I am *very* surprised that the list of requested permissions on Google Play does *not* have to match the actual permissions which the app gets when installed.
I would have thought that the list on Google Play is computed from the binary so it cannot be fake.
Is it really true that you can just leave out permissions in this list and then just get them once people install your app?
I would have thought that the list on Google Play is computed from the binary so it cannot be fake.
Is it really true that you can just leave out permissions in this list and then just get them once people install your app?