> Fingerprinting devices to detect unusual logging activity? This is common. Heck, I've had Google lock me out until I confirmed with my recovery email after logging in from a new device. Much more common is simply getting an email after logging in from a new device. The most common method of doing this is for desktop sites is, I assume, IP address; which obviously does not work for phones.
This is too heavy-handed. Capital One lets me log in from any computer browser anywhere using just my username and password. As of Marshmallow,
> The most straightforward solution to identifying an application instance running on a device is to use an Instance ID, and this is the recommended solution in the majority of non-ads use-cases. Only the app instance for which it was provisioned can access this identifier, and it's (relatively) easily resettable because it only persists as long as the app is installed.
https://developer.android.com/training/articles/user-data-id...
The only pertinent use case the document details for using Phone permission for a credit card app:
> Abuse detection: Detecting high value stolen credentials
> In this case, you are trying to detect if a single device is being used multiple times with high-value, stolen credentials (e.g. to make fraudulent payments).
> We Recommend: IMEI/IMSI (requires PHONE permission group in Android 6.0 (API level 23) and higher.)
> Why this Recommendation?
> With stolen credentials, devices can be used to monetize multiple high value stolen credentials (such as tokenized credit cards). In these scenarios, software IDs can be reset to avoid detection, so hardware identifiers may be used.
but the capital one app does none of those things! Even if it did, I'd imagine I am a pretty average user and all I want to be able to do is look at my list of transactions and pay my credit card bill every month and maybe cash out my reward. The phone permission can wait until you really need it.
If we criticize Amazon for encouraging users to make their devices less secure https://www.amazon.com/gp/help/customer/display.html?nodeId=... then we should criticize Capital One for permissions proliferation as well.