Play store: application list

[zroice]

Google Play Store with everything checked beside "Internet", "Accounts" and "GservicesProvider" in Identification still manages to recognize which apps are installed.

Sideloaded a few apks and checked the store for them to see they had been marked "installed".

On the same note: When an app is beeing installed through play store, despite having revoked all system (installed apps) permissions, the play store still recognizes when the download and installation is finished.

As far as my researches show, this is related to DownloadBroadcastReceiver which currently cannot be blocked in Xprivacy.

Ideally with all but the true necessary permissions denied the play store should not know which apps are installed on the device and just be able to "start download of new app", whether its alrdy installed or not. (if possible..)

[LazyZhu]

It might have something to do with Google Play's market links, because you can use Titanium Backup remove/restore them.

[zroice]

well titanium has account data blocked and complains about not beeing able to retrieve auth token when I try to change market links ("accounts" blocked in xprivacy, so it shouldnt be able to "link" apps to market in the first place, should it?!) and this also happens with real sideloaded apks or apks i had installed before installing the play store (phone is with minimal gapps: Google Account Manager, Google Fraemwork, Google Play Store only).

It seems like the play store retrieves this information different than through "getinstalledapppackages"?!

[M66B]

It is likely that the Play store is using a non standard, non documented way to retrieve the installed applications (perhaps through GSF). Unfortunately the Play store is not open source, so it will be difficult to figure out how it works.

[zroice]

I looked again at this bug/problem and I found out that there are some more intents that xprivacy needs to block related to system (installed apps):

android.intent.action.PACKAGE_CHANGED
android.intent.action.PACKAGE_FIRSTLAUNCH
android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE
android.intent.action.EXTERNAL_APPLICATIONS_UNAVAILABLE

I think the last two are fired if the sd_card is mounted/unmounted, not sure if those actually hand out any other information than that, but lets just block it anyway.. :P

---

I found this out by looking at all the receivers of the play store app with romtoolbox. Please try to add the possibility to block these intents as well.

[M66B]

Thanks for figuring this out!
I will add restrictions for these intents soon.

[zroice]

The receiver disabler/enabler of the romtoolbox app is quite handy to find out which intents are hooked to which receivers. Ill see if i can find some more interesting stuff.

[zroice]

oops.. closed by accident.

One more thing I found out.

There is also an intent related to accounts which might need some blocking work hehe (not sure if this is needed/helpful, but it might be giving out account info to apps?):

android.accounts.LOGIN_ACCOUNTS_CHANGED

[M66B]

I will look into the accounts changed intent too.
Please let me know if you find more.

[M66B]

Next version will restrict addittional in the system category:

• android.intent.action.PACKAGE_CHANGED
• android.intent.action.PACKAGE_DATA_CLEARED
• android.intent.action.PACKAGE_FIRST_LAUNCH
• android.intent.action.PACKAGE_FULLY_REMOVED
• android.intent.action.PACKAGE_NEEDS_VERIFICATION
• android.intent.action.PACKAGE_VERIFIED
• android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE
• android.intent.action.EXTERNAL_APPLICATIONS_UNAVAILABLE

[M66B]

android.accounts.LOGIN_ACCOUNTS_CHANGED does not need to be restricted, since it carries no data.

[M66B]

Will be in next release.