[Feedback] IngameDebugConsole.aar require READ_LOGS permission by default

yasirkula / UnityIngameDebugConsole

A uGUI based console to see debug messages and execute commands during gameplay in Unity

MIT License

2.11k stars 221 forks source link

[Feedback] IngameDebugConsole.aar require READ_LOGS permission by default #34

Closed kishi-yama closed 3 years ago

kishi-yama commented 3 years ago

Hi, thank you for your useful assets.

I used this assets in my project, and noticed IngameDebugConsole.aar require READ_LOGS permission which is not recommended for user privacy reason.

Google says in Android API reference as bellow;

Not for use by third-party applications, because Log entries can contain the user's private information.

So I removed IngameDebugConsole.aar by setting Android checkbox off in import settings.

I would like to recommend you that adding remark about permission in README, or making IngameDebugConsole available without READ_LOGS permission by default because it is easy to overlook to remove permission in release build.

yasirkula commented 3 years ago

I don't think it is necessary because:

Apps can access only their logs even with READ_LOGS, other apps' logs are inaccessible (since Android 4.1 and later)
I don't share or store these logs in any way. They are only visible on the debug console for debugging purposes and only when Receive Logcat Logs In Android is enabled
Since it is the user who sees these logs, they will be seeing their own private information. While sharing these logs, they can omit any private information they want
Google Play doesn't warn users about READ_LOGS before installing the app (correct me if I'm wrong), so users won't even notice its existence

kishi-yama commented 3 years ago

Thank you for your clearly answer.

In fact, my app have got rejected from Google Play for above reason. Even thought I didn't need to receive logcat messages, I overlooked to remove READ_LOGS permission. It was my lack of recognition. I thought I would like to share this issue with you just in case, thanks.

yasirkula commented 3 years ago

If it causes app rejections, then it is a serious issue. Thanks for letting me know.

kishi-yama commented 3 years ago

Reject word may have confused you, sorry. It was just get pointed out from google.

LiuOcean commented 3 years ago

From google's replay:

"Hello again, READ_LOGS permission is one of the most critical permissions, so we have to verify that the game is not using the permission. However, we cannot verify this with the screenshots you sent to us. Please remove the permission completely from the game. Feel free to email us if you have any questions."

Adding READ_LOGS will not cause Google to reject the game, but it will cause the game not to be on Google's recommended position.

yasirkula commented 3 years ago

Are you using the latest version of the plugin? I've added android:maxSdkVersion="15" attribute to READ_LOGS permission on December. So the permission has no effect on Android 4.1 and later.

LiuOcean commented 3 years ago

I should be using the last Release version, I just downloaded the latest file under the master branch and unzipped IngameDebugConsole.aar, and in the AndroidManifest.xml file, it seems that maxSdkVersion is still 18.

yasirkula commented 3 years ago

Yeah, sorry I forgot about increasing it to 18. The permission is said to have no effect on Android 4.1 and later, so I don't understand why they are so worried about this permission. I'll remove it from AndroidManifest so that they can stop annoying me and my users with this nonsense.

LiuOcean commented 3 years ago

And thanks for your awesome work.