> If two apps from the same developer share a User ID (sharedUserId), they run in the same process and share all permissions
Good grief. What a huge vulnerability. Is there some benefit that justifies this?
> If two apps from the same developer share a User ID (sharedUserId), they run in the same process and share all permissions
Good grief. What a huge vulnerability. Is there some benefit that justifies this?
First, `sharedUserId` is opt-in.
You need something like that for plugin / extension like system.
Third, it is being deprecated. and people are screaming "bad google" "android is no longer free!"
> First, `sharedUserId` is opt-in.
By the user?
> You need something like that for plugin / extension like system.
Plugin/extension != app.
Literally there for more protection. Split your app into different apps, each handling a component. Want a banking app, without access to registering your card for NFC payments ? Split the app.
sharedUserIds cannot be applied blindly, they need the app to be signed with the same key, both need to declare their sharedUserId to be the same, etc.