To me, it’s gotta be the microphone
Root
This. Root allows an app to get any permissions and probably even disable all evidence of having them.
It actually allows the app to run as the OS itself.
Clearly the only right answer is Internet. Who cares about camera, mic or location when the app cannot send the data anywhere anyways?
Inter-app communication can go around it. And most OSes don’t block localhost connections either.
On Android apps connected with a Google account, “Can read, send, and delete emails” scares the shit out of me.
At one time, the bank that i used decided to made an app, and they demand Location, Camera, Contact, Files, Microphone, and SMS, in which they will ask for all of it from the get go and not allowing either one of it will send you in a loop, unable to use the app at all. I bail immediately and continue to use the website.
As for the scariest one, camera. They can see where you are and what your surrounding like if they demand “always allow”.
Internet
This depends on what you’re trying to defend against. In my opinion (on GrapheneOS):
- “Accessibility” permission (i.e. full control of the device)
- “Network” permission
- “Modify system settings” permission
- “Install unknown apps” permission
- Any permission that allows apps to communicate with one another (such as a reduced sandbox, file permission, or app communication scopes)
Those are the only permissions that I can think of off the top of my head that could potentially allow an app to phone home. Turning off Wi-Fi for the device does little if the app also has the “Wi-Fi control” permission.
