Google ML Kit's barcode scanner adds the INTERNET permission and sends diagnostics, even in apps with no network code

14 days ago by Marcuz to c/android

While checking one of my own apps with Exodus Privacy, I noticed it had the INTERNET permission even though the code never touches the network. The culprit turned out to be Google ML Kit's barcode scanning library, which a very popular Flutter QR scanner uses under the hood. It adds INTERNET and ACCESS_NETWORK_STATE through a Google transport library, and sends diagnostic data to Google when the scanner is opened (device model, app version, an install-scoped ID, latencies, error codes). Google documents this, but you'd never guess it from an app that just reads a QR code.

A few things I took away from it:

A "0 trackers" result on Exodus doesn't mean "no network". Check the permission list too.
If an app that should be offline asks for INTERNET, a QR/barcode feature is worth suspecting.
For developers: ZXing-based scanners decode entirely on-device and don't pull any of this in. You can confirm with the merged manifest or the manifest-merger report in your build folder.

Has anyone else run into libraries quietly adding network access like this? Curious which others are common offenders.

mannycalavera 6 points 14 days ago

Aren't you supposed to check your merged manifest before publishing? To catch things like this?

It's all great assuming apps or libraries behave the way you think they ought to behave but as a developer the responsibility is on you to check what you're publishing.

save

path: 0 26054851, hotness: undefined, score: 6, children: 4

Marcuz 4 points 14 days ago

That's what I did indeed, thanks for the advice!

save

path: 0 26054851 26055678, hotness: undefined, score: 4, children: 0

0xd34d 2 points 14 days ago

Aren't you supposed to check your merged manifest before publishing? To catch things like this?

You would think that's what one would do. The permission isn't added as quietly as OP would lead you to believe if you look at the merged manifest.

save

path: 0 26054851 26057889, hotness: undefined, score: 2, children: 0

deadcream 1 point 14 days ago

I'm sure you are carefully examining each line of code of libraries your app depends on, including hundreds of transitive dependencies, and also build tools. You are a responsible developer, aren't you?

save

path: 0 26054851 26058926, hotness: undefined, score: 1, children: 1

mannycalavera 3 points 14 days ago

If you don't understand transitive dependencies and how they carry through into either the classpath of your app or how they get merged into the manifest that you declare as your own app's, then you're going to have to learn these lessons the hard way.

save

path: 0 26054851 26058926 26060326, hotness: undefined, score: 3, children: 0

DROID DOES

Rules

DROID DOES

Rules