I have not granted SMS permission to WhatsApp on my device HonorView10 running on EMUI9. Recently I changed the number registered with WhatsApp and it send the verification code to new number (the sim is on same device as it is dual SIM). WhatsApp read the SMS and completed the verification process. Is it possible in Android to read SMS without permission? Or it is bug in EMUI9? I am just curious.
-
Woah!!. Cross Check by going to settings>whatsapp>app permissions>here check if you have granted read sms permission.– Mohammed FarhanJan 30, 2019 at 5:12
-
Definitely doesn't seem like it's using the normal approach. Reading any SMS requires the permission, which you've clearly not given it.– shriakhilcJan 30, 2019 at 5:19
-
There might be something wrong with your custom UI, because as an android developer and after checking in 2-3 android devices available with me this is not the case for me. Please cross check the same scenario in some other android device. May be we can have some idea on this. By the way nice question, I'm getting curious too.– Deep PatelJan 30, 2019 at 5:29
-
@DeepPatel, there seems no issue in UI. The other permissions (granted/not granted to WhatsApp) are working perfectly fine. Just additional info - its Android Pie and latest version of WhatsApp. Also, the following answer by NileshRathod seems plausible as it is standard Android provision.– ShailendraJan 30, 2019 at 9:03
3 Answers
WhatsApp could access SMS without having permission to it
I think whats app is using SMS Retriever API
SMS Retriever API
With the SMS Retriever API, you can perform SMS-based user verification in your Android app automatically, without requiring the user to manually type verification codes, and without requiring any extra app permissions. When you implement automatic SMS verification in your app, the verification flow looks like this
Watssap does access messages in other apps, my phone set up with signal as messaging app and signal is locked, but when setting up watssap it asked me if I want to allow watssap to read messages for verification I clicked no and entered pin manually, after 2min when setting up clone app for dual sim it suddenly read sms message that came to signal app without even asking to unlock app
In some circumstances, you want to help the user understand why your app needs a permission. For example, if a user launches a photography app, the user probably won't be surprised that the app asks for permission to use the camera, but the user might not understand why the app wants access to the user's location or contacts. Before your app requests a permission, you should consider providing an explanation to the user. Keep in mind that you don't want to overwhelm the user with explanations; if you provide too many explanations, the user might find the app frustrating and remove it.
read this https://developer.android.com/training/permissions/requesting
-
1user can understood the use of devices hardware and access the device predefined services , so in new version devices we needs run time permission Jan 30, 2019 at 5:23