Is Evernote a malicious app?

Question

I have been using Evernote on my Laptop and Mobile phone for quite some time now. Recently, when downloading an update of Evernote app in my phone from Google Play app, I noticed that Evernote asks for some objectionable permissions:

enter image description here

I am not aware of any option/facility/service provided by Evernote which would require any of these permissions. Is Evernote Malicious?

Then I think the app is not malicious unless someone will prove it is. Evernote is quite big. — Eduard Florinescu, Nov 07 '12 at 15:23
@EduardFlorinescu Apps from Google Play are never malicious? — , Nov 07 '12 at 15:25
Yes they are but I wanted to now if you have the original app or a copycat that might be a malaware. Evernote is quite a prestigious provider I think is not a malaware but it can spy on you. See answer about similar concerns with facebook. — Eduard Florinescu, Nov 07 '12 at 15:36
See also these previous questions for discussion on why many apps need the "Read Phone State and Identity" permission that you've highlighted: Why do so many applications require permission to read the phone state and identity? and Why does an app read my phone's IMEI number? An awful lot of them do — GAThrawn, Nov 07 '12 at 15:57
@RichardBorcsik - You seemed to miss the point that I was speaking in general. Since I shouldn't have been doing this anyway, I've deleted my comments. — Mark Booth, Nov 08 '12 at 15:15

score 4 · Accepted Answer · edited May 23 '17 at 12:40

The reason for "phone calls" might be quite easy: Looking at the app requirements, they list "Android 1.6 or higher". With that, this permission is automatically set -- whether the developer wants it or not. Reference: Android 1.6 Changelog.

An interesting discussion on this permission can be found at StackOverflow: Android permissions: Phone Calls: read phone state and identity.

Of course this might not be the only reason. If the app e.g. lets you take "call notes" for an ongoing phone call, it might want to connect it with the contact or at least the calling number. To get the contact, it needs the number. To get the number, it needs... yes, READ_PHONE_STATE. Not using EverNote, I cannot say if it offers such a feature.

Personal Information: A possible reason for Contacts I just explained. Some additional reasons, taken from the app description, could be:

Email notes and save tweets to your Evernote account (Email taken from contacts)
Share notes with friends and colleagues via Facebook and Twitter (again, your friends data is probably stored with your contacts)
Take meeting and class notes (meetings are probably among your calendar entries, so they could be connected)
Plan a trip: keep track of travel plans, plane tickets and passports (again a clear candidate for calendar: Travel plans)

As for accounts, pick reasons from above: How to share on your Twitter and/or Facebook accounts without accessing them?

So all mentioned permissions could be easily explained. Could, as it takes some guess-work. You may be able to tell my assumptions are true if you investigate the described features. But the devs should be able to confirm or deny -- and IMHO it is their responsibility to explain.

My suggestion to developers always is: If there are sensitive permissions involved, split the connected functionality into addons/plugins. My standard example: Locus Maps. It needs internet access to load maps, that's crucial to the app. Being a navigation app, you might want it to navigate you to your friends -- so accessing your contacts makes sense. But that together with internet, well... you might be concerned. So Menion (the dev) moved this part to a (free) addon. Choice is up to you: Trust him (and install the addon), or enter all addresses manually.

And for another thing I agree with a point mentioned here a couple of times: A 4.7 star rating with almost half a million downloads, I'd say if that app were malicious, we'd have heard about.

Eduard Florinescu · Answer 2 · 2012-11-07T15:40:36.173

2

"READ PHONE STATE AND IDENTITY

Allows the application to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and so on"

I think it needs calls to make some appointment from them and all the other permission are maybe in the same feature class. I think other users are having similar concerns about other apps from big providers like facebook see here.

My take would be to ask directly Evernote why they need those features enabled.

This is no way a singular incident see a similar concern here.

edited Nov 07 '12 at 15:40

answered Nov 07 '12 at 15:29

Eduard Florinescu

275
1
6
21

1

There's no need for calls to make contacts for them (that would require calendar and contacts access). As described, many devs say their apps need that to detect incoming calls and react correspondingly (though that should no longer require this permission since Android 2.0). More likely those apps want to access the IMEI as "unique key" for ads. But as you said: Ask the dev, they should know. – Izzy Nov 07 '12 at 21:39
@Izzy very useful comment, didn't know that, thanks, I think is interesting that the developer put all the features in the same class. In my opinion accession calls should be sepparated from IMEI. And also iformation if there is a call from information about who's calling who. But then I'm not doing it, its not my call. – Eduard Florinescu Nov 07 '12 at 22:19
That's not the dev's fault. The permissions are sometimes not fine-grained enough. Take an example: you want to display ads in your free app. What permission do you need? Full internet, there's nothing else. But with that, you could do and more. Some ad services require IMEI (they say, to decide whether a given ad already had been displayed to this user) -- so if the dev wants to use this ad service, he'll have to request that permission. Only other reason I could see is if Evernote allows to take notes for an ongoing call, and would connect the number etc. with it. – Izzy Nov 07 '12 at 22:48
@Izzy Was tinking about the developer and designer of the platform in this case Google, they should have fine-grained more the access features, and make them more atomized. – Eduard Florinescu Nov 08 '12 at 00:14

score 2 · Answer 3 · answered Nov 07 '12 at 16:12

2

I don't think since Evernote is quite big they would do something like that, and if would do so it would be something so easy to see. Actually when you are developing for android some methods would require this kind of permission, if i'm not wrong, if you want, for example, check for data connection needs READ PHONE STATE AND IDENTITY or for some advertising..

I've found an interesting article discussing it: Here

answered Nov 07 '12 at 16:12

Markissimo

466
1
3
15

interestingly you found the same article as me check my last link ;) – Eduard Florinescu Nov 07 '12 at 22:11
Thanks for that link! Up to now I would have said: Data connection requires ACCESS_NETWORK_STATE, but not READ_PHONE_STATE. So the "data connected" phone state would give another argument besides 1.6 compatibility and advertisements. – Izzy Nov 07 '12 at 22:54
@EduardFlorinescu sorry, didn't saw your last link, just found this on google =p. @Izzy maybe Google should create another permission or let devs check for those things with ACCESS_NETWORK_STATE, but they probably have a reason to do that on READ_PHONE_STATE – Markissimo Nov 08 '12 at 10:32
@Markissimo no problem with me, this way adds more consistency to the general answer. – Eduard Florinescu Nov 08 '12 at 10:52

Is Evernote a malicious app?

3 Answers3