TBLauncher icon indicating copy to clipboard operation
TBLauncher copied to clipboard

COMPLETE ACCESS TOO MAKE CALLS

Open cybberPneed opened this issue 1 year ago • 7 comments

I doubt this is actually a bug, rather intentional probably for malicious purposes. If you look at permissions YOU HAVE TO ALLOW, the app van make calls at any time with the exception of emergency services. Steer clear something is really off with this app.

cybberPneed avatar Oct 24 '24 14:10 cybberPneed

This is bullshit. You don't have to do any such thing. None of my installs of TBLauncher have this permission granted.

And what kind of malicious act could you even fathom with such a permission? Making calls at night so your call plan is used up? Well, leaking your phone number perhaps, ok.

This permission is solely used for directly initiating a call when searching for contacts. You don't have to give TBLauncher the permission to do so, nor do you have to give it the permission to access your contacts.

ltguillaume avatar Oct 24 '24 15:10 ltguillaume

I didn't say it had access too my contacts. It can make calls by itself without your knowledge. So you're number could be used by a scammer to harass or exploit people etc. Screenshot_20241024_161007_F-Droid Screenshot_20241024_161022_F-Droid

cybberPneed avatar Oct 24 '24 15:10 cybberPneed

Isn't "Phone" a permission on all Android devices, which you can deny? In that case, TBLauncher doesn't have that permission.

ltguillaume avatar Oct 24 '24 15:10 ltguillaume

Permission rules on android are implemented arbitrarily and it generally seems it's down to the ethics of the dev and the neglect of google to monitor /vet / enforce. Sometimes you have options too deny a permission request, sometimes that simply denies you the ability to use it or somewhat restricted function and even no impact but it's always clear when you read the permissions an app states it requires/requests. If that rule had the caveat of an option to only use while I'm using the app then perhaps it's not too worrying but this is completely unrestricted and non negotiable.

cybberPneed avatar Oct 24 '24 15:10 cybberPneed

image So are you saying this is not possible on your Android system? Or do you mean that TBLauncher shouldn't request it at all, because you can't trust Android to deny the permission? In that case, we're getting close to paranoia territory anyway, so you'd be better off checking the source of TBLauncher to know what it in fact does with the permission, or just remove the permission from the Android manifest before you install it on your device.

ltguillaume avatar Oct 24 '24 15:10 ltguillaume

How else can the app make phone calls if not for that permission? Not all permissions can be requested from the user after install, like the contacts permission.

TBog avatar Oct 29 '24 10:10 TBog

Launchers that have the ability to start a call for the end user have this permission. This is not like some type of Secret.

This app is a fork of KISS Launcher and they too have this permission. In fact, they have the Read Call Status and Identity permission on top of the one you are questioning, here.

Go to their Git and make the claim that they are using it for illegitimate purposes and likely you will get laughed out of there.

But, for the sake of argument, let's compare Tinybit's permissions to another launcher, say Niagara, a fairly well liked and widely used paid launcher on the play store. With over 5 million downloads. What do you see?

https://reports.exodus-privacy.eu.org/en/reports/502257/

daffydock avatar Nov 01 '24 08:11 daffydock