SMS Retriever API and POLA (Principle Of Least Astonishment)

hi,

@mar-v-in you are my hero, thanks for your work!

i've been a user of microg for quite a while. it works so well that it has been mostly out of sight and out of mind. but the downside to that is that i haven't been following the project closely.,,

i had to register today with a crappy app that required SMS verification, and suddenly i was horribly shocked: the crappy app got the content of an SMS directed to me without my permission!!

i got online a did a brief research, found out about the SMS Retriever API, and its microG implementation.

so it worked as intended. but maybe i wanted to register the app in a different phone from the one that had the sim card or in an emulator, and maybe the sim card phone also had the app installed (though not logged in), and what would have happened then.

because microg is privacy focused, i think it violated POLA, and it got me deep into a rabbit hole of ever bloating play services.

i immediately ran into microG permission settings and stripped SMS from them, hoping this offense would never repeat.

would you maybe consider taking the surprise element out of this feature?

• the laziest way by far would be to add text to the SMS permission in "self-check". something like: "This permission enables applications that do not have the SMS permission to automatically verify your phone number via a specially crafted incoming SMS." (had this text been there, i would have never granted this permission in the first place.)
• next level would be a new toggle in "play store services" (which i would suggest should be off by default).
• finally, since microg already prompts the user under some conditions (eg, before app auth request to google), maybe it would not be too much work to prompt the user before a hash-marked SMS is forwarded to an app: "Allow application 'Bright Sparkling Trojan' to access the the following received SMS? blahblah". (but of course this last option might be too much work.)

again, thank you for your vital work.

Start with play-services-auth-api-phone/src/main/java/com/google/android/gms/auth/api/phone/SmsRetrieverApi.java and review the SMS Retriever API behavior described in the issue. Compare the proposed permission text, settings toggle, and confirmation prompt options; done requires an agreed privacy-preserving behavior for SMS forwarding.