helloworld1 / AnyMemo

Advanced Spaced Repetition flashcard learning software for Android.
http://www.anymemo.org
GNU General Public License v2.0
151 stars 53 forks source link

Excessive permissions for google drive integration #508

Open expipiplus1 opened 3 years ago

expipiplus1 commented 3 years ago

This app requests three permissions:

The last two seem unnecessary and are a little frightening!

helloworld1 commented 3 years ago

Those are the scope requested: https://github.com/helloworld1/AnyMemo/blob/master/app/src/main/java/org/liberty/android/fantastischmemo/common/AMEnv.java#L50

https://www.googleapis.com/auth/plus.login -> For login https://docs.google.com/feeds/ -> For legacy API listing files, probably not needed anymore https://docs.googleusercontent.com/ -> For legacy API reading files, probably not needed https://spreadsheets.google.com/feeds/ -> For operating spreadsheets. This is the one showing "See, edit, create, delete your spreadsheets in google drive" https://www.googleapis.com/auth/drive.file -> That is the one showing "See, edit, create, delete all google drive files"

We may need to figure out the correct scope to limit the permission.