Android wallpaper images can threaten privacy • Hacker News Board

Re: Android wallpaper images can threaten privacy

#71

Post by elvischidera » Fri, Oct 08, 2021, 9:14 AM UTC

jeroenhd wrote: post #64

qwerty456127 wrote: post #61

Earlier quoted context omitted.

> Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Why can't these apps be restricted to certain folders you need them to access? I also feel like apps which abuse file system permissions to modify the user file system (e.g. create files useless to the user), let alone the system file system should be reported and banned. Any app should hav…

Google is working on that with scoped storage, but a lot of old code doesn't work with that yet and dropping the API would break tons of apps. They've been trying to kill general external storage for this reason since Android 4.4, but every time there's huge blowback from users and developers because "they're trying to take our file explorers" or whatever. In KDE Connect you already need to use the modern API to pick…

I don't think other concerns are less important to "privacy" concerns.

Each restriction just makes certain ideas/project impossible or less ideal [1].

Honestly as an Android dev, I will prefer devices come with these restrictions by default. Then there should be a "I don't give a f*ck" button in the device developer options settings.

The option can be hidden behind 10 screens. Audit rails can be added. Anything but completely eliminating power-use in the name of privacy.

1 - I couldn't implement some telemetry in this project because google yanked the ability to read process stats: https://elvischidera.com/2020-11-23-building-distributed-and...

They could have required a permission instead. Or inform the user about the process I'm observing.

The data I was looking to gather has nothing to do with the user, but the task itself.

Another example is the restrictions introduced in the Bluetooth API.

Not all use of these APIs are intended for stalking. It doesn't make sense to keep "dumbing" down devices.

PS: I'm not arguing about the validity of your concerns. I just wanted to add an alternate take which I felt was missing in this thread.

Re: Android wallpaper images can threaten privacy

#72

Post by qwerty456127 » Fri, Oct 08, 2021, 9:31 AM UTC

jeroenhd wrote: post #64

qwerty456127 wrote: post #61

Earlier quoted context omitted.

> Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Why can't these apps be restricted to certain folders you need them to access? I also feel like apps which abuse file system permissions to modify the user file system (e.g. create files useless to the user), let alone the system file system should be reported and banned. Any app should hav…

Google is working on that with scoped storage, but a lot of old code doesn't work with that yet and dropping the API would break tons of apps. They've been trying to kill general external storage for this reason since Android 4.4, but every time there's huge blowback from users and developers because "they're trying to take our file explorers" or whatever. In KDE Connect you already need to use the modern API to pick…

> but every time there's huge blowback from users and developers because "they're trying to take our file explorers" or whatever.

This is a justified blowback. The file explorers and system utilities (apps users actually want to access the whole file system) should be given full rights. Access rights should be managed, not denied for all the apps altogether. I would introduce separate permissions for full file system (incl. OS and other apps files) access, access to user files space only, access to specific directories.

PS: Can anybody recommend a really good file system explorer for Android? I would pay any reasonable single-time price but no ads and no subscriptions please.

Re: Android wallpaper images can threaten privacy

#73

Post by seaish » Fri, Oct 08, 2021, 10:16 AM UTC

zaik wrote: post #32

> This color extraction algorithm is basically a map from the set of all possible images to the RGB color space. The set is infinite and the RGB color space is limited by 2^24 combinations. Theoretically, this means every RGB combination is possible. I know this is missing the point of the article, but this is not how the pigeonhole principle works.

I'd guess at least half of the colors are extremely unlikely. Anything near the edge of the RGB cube would require some very uninspired artwork to show up in the set.

Re: Android wallpaper images can threaten privacy

#74

Post by nicce » Fri, Oct 08, 2021, 10:35 AM UTC

cute_boi wrote: post #56

nicce wrote: post #45

Earlier quoted context omitted.

Google cannot change the Linux kernel like they control Chromium or the most of the Android, so with Fuchia (or its kernel) they are more in control once again.

Again What has google done to make Chrome more privacy friendly when they have every control? I guess the answer is 0. So even with Fuchia I think it will be worse than Linux.

That was my whole point.

Re: Android wallpaper images can threaten privacy

#75

Post by [deleted] » Fri, Oct 08, 2021, 10:48 AM UTC

iggldiggl wrote: post #67

jeroenhd wrote: post #64

Earlier quoted context omitted.

Google is working on that with scoped storage, but a lot of old code doesn't work with that yet and dropping the API would break tons of apps. They've been trying to kill general external storage for this reason since Android 4.4, but every time there's huge blowback from users and developers because "they're trying to take our file explorers" or whatever. In KDE Connect you already need to use the modern API to pick…

They could have made the transition much more straightforward by just making the permissions system more granular (i.e. let the user pick a directory instead of simply asking storage access yes/no) and leaving the existing file APIs intact otherwise, just throw a permission error if you're accessing anything outside of the granted scope. Instead they tried to force through a completely new API that isn't compatible w…

[deleted]

Re: Android wallpaper images can threaten privacy

#76

Post by izacus » Fri, Oct 08, 2021, 10:48 AM UTC

iggldiggl wrote: post #67

jeroenhd wrote: post #64

Earlier quoted context omitted.

Google is working on that with scoped storage, but a lot of old code doesn't work with that yet and dropping the API would break tons of apps. They've been trying to kill general external storage for this reason since Android 4.4, but every time there's huge blowback from users and developers because "they're trying to take our file explorers" or whatever. In KDE Connect you already need to use the modern API to pick…

They could have made the transition much more straightforward by just making the permissions system more granular (i.e. let the user pick a directory instead of simply asking storage access yes/no) and leaving the existing file APIs intact otherwise, just throw a permission error if you're accessing anything outside of the granted scope. Instead they tried to force through a completely new API that isn't compatible w…

The "new API" has been available since Android 4.4 and was encouraged as default approach because it also worked with cloud storages, Chromebooks and other environment.

Please don't write this misleading stuff, nothing about SAF is new. It's just that it was easier for developers to hardcode paths and crap all over the storage than to open the file dialog.

Re: Android wallpaper images can threaten privacy

#77

Post by iggldiggl » Fri, Oct 08, 2021, 11:43 AM UTC

izacus wrote: post #76

iggldiggl wrote: post #67

Earlier quoted context omitted.

They could have made the transition much more straightforward by just making the permissions system more granular (i.e. let the user pick a directory instead of simply asking storage access yes/no) and leaving the existing file APIs intact otherwise, just throw a permission error if you're accessing anything outside of the granted scope. Instead they tried to force through a completely new API that isn't compatible w…

The "new API" has been available since Android 4.4 and was encouraged as default approach because it also worked with cloud storages, Chromebooks and other environment. Please don't write this misleading stuff, nothing about SAF is new. It's just that it was easier for developers to hardcode paths and crap all over the storage than to open the file dialog.

Using the SAF is quite a bit more complex than simply prompting the user to pick a folder and then using that as your base path, though.

Plus once apps developers were more seriously forced to use the SAF by recent Android versions, I've seen enough bug reports about actual shortcomings and performance problems of the SAF API on the Android bug tracker even for more recent Android versions.

And Google's simultaneous insistence on only allowing inter-app file sharing via content://-URIs has definitively broken all multi-file file formats, with no official replacement available.

Re: Android wallpaper images can threaten privacy

#78

Post by SavannahJS » Fri, Oct 08, 2021, 1:58 PM UTC

sa1 wrote: post #59

SavannahJS wrote: post #51

Earlier quoted context omitted.

Hey there, I work at FingerprintJS. We don't believe in third party tracking and only focus on first party anti-fraud use cases. We publicly reveal any methods that we detect as being pure third party tracking privacy violations so that they get patched.

I suspect first party anti-fraud tracking methods and third party tracking methods have a lot of overlap. What are meaningful differences?

It is certainly a discussion we are having internally often. Overall we focus on identifiers that are not uniquely identifiable to a person on their own without taking them in aggregate, which makes them harder to share across unrelated domains. We also generally avoid anything personally identifiable (name, email, etc) that could be tied back to anyone in particular - we aim only to accurately identify a browser or app instance itself.

Re: Android wallpaper images can threaten privacy

#79

Post by yumaikas » Fri, Oct 08, 2021, 4:58 PM UTC

vorejdajo wrote: post #13

It's not constant. I expect that people change wallpaper frequently.

I mean, I go and set up ASCIIQuarium on every phone I have. Hunting down the APK gets harder and harder though.

Re: Android wallpaper images can threaten privacy

#80

Post by mleonhard » Fri, Oct 08, 2021, 6:55 PM UTC

izacus wrote: post #22

Most apps will skip all that and just ask you to login before working. Much easier and they get your email ;)

Do you have anything to back up your claim?

I think the opposite is true: Nearly every app bundles an ad-serving or analytics library which uses fingerprinting techniques like this. Apps require login in addition to fingerprinting, not instead of it.

Analytics libraries are extremely easy to include. Some even get included without the knowledge of the developer. For example, when a Flutter app includes the Firebase library, it starts automatically sending user behavior data to Google. Specifically, it sends the title of every screen the user opens and how long they spend on it. This happens even on Flutter apps for iOS.