Android 28如何无需权限读取接收短信？
Great question! I’ve dug into this exact scenario plenty of times—since Android 6.0 (API 23) locked down SMS permissions so tightly, it’s always been curious when apps skip asking for them entirely. Let’s break down the most common ways this works, from official tools to tricky workarounds:
1. Google’s SMS Retriever API (Official & Recommended)
This is the go-to method for reputable apps—it’s Google’s designed solution to get verification codes without touching SMS permissions. Here’s the breakdown:
- The app integrates the SMS Retriever API (part of Google Play Services) and registers a broadcast receiver.
- When your carrier sends the verification SMS, it needs to follow a strict format:
<#> Your verification code is 123456. FA+9qCX9VSu
- The critical pieces are the
<#>at the start, the verification code itself, and your app’s unique hash string at the end (generated using your app’s signing key and package name). - Google Play Services scans incoming SMS for this format, and if it matches, it pushes the code directly to your app. No SMS permissions are needed because Play Services handles the scanning behind the scenes.
To generate the required hash string, you can use Google’s command-line tool or a small AppSignatureHelper snippet from the Play Services library.
2. Notification Listener Service
This method doesn’t read SMS directly—it taps into the notifications your default SMS app sends when a new message arrives:
- The app asks for Notification Access (a system-level permission users enable in Settings, not runtime SMS permissions).
- Once enabled, the service can listen for notifications from your SMS app, extract the verification code from the notification text, and pass it to the app.
- It’s less reliable than the SMS Retriever API though—if your SMS app doesn’t show a notification, or hides the code in the expanded notification, it fails. Google also cracks down on apps abusing this permission for data harvesting.
3. Accessibility Service
This is a more aggressive approach that leverages Android’s accessibility features:
- The app requests Accessibility Permission (another system-level setting users have to manually enable).
- With this permission, the service can monitor your entire screen—including SMS popups, the SMS app’s interface, or even the keyboard when you type the code. It then extracts the verification code automatically.
- This is powerful but risky: accessibility permissions grant apps broad access to your device, so Google heavily audits apps using this method. If it’s not used for a legitimate accessibility purpose, the app might get removed from the Play Store.
A Quick Reality Check
Sometimes apps claim "no permissions required," but they’re actually asking for a different system permission (like Notification Access or Accessibility) that users might not link to SMS reading. The only truly permission-free method is the SMS Retriever API, since it relies entirely on Google Play Services to handle SMS scanning.
内容的提问来源于stack exchange，提问作者Jake warton
