App watcher permissions

anod / AppWatcher

App Watcher for Android helps you to follow updates of applications in Play Store that are not installed currently on your device.

https://play.google.com/store/apps/details?id=com.anod.appwatcher

Other

74 stars 8 forks source link

App watcher permissions #1

Closed Ralf82 closed 12 years ago

Ralf82 commented 12 years ago

Hello, is it possible to subscribe to app update information without using my google account? I don't want to give authenticator access to my google account just to get news about apps.

So, is there another way?

danpecker commented 12 years ago

Hey, that's exactly my question, too. +1

It's open source, however, I am not the one to understand the code. Do you trust the developer and the permissions?

anod commented 12 years ago

No, there is no way to use google market api without authentication

Ralf82 commented 12 years ago

@danpecker: Sorry, I don't know the developer. I heard about this app in this blog and in a forum: http://www.mobiflip.de/app-watcher-fuer-android-prueft-updates-auch-fuer-nicht-installierte-programme/

Most users are still sort of afraid of installing this app. I would pay for such an app, if there is not this permission problem.

@anod: Would it be possible, if the app use one special dummy account for all users.

The problem is not "normal" authentication like other apps demand (for tasks, picasa etc). This app here demands to act itself as an "account authenticator", so it would be the admin of my account ...

edit: This is what other apps demand: "use the authentication credentials of an account Allows the app to request authentication tokens."

Is it not enough?

anod commented 12 years ago

@Ralf82

I think there is confusion in permissions. This permission requests authentication for google account: USE THE AUTHENTICATION CREDENTIALS OF AN ACCOUNT Allows the app to request authentication tokens.

The following permission is used to create Synchronization account for AppWatcher itself, and one of the part of synchronization account is required authentication... It has a dummy implementation and as far as I know it's not possible to create synchronization account without this permission. ACT AS AN ACCOUNT AUTHENTICATOR Allows the app to use the account authenticator capabilities of the AccountManager, including creating accounts and getting and setting their passwords.

I will check again if I can skip this dummy authenitfication.

Ralf82 commented 12 years ago

@anod: For example:

As far as I understand: This task app creates a Synchronization account to sync with Google - without your permissions: https://play.google.com/store/apps/details?id=ch.teamtasks.tasks.paid

Used permissions:

use the authentication credentials of an account Allows the app to request authentication tokens.
write sync settings Allows the app to modify the sync settings, such as whether sync is enabled for the People app.
discover known accounts Allows the app to get the list of accounts known by the tablet. Allows the app to get the list of accounts known by the phone.
read sync statistics Allows the app to read the sync stats; e.g., the history of syncs that have occurred.
read sync settings Allows the app to read the sync settings, such as whether sync is enabled for the People app.

Sounds more specific and trustful?

anod commented 12 years ago

Tasks app is not very correct example because they don't use Accounts & Sync feature for synchronization. They manage synchronization inside application and the app is not listed under Settings -> Accounts & Sync.

Those apps has the same permission: https://play.google.com/store/apps/details?id=org.mots.haxsync https://play.google.com/store/apps/details?id=com.facebook.katana

Ralf82 commented 12 years ago

In fact, Task IS listed under Settings -> Accounts & Sync. It is listed INSIDE my Google account - see last item of this screenshot: http://s1.directupload.net/images/120610/f8tuz82y.png

So like your app the app "Tasks" gets the information from my google account. It's not a stand alone account like Facebook etc.

Maybe this is possible with your app?

anod commented 12 years ago

Nice, it can be a nice solution to remove this permission and move synchronization under one of google accounts

Ralf82 commented 12 years ago

If you could do this, this would be great. Your app will get much more acceptance. People are waiting for such an app ;).

BTW - feature request (not important):

export list as txt to sd card and import (so you have a backup of the list)
mark more than one app after searching in play store

peterbonge commented 12 years ago

@anod Any news about moving sync to an existing Google account?

anod commented 12 years ago

I'm planning to have some time for the app this month

Ralf82 commented 12 years ago

Great to hear from you!

Meanwhile there is an app in competition: https://play.google.com/store/apps/details?id=com.blogspot.jddevelop.android.marketmarks&hl=de

MarketMarks needs less permissions, but more traffic.

Ralf82 commented 12 years ago

Great that you are working on it. :)

Ralf82 commented 12 years ago

Hii,

any news?

anod commented 12 years ago

Updated to use one of existing google accounts for synchronization instead of own synchronization account, and removed permissions.

Ralf82 commented 12 years ago

Hi, fine but: I can not see the update in play store.

Can you help us?

anod commented 12 years ago

Hi,

I need to finish couple of things before release of the new version and just don't have time to do it... May be I will push it like it is now without all planned changes....

Ralf82 commented 12 years ago

Thank you. And looking forward to more changes ... :-)