
Cloak and dagger: taking control of the Android UI feedback loop - robinhouston
https://blog.acolyer.org/2017/06/23/cloak-and-dagger-from-two-permissions-to-complete-control-of-the-ui-feedback-loop
======
jsiepkes
"SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE. If an app can gain both
of these permissions, it’s game on"....I mean c'mon....even before looking it
up I could guess that BIND_ACCESSIBILITY_SERVICE would give an app broad
permissions.

