Android permissions to access media store

Question

Are there any specific permissions needed to access android's mediastore? I wrote a test app that could access all of the users photos - but I find this behavior unexpected. It really seems like there should be some permissions to access this data.

Answer 1

With android 4.4 i get this error message in logcat when reading an image via content url content://media/external/images/media/123 that is outside the /mnt/sdcard/DCIM/Camera directory

... 
Caused by: java.lang.SecurityException: Permission Denial: reading com.android.providers.media.MediaProvider uri content://media/external/images/media from pid=1197, uid=10072 requires android.permission.READ_EXTERNAL_STORAGE, or grantUriPermission()

so newer android versions require permission android.permission.READ_EXTERNAL_STORAGE

Answer 2

Images(and video) taken with the device camera are stored in the External Storage (SD card on most devices) generally they are stored in sdcard/dcim/Camera/

On android there is no permission required to read from the external storage, this means that any application that is installed on the device could indeed have access to the photos that were taken with your device.

writing to the external storage does however require a permission, so if an application wanted to delete or change one of these files they would need to have that permission.

Though, to be honest unfortunately I think the permissions are a moot point. If there is a nice pretty icon, and promises of amazing things the general population will install anything regardless of what permissions it requires. For most people the permissions page is just that thing where you have to scroll down and press install.