[tor-bugs] #24796 [Applications/Tor Browser]: Review all requested and required Android permissions

[Tor Bug Tracker & Wiki]

#24796: Review all requested and required Android permissions
--------------------------------------+-----------------------------------
 Reporter:  sysrqb                    |          Owner:  tbb-team
     Type:  task                      |         Status:  needs_information
 Priority:  High                      |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:  tbb-mobile                |  Actual Points:
Parent ID:  #26531                    |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+-----------------------------------

Comment (by sysrqb):

 The permissions requested by Fennec (base) are reasonably reduced, but
 GeckoView still requests many permissions we do not want. Currently
 GeckoView's manifest
 (`mobile/android/geckoview/src/main/AndroidManifest.xml`) is not
 preprocessed, so we'll need to comment-out most of the same permissions as
 we ifdef-out in Fennec's permissions.

 {{{
 $ grep -n -e feature -e permission obj-arm-linux-
 androideabi/gradle/build/mobile/android/app/intermediates/manifests/full/officialWithoutGeckoBinariesNoMinApiPhoton/debug/AndroidManifest.xml
 3:  <uses-permission
 android:name="android.permission.ACCESS_NETWORK_STATE"/>
 4:  <uses-permission android:name="android.permission.INTERNET"/>
 5:  <uses-permission
 android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
 6:  <uses-permission
 android:name="android.permission.READ_EXTERNAL_STORAGE"/>
 7:  <uses-permission
 android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
 8:  <uses-permission
 android:name="com.android.launcher.permission.INSTALL_SHORTCUT"/>
 9:  <uses-permission
 android:name="com.android.launcher.permission.UNINSTALL_SHORTCUT"/>
 10:  <uses-permission
 android:name="com.android.browser.permission.READ_HISTORY_BOOKMARKS"/>
 11:  <uses-permission android:name="android.permission.WAKE_LOCK"/>
 12:  <uses-permission android:name="android.permission.VIBRATE"/>
 13:  <uses-feature android:name="android.hardware.touchscreen"/>
 14:  <uses-permission
 android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
 15:  <uses-feature android:required="true"
 android:glEsVersion="0x00020000"/>
 16:  <uses-permission
 android:name="android.permission.CHANGE_WIFI_STATE"/>
 17:  <uses-permission
 android:name="android.permission.ACCESS_WIFI_STATE"/>
 18:  <uses-permission
 android:name="android.permission.ACCESS_COARSE_LOCATION"/>
 19:  <uses-permission
 android:name="android.permission.ACCESS_FINE_LOCATION"/>
 20:  <uses-feature android:required="false"
 android:name="android.hardware.location"/>
 21:  <uses-feature android:required="false"
 android:name="android.hardware.location.gps"/>
 22:  <uses-permission android:name="android.permission.CAMERA"/>
 23:  <uses-feature android:required="false"
 android:name="android.hardware.camera"/>
 24:  <uses-feature android:required="false"
 android:name="android.hardware.camera.autofocus"/>
 25:  <uses-permission android:name="android.permission.RECORD_AUDIO"/>
 26:  <uses-feature android:required="false"
 android:name="android.hardware.audio.low_latency"/>
 27:  <uses-feature android:required="false"
 android:name="android.hardware.microphone"/>
 28:  <uses-feature android:required="false"
 android:name="android.hardware.camera.any"/>
 }}}


 All Permissions for Tor Browser for Android - as described by Android:
 {{{
 Camera:
 take pictures and videos

 Location:
 access approximate location (network-basesd)
 access precise location (GPS and network-based)

 Microphone:
 record audio

 Storage:
 read the contents of your USB storage
 modify or delete the contents of your USB storage


 Other:
 view network connections
 have full network access
 run at startup
 install shortcuts
 uninstall shortcuts
 prevent phone from sleeping
 control vibration
 connect and disconnect from Wi-Fi
 view Wi-Fi connections
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24796#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online