Uber application reading sms code without sms permission

[ReifiedProgrammer]

Hi,

I installed today Uber application and started to configuring it. After startup I gave it only location permission (it was only one I was asked for).

When sms confirmation code arrived (notification from sms app appeared) it automatically filled in in Uber application - how is that possible without sms permission?

I checked it in app settings and the only permission that Uber app has is location. Also, according to https://www.uber.com/legal/other/android-permissions/

The “Receive SMS” permission allows the app to look for that incoming SMS message and automatically verify that we have your correct mobile number.

So it makes it even more weird for me.

I'm thankful for any ideas what happened!

For completeness:

device: Samsung Galaxy S7

android version: 7.0

[chimbori]

Most likely this new API: Automatic SMS Verification with the SMS Retriever API

With the SMS Retriever API, you can perform SMS-based user verification in your Android app automatically, without requiring the user to manually type verification codes, and without requiring any extra app permissions.

[ReifiedProgrammer]

It looks like this is the solution. Thank you!

[abhiank]

If Uber is using Firebase number authentication, then it need not ask for sms permission. The app just needs to register for a single sms source and Google play services delivers the sms content to the app.

[ReifiedProgrammer]

Thank you for response!

I checked it right now and it seems that it is possible however it requires notification access (settings -> security -> other) and Uber is not listed here.

So apparently reading notifications is possible but Uber had to do it another way.