Permissions for Firebase Analytics and Crash

Question

I used

//Analytics
compile 'com.google.firebase:firebase-core:9.2.1'
// Crash
compile 'com.google.firebase:firebase-crash:9.2.1'

and obtained those guys in my generated manifest:

<!-- Required permission for App measurement to run. -->
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<!-- Optional permission for App measurement to run. -->
<uses-permission android:name="android.permission.WAKE_LOCK" />
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" />

Then we have the following block

<permission
    android:name="my.package.name.permission.C2D_MESSAGE"
    android:protectionLevel="signature" />
<uses-permission android:name="my.package.name.permission.C2D_MESSAGE" />

My questions:

If I use only Firebase Analytics and Crash and don't need any messaging functional, is it Ok to remove the second block as follows:

<uses-permission android:name="my.package.name.permission.C2D_MESSAGE" tools:node="remove" />

What does it mean "Optional permission for App measurement to run" in the first block? Is it safe to remove that too?

Answer 1

Do note that "Optional Permission" is only referring to the WAKE_LOCK and not c2dm.permission.RECEIVE.

The "Optional Permission" is derived from the Manifest of the intermediate folder for firebase-analytics. (\build\intermediates\exploded-aar\com.google.firebase\firebase-analytics).

Do note that for version 10.0.1 (the version i used), WAKE_LOCK permission is no longer optional. Wakelock is no longer shows "Optional permission for App measurement to run."

removing the WAKE_LOCK permission will result in a lot of crashes.

As for the other permissions. According to Doug Stevenson over at https://groups.google.com/d/msg/firebase-talk/CXgecSxgsRE/84PsoyTKGgAJ C2D_MESSAGE and c2dm.permission.RECEIVE is important.

it turns out that those other permissions that appear to be only relevant for messaging are actually used indirectly by analytics and other Firebase components. The reason is that they need to generate secure tokens that need to be rotated periodically. This is handled by the instance ID library, which you can read about here: https://developers.google.com/instance-id/

...they are important for making sure Firebase components work correctly). I'm told that Analytics, Crash Reporting, and Remote Config all make use of these tokens today

Answer 2

Yes , you can remove both of them and they're not necessary. Also in google sample none these two permissions granted.

According to documentation:

Firebase Analytics helps you understand how people use your iOS or Android app. The SDK automatically captures a number of events and user properties and also allows you to define your own custom events to measure the things that uniquely matter to your business. Once the data is captured, it's available in a dashboard through the Firebase console. This dashboard provides detailed insights about your data — from summary data such as active users and demographics, to more detailed data such as identifying your most purchased items.

Also seeing this video maybe give you better idea about measurement.

Answer 3

Firebase Analytics uses FirebaseInstanceId. This can be seen by running the dependencies task in the Android Studio tool window for Gradle. This portion of the output shows the dependency on FirebaseInstanceId :

+--- com.google.firebase:firebase-core:9.2.1
|    \--- com.google.firebase:firebase-analytics:9.2.1
|         +--- com.google.android.gms:play-services-basement:9.2.1
|         |    \--- com.android.support:support-v4:24.1.0
|         |         \--- LOCAL: internal_impl-24.1.0.jar
|         +--- com.google.firebase:firebase-common:9.2.1
|         |    +--- com.google.android.gms:play-services-basement:9.2.1
|         |    |    \--- com.android.support:support-v4:24.1.0
|         |    |         \--- LOCAL: internal_impl-24.1.0.jar
|         |    \--- com.google.android.gms:play-services-tasks:9.2.1
|         |         \--- com.google.android.gms:play-services-basement:9.2.1
|         |              \--- com.android.support:support-v4:24.1.0
|         |                   \--- LOCAL: internal_impl-24.1.0.jar
|         \--- com.google.firebase:firebase-analytics-impl:9.2.1
|              +--- com.google.android.gms:play-services-basement:9.2.1
|              |    \--- com.android.support:support-v4:24.1.0
|              |         \--- LOCAL: internal_impl-24.1.0.jar
|              +--- com.google.firebase:firebase-iid:9.2.1  <== FirebaseInstanceId
|              |    +--- com.google.android.gms:play-services-basement:9.2.1
|              |    |    \--- com.android.support:support-v4:24.1.0
|              |    |         \--- LOCAL: internal_impl-24.1.0.jar
|              |    \--- com.google.firebase:firebase-common:9.2.1
|              |         +--- com.google.android.gms:play-services-basement:9.2.1
|              |         |    \--- com.android.support:support-v4:24.1.0
|              |         |         \--- LOCAL: internal_impl-24.1.0.jar
|              |         \--- com.google.android.gms:play-services-tasks:9.2.1
|              |              \--- com.google.android.gms:play-services-basement:9.2.1
|              |                   \--- com.android.support:support-v4:24.1.0
|              |                        \--- LOCAL: internal_impl-24.1.0.jar
|              \--- com.google.firebase:firebase-common:9.2.1
|                   +--- com.google.android.gms:play-services-basement:9.2.1
|                   |    \--- com.android.support:support-v4:24.1.0
|                   |         \--- LOCAL: internal_impl-24.1.0.jar
|                   \--- com.google.android.gms:play-services-tasks:9.2.1
|                        \--- com.google.android.gms:play-services-basement:9.2.1
|                             \--- com.android.support:support-v4:24.1.0
|                                  \--- LOCAL: internal_impl-24.1.0.jar

The C2D_MESSAGE permission comes from the manifest associated with the firebase-iid library. My guess is that without it, FirebaseAnalytics would not be able to obtain a unique ID for the device and would be unable to report data.

Regarding the WAKE_LOCK permission, see this related answer.

I doubt it is safe to remove any of the permissions. You could find out by running without them and seeing if analytics reports any events.