Resolve 30 day notice from Google Play Review Team, re BIND_ACCESSIBILITY_SERVICE

[kspearrin]

Need to file an appeal or figure out why we are in violation here. It appears that Google does not want us using accessibility services for stuff that isn't actually helping people with disabilities. We use this service for autofilling.

Anyone have experience with dealing with these notices from Google?

We’re contacting you because your app, bitwarden Password Manager, with package name com.x8bit.bitwarden is requesting the ‘android.permission.BIND_ACCESSIBILITY_SERVICE.’ Apps requesting accessibility services should only be used to help users with disabilities use Android devices and apps. Your app must comply with our Permissions policy and the Prominent Disclosure requirements of our User Data policy.

Action required: If you aren’t already doing so, you must explain to users how your app is using the ‘android.permission.BIND_ACCESSIBILITY_SERVICE’ to help users with disabilities use Android devices and apps. Apps that fail to meet this requirement within 30 days may be removed from Google Play. Alternatively, you can remove any requests for accessibility services within your app. You can also choose to unpublish your app.

If you need to make changes to your apps, please follow these steps:

Read through the Permissions and User Data policies for more details, and make sure your app complies with all policies listed in the Developer Program Policies.

If you don’t need the BIND_ACCESSIBILITY_SERVICE permission in your app or the permission is being used for something other than helping users with disabilities use Android devices and apps:
Remove your request for this permission from your app’s manifest.
Sign in to your Play Console and upload your modified, policy-compliant APK.

Or, if you need the BIND_ACCESSIBILITY_SERVICE permission in your app to help users with disabilities use Android devices and apps:
Include the following snippet in your app’s store listing description: “This app uses Accessibility services.”
Provide prominent user-facing disclosure of this usage before asking the user to enable this permission within your app. Your disclosure must meet each of the following requirements:
Disclosure must be provided via the android:summary and android:description elements of the AccessibilityServiceInfo class
Disclosure must describe the functionality that the Accessibility Service permission is enabling for your app. Each feature used with the Accessibility Service request must be declared in your disclosure with justification.

Alternatively, you can choose to unpublish the app.
All violations are tracked. Serious or repeated violations of any nature will result in the termination of your developer account, and investigation and possible termination of related Google accounts.

If you’ve reviewed the policy and feel we may have been in error, please reach out to our policy support team. One of my colleagues will get back to you within 2 business days.

Regards,

The Google Play Review Team

[kspearrin]

More people are getting these. See:

https://www.reddit.com/r/Android/comments/7c4go5/is_google_play_really_going_to_suspend_all_apps/

https://groups.google.com/forum/#!topic/tasker/ZDbjtD4bAts

https://ausdroid.net/2017/11/11/google-play-developers-use-accessibility-service-properly-removed/

[jerryn70]

If we are no longer able to use accessibility then we need to look alternative methods like keyboard integration #62 . Now keepass2android can switch keyboard automatically on non rooted device with keyboard swap plugin .

[mbirth]

@jerryn70: But that one needs the user to set a specific permission using adb. (see here)

Wouldn't it be easier to provide the Accessibility stuff via a separately downloadable "plugin"? Like e.g. Lawnchair launcher or Nova add the Google Now page.

[kspearrin]

More news/discussion coming out:

https://www.xda-developers.com/google-threatening-removal-accessibility-services-play-store/

https://www.reddit.com/r/Android/comments/7cfldu/google_is_threatening_to_remove_apps_with/

[jerryn70]

@mbirth but we cannot give that plugin through play store. If we provide that through other stores/clouds , then no one will trust that. Especially for a password manger

[kspearrin]

https://thenextweb.com/apps/2017/11/13/googles-about-to-brick-a-bunch-of-useful-android-apps-that-rely-on-accessibility-services/

[walrus543]

I discussed this issue with other devs. Many apps will lose features or will be removed... If only bitwarden could be FLOSS, you would publish it on F-Droid.
Too much power was put in their hands...

[mbirth]

@jerryn70 The main app (from the Play Store) could verify the integrity of the plugin file, e.g. via checksum of the plugin's apk file. Maybe there's a way to check the developer signature, too. This way you could make sure to only use the plugin when it's genuine.

[samlu]

Read this post https://blog.lastpass.com/2017/11/lastpass-android-accessibility-services.html/

It seems that they do the same thing as you by using Accessibility services but not getting the warning email from Google review team. FYI.

[kspearrin]

@samlu Well hopefully that applies to bitwarden as well (and other password apps) and not just LastPass because they have special contacts with the play store team.

[pehlm]

It's possible that passwordmanagers can receive reprieve "from possible upcoming removals from the Play Store" as they write on Androidauthority. So it's important to contact Google.

[kspearrin]

It's possible that passwordmanagers can receive reprieve "from possible upcoming removals from the Play Store" as they write on Androidauthority. So it's important to contact Google.

Anyone have a contact for Google? 😃

[pehlm]

The only one I've is https://docs.google.com/forms/d/e/1FAIpQLScem3Xhk4991YKhX3YtPUZ7_YSuFZGacdH5r5yFO8lrSMQNqA/viewform?usp=sf_link. But it's for Oreo Autofill API though.