How can the Google Photo App read the accounts without permission?

Question

I'm implementing an login quiet similar to the login of the Google Photo App. I'm not testing my App in Android Marshmallow. That requires the permission:

<uses-permission android:name="android.permission.GET_ACCOUNTS" />

Quiet clear no questions until here. But how does the app can read out my accounts without requesting nor granting the permission in the app settings?

When I try to use:

Account[] googleAccounts = AccountManager.get(context).getAccountsByType(GoogleAuthUtil.GOOGLE_ACCOUNT_TYPE);

I just get an empty array. What am I doing wrong?

Answer 1

The past week I've coded a server-side access with Google login ( https://developers.google.com/identity/sign-in/android/offline-access ), and you don't need GET_ACCOUNTS for it.

What happens is that the application requests Google Play Services for a token that you will send to your server. And that's all. Google Play Service will access accounts, popup UI for the user to agree/confirm, etc.

So, I'm assuming that's what Google Photos use. Another alternative valid answer is that they're a system app developed and signed by the creators of the OS and they can't do whatever they want by simply accessing protected APIs.