Google Photo App如何在未经许可的情况下读取帐户？

Question

I'm implementing an login quiet similar to the login of the Google Photo App. I'm not testing my App in Android Marshmallow. That requires the permission:

<uses-permission android:name="android.permission.GET_ACCOUNTS" />

Quiet clear no questions until here. But how does the app can read out my accounts without requesting nor granting the permission in the app settings?

When I try to use:

Account[] googleAccounts = AccountManager.get(context).getAccountsByType(GoogleAuthUtil.GOOGLE_ACCOUNT_TYPE);

I just get an empty array. What am I doing wrong?

Answer 1

The past week I've coded a server-side access with Google login ( https://developers.google.com/identity/sign-in/android/offline-access ), and you don't need GET_ACCOUNTS for it.

What happens is that the application requests Google Play Services for a token that you will send to your server. And that's all. Google Play Service will access accounts, popup UI for the user to agree/confirm, etc.

So, I'm assuming that's what Google Photos use. Another alternative valid answer is that they're a system app developed and signed by the creators of the OS and they can't do whatever they want by simply accessing protected APIs.