AnyMemo
AnyMemo copied to clipboard
Excessive permissions for google drive integration
This app requests three permissions:
- View and manage files opened or created with this app
- See, edit, create, delete all google drive files
- See, edit, create, delete your spreadsheets in google drive
The last two seem unnecessary and are a little frightening!
Those are the scope requested: https://github.com/helloworld1/AnyMemo/blob/master/app/src/main/java/org/liberty/android/fantastischmemo/common/AMEnv.java#L50
https://www.googleapis.com/auth/plus.login -> For login https://docs.google.com/feeds/ -> For legacy API listing files, probably not needed anymore https://docs.googleusercontent.com/ -> For legacy API reading files, probably not needed https://spreadsheets.google.com/feeds/ -> For operating spreadsheets. This is the one showing "See, edit, create, delete your spreadsheets in google drive" https://www.googleapis.com/auth/drive.file -> That is the one showing "See, edit, create, delete all google drive files"
We may need to figure out the correct scope to limit the permission.