app access to any permission in the external storage permission group, it can read or write any file in the external storage.

Potentially, this could allow apps to access sensitive data stored on your external storage. Android Q hopes to fix this with new permissions that will enable apps to read the locations from your media, access music files, access photos and access videos.

Finally, it looks like Google may move a Play Services permission to AOSP. The permission would allow an app to recognize a user’s physical activity. Currently, this permission is integrated into Play Services, but it has turned up in Android Q.

Android Q already looks to be a sizable release, with several new changes coming. However, while Q may grant some wishes — like a system-wide dark mode — it may also cause some grief with new ways for carriers to lock down the SIM card.

Source: XDA Developers