Why has the READ_PHONE_STATE permission been added?

Question

In the latest beta version I just published to the Play Store, I notice that the READ_PHONE_STATE has been added since the previous version.

I haven't added this myself. All I can recall doing since the previous version is using v9.6.0 of various play-services libraries (was v9.4.0):

compile 'com.google.android.gms:play-services-location:9.6.0'
compile 'com.google.android.gms:play-services-places:9.6.0'
compile 'com.google.android.gms:play-services-auth:9.6.0'

Would this have done it? I can't see it documented. Can I get rid of the permission?

And I've ensured that all the of the libraries I'm using match the main app, as per this answer... makes no difference in my case.

EDIT

OK based on this article, I've delved into my log output to find:

ADDED from [Meteogram:jobdispatcher:unspecified] C:\Users\Me\AndroidStudioProjects\Meteogram\app\build\intermediates\exploded-aar\Meteogram\jobdispatcher\unspecified\AndroidManifest.xml:37:25-84 android:uses-permission#android.permission.READ_PHONE_STATE

But nothing has changed in the jobdispatcher library (which I imported into my project as a gradle module) since the last version.

EDIT2

Here is a bit more from that log, and my feeling is that maybe it is due to the play-services library version as suspected?

ADDED from [Meteogram:jobdispatcher:unspecified] C:\Users\Me\AndroidStudioProjects\Meteogram\app\build\intermediates\exploded-aar\Meteogram\jobdispatcher\unspecified\AndroidManifest.xml:37:17-87
    android:name
        ADDED from [Meteogram:jobdispatcher:unspecified] C:\Users\Me\AndroidStudioProjects\Meteogram\app\build\intermediates\exploded-aar\Meteogram\jobdispatcher\unspecified\AndroidManifest.xml:37:25-84
android:uses-permission#android.permission.READ_PHONE_STATE
IMPLIED from C:\Users\Me\AndroidStudioProjects\Meteogram\app\src\pro\AndroidManifest.xml:2:1-12:12 reason: com.google.android.gmscore.integ.client.location has a targetSdkVersion < 4
activity#com.google.android.gms.common.api.GoogleApiActivity

The targetSdkVersion < 4 matches with the other answer linked above, but is there anything I can do in this situation, since the play-services library is not mine?

EDIT3

I found an answer... rather than delete this question I'll leave it up, with solution, in case it's useful for others (and in case someone else has a better solution!)

EDIT4

Looks like it has been fixed in 9.6.1.

Evangelinaevangeline

Answer 1

I eventually found this, which reports the same issue. One workaround is mentioned in Answer #3, which is to remove the permission "manually" (my assumption is that the permission is only required for very early Android versions, which is OK for me since my minSdk is 16):

<manifest ...
    xmlns:tools="http://schemas.android.com/tools"
    ... >

<uses-permission
    android:name="android.permission.READ_PHONE_STATE"
    tools:node="remove" />

Evangelinaevangeline

the question is, does it break anything from the google services functionality? Have you encountered any problems? – Jadda

the permission is not even required on early android versions. rather, what's going on here is that the permission did not even exist on early android versions, and functionality that now requires that permission required no permission at all. the permission is added if android studio thinks you have old code that doesn't know about the permission. – Chantey

This should be considered a workaround until a fix is released. In fact there is no progress related to the issue referenced below by Mikkel Jørgensen. – Mongolian

I added some details on where to put this workaround for inexperienced androiders (like myself), below. Thanks drmrbrewer. – Anasarca

Even after adding tools:node="remove" if i run command cordova build android it is again adding the permission READ_PHONE_STATE to android manifest.xml.Any solution to remove permission READ_PHONE_STATE from manifest file? – Conversant

Answer 2

This issue is present in Play Services v 12.0.0 as well. There's an open issue tracker on it here. It seems the issue is present for both permissions:

• android.permission.READ_PHONE_STATE
• android.permission.WRITE_EXTERNAL_STORAGE

It will probably be fixed with 12.0.1 as we saw with the 10.0.1 fix (from the original question).

Until then, I recommend removing the permission manually from the manifest as stated in the answer by drmrbrewer.

Update
12.0.1 has been released as of March 28, 2018, where this issue was addressed. See the release notes here.

Adds missing minSdkVersion in -license artifacts to prevent automatic inclusion of READ_PHONE_STATE and READ_EXTERNAL_STORAGE permissions.

Cottontail

Good solution, but it crashes if you use combination of Crashlytics + Firebase v12.0.0 + remove permission manually. It seems to be safe to stay on v11.8.0. I think the problem is from the module 'com.google.android.gms:play-services-maps:12.0.0' – Strathspey

I agree - I am also keeping 11.8.0 until a fix arrives – Sacking

Please check my answer. It was just fixed in 12.0.1 Firebase version. – Demosthenes

I can confirm the 12.0.1 release addresses this issue. – Sacking

Answer 3

Update #2: Version 10.0.1 fixes the issue again.

Update: this also occurs in version 10.0.0 of Google Play services, as reported in this post.

Previous Answer:

Per this post in the Android Developers G+ Community, one of the moderators (me) posted this comment:

I already reported this issue internally yesterday when a developer pointed it out, the fix has already been made internally, and an updated SDK is coming soon

And the updated SDK is now available - use the 9.6.1 Google Play services dependency.

Ulysses

@Ulysses Has this happened again in version 12.0.0? Looks like com.google.android.gms.license has a targetSdkVersion < 4 – Interlink

@Interlink - yes it did. 12.0.1 should be coming soon with a fix. – Ulysses

@Ulysses thanks for the quick reply! Is there an estimate for the 12.0.1 release? I may have told a client I'd get a release out today as 12.0.0 was expected to fix a bad crash – Interlink

I just realised it should be safe to manually remove the permission, so going with that for now – Interlink

@Interlink - it'll still be an order of days – Ulysses

@Interlink - 12.0.1 is out now with a fix – Ulysses

Answer 4

For those who are looking for the issue related to version 12.0.0 of Firebase, just upgrade to version 12.0.1. It was a mistake in the packaging for 12.0.0 and was resolved in 12.0.1.

Check the release notes: https://developers.google.com/android/guides/releases

Demosthenes

Answer 5

If you're not experienced with Android (like me!) and you were not sure where drmrbrewer's snippet should go, the answer is in your main app/manifests/AndroidManifest.xml file, like this:

  <manifest xmlns:android="http://schemas.android.com/apk/res/android"
      xmlns:tools="http://schemas.android.com/tools"
      package="com.your.package">

      ...

      <!-- attempt to combat this issue: https://mcmap.net/q/383242/-why-has-the-read_phone_state-permission-been-added -->
      <uses-permission
          android:name="android.permission.READ_PHONE_STATE"
          tools:node="remove" />
      <uses-permission
          android:name="android.permission.WRITE_EXTERNAL_STORAGE"
          tools:node="remove" />
  </manifest>

Anasarca

Answer 6

Faced same problem. Just checked that Google release new version. Update to 12.0.1 or to latest version. This problem will be gone.

Hubby