Is Evernote a malicious app? I have been using Evernote on my Laptop and Mobile phone for quite some time now. Recently, when downloading an update of Evernote app in my phone from Google Play app, I noticed that Evernote asks for some objectionable permissions:









I am not aware of any option/facility/service provided by Evernote which would require any of these permissions. Is Evernote Malicious?
The reason for "phone calls" might be quite easy: Looking at the app requirements, they list "Android 1.6 or higher". With that, this permission is automatically set -- whether the developer wants it or not. Reference: Android 1.6 Changelog.

An interesting discussion on this permission can be found at StackOverflow: Android permissions: Phone Calls: read phone state and identity.

Of course this might not be the only reason. If the app e.g. lets you take "call notes" for an ongoing phone call, it might want to connect it with the contact or at least the calling number. To get the contact, it needs the number. To get the number, it needs... yes, READ_PHONE_STATE. Not using EverNote, I cannot say if it offers such a feature.

Personal Information: A possible reason for Contacts I just explained. Some additional reasons, taken from the app description, could be:


Email notes and save tweets to your Evernote account (Email taken from contacts)
Share notes with friends and colleagues via Facebook and Twitter (again, your friends data is probably stored with your contacts)
Take meeting and class notes (meetings are probably among your calendar entries, so they could be connected)
Plan a trip: keep track of travel plans, plane tickets and passports (again a clear candidate for calendar: Travel plans)


As for accounts, pick reasons from above: How to share on your Twitter and/or Facebook accounts without accessing them?

So all mentioned permissions could be easily explained. Could, as it takes some guess-work. You may be able to tell my assumptions are true if you investigate the described features. But the devs should be able to confirm or deny -- and IMHO it is their responsibility to explain.



My suggestion to developers always is: If there are sensitive permissions involved, split the connected functionality into addons/plugins. My standard example: Locus Maps. It needs internet access to load maps, that's crucial to the app. Being a navigation app, you might want it to navigate you to your friends -- so accessing your contacts makes sense. But that together with internet, well... you might be concerned. So Menion (the dev) moved this part to a (free) addon. Choice is up to you: Trust him (and install the addon), or enter all addresses manually.



And for another thing I agree with a point mentioned here a couple of times: A 4.7 star rating with almost half a million downloads, I'd say if that app were malicious, we'd have heard about.