Android Fixing the READ_PHONE_STATE? getting a bit tired of it..

[Galloper]

After a bit of struggle with GMS2 and different builds on Android, also publishing on Google Play market and so on..
I found this problem: it seems that particular implementation of Google Licensing (with the public key from the Play market dev. console) by YYG is done in such a way that does require the application to have READ_PHONE_STATE permission in it's manifest.

Google documentation on this suggests that it's not really necessary: https://developer.android.com/google/play/licensing/adding-licensing.html
Here is what it says:

Note that, depending on the APIs you use, your application might need to request additional permissions in order to acquire device-specific information. For example, to query the TelephonyManager to obtain the device IMEI or related data, the application will also need to request theandroid.permission.READ_PHONE_STATE permission in its manifest.

Before requesting new permissions for the sole purpose of acquiring device-specific information for use in your Obfuscator, consider how doing so might affect your application or its filtering on Google Play (since some permissions can cause the SDK build tools to add the associated <uses-feature>).

And while the licensing extension from YoYo Games found here does NOT have READ_PHONE_STATE permission listed in it, just ticking the box in the GameOptions->Android->Packaging to "Enable Google Licensing" add this permission to your Android manifest and you can't just remove it by editing it, cuz it will be added on every build, unless you untick that box. Even if you already remove the YYG Google Licensing extension, the enabling/disabling this box still does it's magic to the manifest.
Needless to say, in the game's Android->Permissions settings you can check/uncheck the permission all you like - it won't affect anything.

So my question is to the GMS2 developers: can it be done in some other way like that document above suggests? I mean the implementation of Google Licensing, without asking for READ_PHONE_STATE cause it does scare some users especially from otherwise normal casual games.
Right now the only solution to this, if you do not want your game on Google Play to request people to accept invading their privacy (Google kind of explicitly asks for it upon installing if you have READ_PHONE_STATE in your app) - the only solution would be to not use the licensing at all. Duh.

============more on this====================
There's an old question on StackOverflow concerning this problem with licensing and permissions, particularly targeting the same paragraph from Google's documentation that I just quoted:
https://stackoverflow.com/questions...ng-deviceid-for-lvl-without-added-permissions
and the answer leads to even older android dev blog with a final suggestion of using things like ANDROID_ID instead of getting the device id.
Looking at the code inside of GooglePlayLicensingAsExt.java I see this line in checkLicensing() function:

String deviceId = Secure.getString(RunnerActivity.CurrentActivity.getContentResolver(), Secure.ANDROID_ID);

it later gets fed into AESObfuscator, so you probably read that blog too, yet we still need the permission somehow?
Sorry if I'm wrong, it's just so frustrating.
Sure there are better Android programmers around here who can explain why we still need to have this permission (in our particular case) to use licensing?

 

[klys]

Well, using logic you can think that maybe its necesary to know who is trying to use a license with the apk, or the apk without the license. Is a way to identify the device.

Security measurements.

 

[bml]

READ_PHONE_STATE has a protection level of dangerous so it's not user friendly. I can't think of a good reason why it would be needed unless a game is reading notifications which doesn't seem like something Licensing would need. Historically it's been used to get a unique ID, but there are others way to do that without requiring access to a user's phone number and notifications.

I think using READ_PHONE_STATE on Android 6 or greater will require a privacy policy if you submit to the Play Store.

Android docs:

Dangerous permissions cover areas where the app wants data or resources that involve the user's private information, or could potentially affect the user's stored data or the operation of other apps. For example, the ability to read the user's contacts is a dangerous permission. If an app declares that it needs a dangerous permission, the user has to explicitly grant the permission to the app.