This app was mentioned in 7 comments, with an average of 14.71 upvotes
WTF, i was just looking at others, "Brightest Flashlight Free" with 50mil.+ DL's get full access to your GPS and storage devices.
>Brightest Flashlight Free ® GoldenShores Technologies, LLC Free Version 2.4.2 can access:
>Location;
> approximate location (network-based)
> precise location (GPS and network-based)
>Phone;
>read phone status and identity
>Photos/Media/Files;
>modify or delete the contents of your USB storage
>read the contents of your USB storage
>Camera;
>take pictures and videos
>Wi-Fi connection information
>view Wi-Fi connections
>Device ID & call information
>read phone status and identity
>Other;
>disable or modify status bar
>read Home settings and shortcuts
>control flashlight
>prevent device from sleeping
>view network connections
>full network access
>install shortcuts
>uninstall shortcuts
Ah, permissions make sense then. It's just that I'm always cautious when an app asks for permissions cough cough that don't exactly make sense.
I've been using the app for a couple weeks now and love its simplicity! Thank you for making the app.
I wouldn't think so, it would just be a permission needed for the app to work, I read special permission as one of those apps that requires access to your phone's contacts and location just to turn on the flash light which only requires the camera access. for example this one require access to just about everything so it can spy on you, and this one only requires access to the camera
For additional entertainment, check out the permissions of this <strong>flashlight</strong> app with 50mil-100mil installs.
Here is the official FTC complaint [PDF] that the app "violated the provisions of the Federal Trade Commission Act" with all of its invasive permissions and shitty "privacy policy."
Notice the app is still on the play store with over one million reviews, giving it a 4.7 rating.
It is currently your own responsibility to be vigilant about permissions.
https://play.google.com/store/apps/details?id=goldenshorestechnologies.brightestflashlight.free
How does an "LLC" get away with not including their businesses country of origin, a self-signed code certificate, a gmail support address, and generate ad and analytic revenue from: Amobee, Firebase Analytics, Google Mobile Ads, inMobi, MDotM, Applovin, Integral Ads, Moat, Millennial Media, TapIt, and Flurry?
The first thing Google could do is enforce code signing through certificate authorities and not allow self-signed certs. And then display the details from the digital certificate for the owner information instead of random stuff a developer enters into the app store entry. That way you know where an app came from and it had to pass some sort of validation by a 3rd party. And all 3rd party code has to include its own digital certificate information and privacy policies on the app store page or something. One app that technically includes 11 other companies' apps doesn't seem right.
It isn't just malware that we're worried about. It's so many hands in the pot without us knowing.