How do app permissions work in WP8/8.1? For example, what prevents a developer from slipping in code that skirts past the Windows Store that secretly mines bitcoins for him at the expense of your bandwidth/battery/cpu?
Well, the only way that any app other than a location aware app or background music app can run anything is if it is in the foreground. Is it on your screen? If no, then it's not running. So bitcoin mining would have to take place in an app that uses location services or background music services - AND you'd have to start the app (stop it by backing out instead of hitting start button).
If a developer tries to use services that are not listed in the app manifest (which is what you see when you install an app), it will throw an exception - the app will close.
I love how msft tells you that you can deny app permissions (like locations when totally not necessary and mostly because msft demands the developer do it) but conveniently leaves out you can't use the app without extending the demanded permissions. double talk at best.