You're correct, but there's a good reason: they need to draw over other apps to do what they do. So it's not necessarily nefarious. But it is an excellent reason to build the functionality into the OS.
reply(The reason the permission is so dangerous is they can trick you into pressing the wrong button by relabeling dangerous text with innocuous text.)
The presence of a good reason is exactly why you have to be so careful. Creating an app with a legitimate reason to request permission, only to also abuse it, is a great strategy for an attacker.
replyAbsolutely, which is why I really appreciate the network permission on GrapheneOS. It makes me more comfortable to allow other permissions knowing no data can be exfiltrated.
reply>no data can be exfiltrated.
replyWell, that depends on the other apps you have installed. Unless things have changed in newer versions, apps can do IPC regardless of network permission, so any app can for example use Cronet to make network requests via Google Play Services, regardless of the toggle.
It's wild to me that "internet access" is not revokable or even displayed in the Play Store in stock Android. It's such a huge security and privacy concern, even if most apps semi-legitimately need it.
replyOr, it would be wild, if it weren't fairly obvious that this is just Google protecting their mobile ad revenue.
Network permissions could be used to avoid ads on Android. The horror!
reply