Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When an app asks for permissions, it should have a “feed fake data” option

mastodon.gamedev.place

Post reply on HN
Print view View original

211–220 of 413 posts

Re: When an app asks for permissions, it should have a “feed fake data” option

#211

Post by floomk »

ryandrake wrote: post #90
mormegil wrote: post #45

Earlier quoted context omitted.

> apps could not require users to have “an account” in order to run There is some big qualification missing or I don't understand what does that even mean. How could a banking app run without an account? An online game? The Twitter app nowadays? Dropbox/Nextcloud/...? Etc. Yeah, I agree that for a lot of apps, requiring a account is just a marketing gimmick, but I don't think such a general rule could work.

Good question! We actually asked Apple exactly this when appealing the AppStore de-listing. How come others can require an account and we can't? What was it about our app that made us have to spend the engineering effort to add a guest login (this was a disingenuous argument that I advised against, since we deliberately spent engineering effort to require the login)? Their response, not the exact wording since it was…

> We're reviewing your app, not theirs, so what they can do is irrelevant

rules for thee but not for me

Apple has never been fair with its review, sadly.

> I would expect Apple's response to be "change it back".

Companies should not have to bend over to apple's whims just to get their software in end user hands. Hopefully upcoming EU regulation will reign apple's overreach in a bit.

Re: When an app asks for permissions, it should have a “feed fake data” option

#212

Post by jstummbillig »

dweinus wrote: post #182
jstummbillig wrote: post #150

Why do we need to be awful? Here is a simple rule: No is an option, unless it's really not an option. If it's not an option, you need to be very clear about why (in the app application process maybe), otherwise your app gets declined. i.e. if tiktok/ig asks for permissions on camera and microphone, no is an option, because you don't need either to use either. If parts of your app can feasibly be used by a user withou…

Sounds good, but enforcing it how? The only party here that can do the enforcing is the Google/Apple/Microsoft App Store. I'm not sure they all have the right incentives to expend the effort to enforce that in a consistent and user-friendly way. Otherwise would have already.

> The only party here that can do the enforcing is the Google/Apple/Microsoft App Store

Sounds good to me, though I think there should be a second component, which would be app sdks: Make designing with conditional permissions in mind a first class citizen, and create clear guidelines, as to how to do that, and why you really, really should do that.

> I'm not sure they all have the right incentives to expend the effort to enforce that in a consistent and user-friendly way. Otherwise would have already.

Alas, this is probably where legislation would so some convincing (see gdpr)

Re: When an app asks for permissions, it should have a “feed fake data” option

#213

Post by hvis »

Feeding actively random data can put you into a special category of users, though. If the recipient does any relevant analysis.

So if one was looking to preserve privacy and reduce one's own track-ability, sending ambient sounds and 5x5 island location might work against that.

Re: When an app asks for permissions, it should have a “feed fake data” option

#214

Post by rollcat »

iamcalledrob wrote: post #171
rollcat wrote: post #59

Earlier quoted context omitted.

> it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission. Meanwhile, WhatsApp still "punishes" users for denying contacts access by hiding everyone's names (only the phone numbers are shown), including for contacts that have their own names set in their own profiles. Facebook^W Meta is scum.

WhatsApp has always done this (to my knowledge). Phone numbers -> name resolution is done using your contact list. At least last time I checked. Usernames are not given much weight in the UI--there's no guarantee that my username reflects who I really am. Feels rightly more suspicious IMO to see a message from an unknown number than from "~Elon Musk". I believe this happens regardless of whether the app has contact p…

> Phone numbers -> name resolution is done using your contact list. At least last time I checked.

Nope. With contacts permission granted, unknown numbers turn into ~names (per user's own profile) automatically. When you revoke the permission, the ~name is hidden to punish you.

> [...] there's no guarantee that my username reflects who I really am. Feels rightly more suspicious IMO to see a message from an unknown number than from "~Elon Musk".

It's an entirely separate problem, and as old as mail itself (which predates computers by many millenia). Would you know whether to trust elonmusk@twitter.io, without looking it up?

Re: When an app asks for permissions, it should have a “feed fake data” option

#215

Post by progbits »

AmericanChopper wrote: post #208
dagmx wrote: post #184

Earlier quoted context omitted.

It prevents you from taking high resolution recordings , whether they’re screenshots or video. You either take a low resolution capture or the DRM layer prevents content from being displayed when recording. The legality of the subject is not something I’m talking about. You just asked for examples and I provided them.

For starters, it does nothing at all to prevent taking screen shots. Which is what this thread is about. As for high quality video capture, it is trivially easy to do. How do you think high quality copies of Netflix-only content ends up on the pirate bay they same day it comes out?

Yes it does. HD Netflix in Chrome, Edge or Safari will result in black rectangle when you screenshot it.

Re: When an app asks for permissions, it should have a “feed fake data” option

#216

Post by avar »

mormegil wrote: post #45
ryandrake wrote: post #27

I’m all for the “fake data” idea, but also: Apps should be required to gracefully handle the cases where users deny permission to access real data. I know last time I developed for iOS, it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission. Apps must gracefully handle it and continue running. Also, and this was even longer ago, apps could not require users…

> apps could not require users to have “an account” in order to run There is some big qualification missing or I don't understand what does that even mean. How could a banking app run without an account? An online game? The Twitter app nowadays? Dropbox/Nextcloud/...? Etc. Yeah, I agree that for a lot of apps, requiring a account is just a marketing gimmick, but I don't think such a general rule could work.

    > How could a banking app run without an account?
I use two banking apps that have a FAQ feature that's just a fancy wrapper for their respective online knowledge bases.

It's only due to laziness on their part that the entire app needs a login. Even if the only thing I'd like to do is browse the knowledge base.

Similarly, you shouldn't need to be logged in to queue up an arbitrary number of transactions. To execute them sure, but every banking app I've tried makes you login from the outset for no discernible reason.

Re: When an app asks for permissions, it should have a “feed fake data” option

#217

Post by knallfrosch »

ryandrake wrote: post #27

I’m all for the “fake data” idea, but also: Apps should be required to gracefully handle the cases where users deny permission to access real data. I know last time I developed for iOS, it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission. Apps must gracefully handle it and continue running. Also, and this was even longer ago, apps could not require users…

Apple allows Bloomberg even though it requires an account.

Re: When an app asks for permissions, it should have a “feed fake data” option

#219

Post by leshenka »

post-it wrote: post #135
grishka wrote: post #54

Earlier quoted context omitted.

> Apps should be required to gracefully handle the cases where users deny permission to access real data Or else? You're suggesting an organizational solution to a technical problem. This can't possibly work. Fake data is the only practical solution to this, such that the app would see the permission as granted when it is not actually granted.

The technical solution is to make the output of having denied permission identical to the output of there being no data. On iOS, if you deny permission to access devices on the local network, the app has no way of knowing - it just sees that there are no devices available.

> being no data

"but sure you have photos on your phone, if your phone tells me there aren't any then it's lying"

Yeah, fake data. I remember there was an Android Xposed(?) mod that did that, was quite funny to see heaps of fake names in contact list

Re: When an app asks for permissions, it should have a “feed fake data” option

#220

Post by rappatic »

kubik369 wrote: post #206

I am surprised no top comment mentions this — on iOS, you cannot distinguish if you were granted a permission or not. As an example, if an app asks you for access to your photos, it will always get an array. The trick is that when you deny this permission, the array will be empty, so you cannot know if the user simply has an empty library or if he denied you access. I like it, simple and elegant. Naturally, in the ca…

What about other permissions where you can't realistically send an empty object? For example, if the user grants permission to view location, the location object passed to the app will obviously have the pertinent information. Would the OS simply pass an empty location object and wouldn't that make it obvious that permission was denied? Or is it hidden behind some kind of error
Post reply on HN