Android APP 使用 百度 SDK ,被 Google Play 7 天 警告 下架
bewareofbears · 2019-08-28 11:40:18 +08:00 · 15821 次点击这是一个创建于 1916 天前的主题，其中的信息可能已经有所发展或是发生改变。
百度定位 SDK v7.9.0
百度地图 SDK v5.4.4
We ’ ve identified that your app is using Baidu SDK, which has been determined to access user or device data for undisclosed, unimplemented, or disallowed features or purposes.
Data from sensitive permissions (for example, IMEI derived from the READ_PHONE_STATE) is being transmitted or read by your app in a manner that is disallowed. Apps may only handle sensitive user data in which the corresponding permission has been granted on that device for that individual app, and where the user has directly consented to that individual app ’ s access and use.
Furthermore, use of permissions (including READ_PHONE_STATE) must be related to the core functionality of your app. If your app does not require this permission, please remove it.
We have also determined that the use of this sensitive data is subject to prominent disclosure (and consent) requirements. Provided your app 1) has core functionality requiring access to READ_PHONE_STATE), 2) never transmits READ_PHONE_STATE (and other sensitive permissions based data) for use in other apps, 3) never accesses Permissions protected sensitive device data in an unauthorized manner; your app must fulfill the prominent disclosure and consent requirements prior to accessing and handling this data. Further, the handling of this data must also be clearly described in your Privacy Policy.
百度地图 SDK v5.4.4
We ’ ve identified that your app is using Baidu SDK, which has been determined to access user or device data for undisclosed, unimplemented, or disallowed features or purposes.
Data from sensitive permissions (for example, IMEI derived from the READ_PHONE_STATE) is being transmitted or read by your app in a manner that is disallowed. Apps may only handle sensitive user data in which the corresponding permission has been granted on that device for that individual app, and where the user has directly consented to that individual app ’ s access and use.
Furthermore, use of permissions (including READ_PHONE_STATE) must be related to the core functionality of your app. If your app does not require this permission, please remove it.
We have also determined that the use of this sensitive data is subject to prominent disclosure (and consent) requirements. Provided your app 1) has core functionality requiring access to READ_PHONE_STATE), 2) never transmits READ_PHONE_STATE (and other sensitive permissions based data) for use in other apps, 3) never accesses Permissions protected sensitive device data in an unauthorized manner; your app must fulfill the prominent disclosure and consent requirements prior to accessing and handling this data. Further, the handling of this data must also be clearly described in your Privacy Policy.
 |
1
weiruanniubi 2019-08-28 12:23:40 +08:00
支持谷歌！
|
 |
2
kx5d62Jn1J9MjoXP 2019-08-28 12:27:31 +08:00 via Android
可是百度和百度地图都上架了 Google play
|
 |
4
RikkaW 2019-08-28 12:59:55 +08:00 via Android
用别人 SDK 第一件事就是把没用的权限拿掉嘛（
|
 |
5
fvckDaybyte2 2019-08-28 13:14:52 +08:00
@RikkaW 那岂不是等着 crash ……
|
 |
6
honeycomb 2019-08-28 13:36:58 +08:00 via Android
看上去没有问题，这里的 SDK 使用了 play 政策不允许的东西，简而言之就是 READ_PHONE_STATE 对应的读取设备永久识别码（ IMEI/MEID，build.serial 等）。
你的应用必须是核心功能需要这个权限的情况下才能使用这个权限（显然定位不适用这种情况，因为获知定位不需要也不应该向百度提交设备持久识别码） |
|
7
honeycomb 2019-08-28 13:38:27 +08:00 via Android
@ssynhtn 百度地图目前至少不强制使用 read_phone_state 权限。
当然还是建议把 amap 给举报了，因为它强制要求了该权限 |
 |
9
Nitroethane 2019-08-28 13:44:35 +08:00 via Android
@honeycomb amap 强制使用这个权限给出的理由好像是方便驾驶人在开车的时候方便接电话啥的
|
 |
10
lpd0155 2019-08-28 13:49:52 +08:00 via Android  2
兄弟人家百度在文档里也说了上架 play 要把这两个权限拿掉。你没看吧
|
 |
11
loveour 2019-08-28 13:53:39 +08:00
@ssynhtn #2 上架的十有八九是处理过的 SDK。以前接国内某个统计 SDK 的时候，就有一个专门的谷歌商店版，要的权限会少。所以我一直都觉得，国内 APP 乱象，管太少是原因。
|
 |
13
bewareofbears OP @lpd0155 大哥,应用在特定场景下 需要通过 READ_PHONE_STATE 获取手机来去电状态.给用户提供更友好的体验。
我不需要 设备永久识别码（ IMEI/MEID，build.serial 等） 这种情况,给 Google 申述？有没有更好的方式？ |
 |
14
no1xsyzy 2019-08-28 15:47:53 +08:00
@bewareofbears 改 PP
最后一段六行跟你说改 PP 就能过，你看不懂就没辙了 |
|
15
no1xsyzy 2019-08-28 15:53:09 +08:00
prominent disclosure and consent requirements 明确地提示用户并征得同意：
尽管获取了此权限，但并不读取 IMEI 码，因此也不会向任何服务器传输。 并同时写在 PP 里 |
 |
16
azh7138m 2019-08-28 15:54:50 +08:00 1
呃，可以考虑 target Q，就没法拿到这些设备信息了（
"获取手机来去电状态.给用户提供更友好的体验" 一般来说，app 不 xjb 读我的隐私，我会觉得体验更好。 |
 |
17
Buges 2019-08-28 16:13:48 +08:00 via Android 2
Google 做得很好，建议加大力度。
一般来说，但凡使用了某些国产 sdk 的应用，包括但不限于请求 IMEI，请求 storage 并在目录下拉 deviceid💩文件，都是不配上架的。 |
|
18
honeycomb 2019-08-28 17:10:07 +08:00 via Android
@azh7138m
按照楼主的意思，他要的不是永久识别码，而是别的受该权限保护的（不用于识别可用于识别手机身份） API。因此也适用 Q 里事实上禁止获取永久识别码的情况。 @bewareofbears 建议考虑 @no1xsyzy 的说法，即在隐私协议中声明不会在获得该权限的情况下，使用设备永久识别码。或者在用户不愿意授权时放弃相关的优化特性。 对 Google 的审查团队而言，则是证明为何值得获取了来去电状态。 |
|
19
honeycomb 2019-08-28 17:17:06 +08:00 via Android
@Nitroethane
它应当支持用户宁可放弃这个特性，也不给电话权限的要求（简而言之不强制索要权限）。 因为在 Android 10 以前（或者自定义 appops 设置），不能保证在给了该权限后，它能不拿 IMEI。 |
 |
20
s2555 2019-08-29 08:56:53 +08:00
同昨天，之前因为极光，现在到支付宝，心累啊。
Notification from Google Play： 我们已经确定您的应用正在使用支付宝 SDK 或库，这有助于传输电话号码信息，而无需符合突出的披露准则。 如有必要，您可以咨询您的 SDK 提供商以获取更多信息，或者请将 AliPay SDK 版本升级到 15.5.5 或更高版本。 |
 |
21
starsriver 2019-08-29 10:04:34 +08:00 via Android
你的软件没有必要用到这些功能，删了重新构建。
除非你做了一系列的 app 比如说设备绑定之类的 |
 |
22
CommandNotFound 2019-09-16 14:41:36 +08:00
百度 SDK 太坑了，那是不是取消权限 READ_PHONE_STATE，重新提交就可以了？还是说整个百度 SDK 都要去掉？没有权限 READ_PHONE_STATE，百度 SDK 会不会闪退？
|
|
23
bewareofbears OP @CommandNotFound 调整代码实现.取消了 READ_PHONE_STATE
|
Select Language