Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When an app asks for permissions, it should have a “feed fake data” option

mastodon.gamedev.place

Post reply on HN
Print view View original

281–290 of 413 posts

Re: When an app asks for permissions, it should have a “feed fake data” option

#281

Post by spacebanana7 »

tobr wrote: post #173
lldb wrote: post #161

Earlier quoted context omitted.

Worst offender is google photos on iOS - you can’t even open the app without giving it all photos access. Selected photos doesn’t count. Even just to view photos already saved in the cloud.

Discussed recently on ATP[1] - this is a huge security hole. If you give access to all photos, apparently the app can search through the EXIF data to extract locations and timestamps, and build up a very accurate timeline of your whereabouts. 1: https://atp.fm/542

I wish Apple stripped sensitive metadata from photos by default when interacting with third party apps/sites. The few services that actually need this data could request an additional permission.

As an app developer I don’t want users to send me location metadata with their photos, but there’s no easy way to communicate this to non-technical users.

Re: When an app asks for permissions, it should have a “feed fake data” option

#282

Post by viraptor »

techwizrd wrote: post #268

I can see why this would be useful, but we already spend a lot of time chasing down data quality issues in AI/ML models and statistics as-is. We may be requesting permissions to workaround/correct GPS accuracy issues, comply with local regulations, or turn on a feature flag. For example, if you're on your home network I should hit HomeAssistant via a different route than if you're away from home. Or maybe local regul…

I understand all of those concerns, but... as a user they're not my problem.

For example I don't care about where I am and neither should you for legal issues or features. This results is situations like me going no holiday and the bank app failing to work/install because they don't have presence in X country. Wanna know if the usage complies with regulations or I want a feature? Ask me, don't guess.

Wanna know how to access my HomeAssistant? Ask me, because there's a ZeroTier network making HA available directly wherever I am.

For fraud prevention it's not necessary to know more of my tracking info. It just makes it easier for the company at the cost of privacy issues for me.

I get the developer's view here, it's harder when someone feeds you wrong data. Tough, we're supposed to deal with that as devs and maybe just ask the question directly rather than guessing through other means. You should be doing that already, because GPS is not always reliable, contacts change, people have complex lives in terms of which laws apply to them.

Re: When an app asks for permissions, it should have a “feed fake data” option

#283

Post by charcircuit »

immibis wrote: post #167
charcircuit wrote: post #19

This will just make app developers angry at your platform. If this is just some hack users are doing apps will increasingly use attestation to make sure you are not feeding them fake data. Apps want to be able to give users a good user experience and if they are given fake data users will get angry that the developer's app is broken and leave 1 star reviews. Denying permissions and letting apps know something is deni…

Fine, then don't make an app. Your loss, not mine.

If you are building an app platform the whole point is to get as many quality apps on it as you can. Telling app developers to go pound sand and not make an app for your platform is your loss.

Re: When an app asks for permissions, it should have a “feed fake data” option

#284

Post by jrumbut »

ryandrake wrote: post #90
mormegil wrote: post #45

Earlier quoted context omitted.

> apps could not require users to have “an account” in order to run There is some big qualification missing or I don't understand what does that even mean. How could a banking app run without an account? An online game? The Twitter app nowadays? Dropbox/Nextcloud/...? Etc. Yeah, I agree that for a lot of apps, requiring a account is just a marketing gimmick, but I don't think such a general rule could work.

Good question! We actually asked Apple exactly this when appealing the AppStore de-listing. How come others can require an account and we can't? What was it about our app that made us have to spend the engineering effort to add a guest login (this was a disingenuous argument that I advised against, since we deliberately spent engineering effort to require the login)? Their response, not the exact wording since it was…

> Nobody listened to me, of course.

Being the voice of "this is never, ever going to be accepted into the AppStore, it is a perfect example of what you can't do" can be a very lonely journey.

Re: When an app asks for permissions, it should have a “feed fake data” option

#285

Post by Dylan16807 »

floomk wrote: post #256
marvin wrote: post #225

Earlier quoted context omitted.

You’re celebrating the possibility that EU regulation will remove Apple’s ability to enforce good user experience?

No one is forcing you to install anything you don't want to. The only thing I want is having the ability to install anything I want to. If you don't want to install those things the solution is simple: Don't. You don't need Apple to make that decision for you.

While I wish I lived in a world of perfect competition, I also realize that I don't. System-wide rules against bad behavior are a lot more efficient.

> You don't need Apple to make that decision for you.

I also don't need an app making the decision of whether I need an account. Apple preserves that choice for users. And they're not making any decisions for the user about installing. Effectively zero apps will leave the store over this rule, so the user retains full choice over installing.

Re: When an app asks for permissions, it should have a “feed fake data” option

#286

Post by thaeli »

techwizrd wrote: post #268

I can see why this would be useful, but we already spend a lot of time chasing down data quality issues in AI/ML models and statistics as-is. We may be requesting permissions to workaround/correct GPS accuracy issues, comply with local regulations, or turn on a feature flag. For example, if you're on your home network I should hit HomeAssistant via a different route than if you're away from home. Or maybe local regul…

As a user, I don't care about your ML model. I care about not sending you personal info. Coarser info isn't good enough - you can convince me you actually deserve my real info, or you can get no info (preferable), or you can get fake info (alternative if you degrade or break my user experience because I wouldn't give you that info).

I understand there are some legit use cases for validated info. Unfortunately, targeted advertising and other types of profiling are also common use cases for the same info. It's a lot like MAC randomization on public wifi - it sucks, it breaks legit use cases, but it was needed because too many companies were using it to track people.

Re: When an app asks for permissions, it should have a “feed fake data” option

#287

Post by samtho »

This will only start a cat and mouse game between app developers and users feeding junk data. There will be statistical tells or artifacts in fake data that will be identified which will prompt vendors to improve the entropy or patterns it creates.

The only solution (for a non development/testing uses) is for applications to accept no as an answer.

Re: When an app asks for permissions, it should have a “feed fake data” option

#288

Post by Groxx »

flutas wrote: post #100
Nereuxofficial wrote: post #13

Earlier quoted context omitted.

XPrivacy was incredibly cool. But on modern phones rooting and installing Xposed has either gotten massively more complicated or disabled ougright. GrapheneOS wasn't working with banking apps, Google broke rooting via Magisk multiple times on the Android Beta and at some point and i stopped bothering. Maybe GrapheneOS or similar Projects could do this

FWIW: Rooting seems fairly easy at this point in time , at least for pixel devices. Flash with magisk, install Universal Safetynet Fix ( https://github.com/Displax/safetynet-fix/ ) and you're passing safetynet / play integrity API. I haven't come across a single app that doesn't work due to root currently, but I limit my installed apps.

Last time I tried to use magisk on my pixel it was a complete fustercluck (about a year ago). I ended up having to patch together multiple fixes in multiple forum threads, and manually pick apart and patch the firmware package, because nothing worked at all for months on end, on a completely stock device.

I have kinda lost faith in it. And it doesn't help that it tries to do everything internally, so you can't e.g. download your pre-patch blobs or upload them after it loses track of them, because it does everything exclusively in complicatedly-magically-named internal folders. There is some seriously bonkers decision-making going on in it.

Re: When an app asks for permissions, it should have a “feed fake data” option

#289

Post by jcul »

Nereuxofficial wrote: post #13
progbits wrote: post #3

XPrivacy for rooted android could do this 7+ years ago and there are other modern alternatives (but I haven't rooted my phone for a long time so I can't vouch for them): https://github.com/M66B/XPrivacy Obviously that is not mainstream, I agree it should come built in. But then both Android and iOS allow bullshit like region-locked apps or preventing screenshots from DRM content, so good luck with that.

XPrivacy was incredibly cool. But on modern phones rooting and installing Xposed has either gotten massively more complicated or disabled ougright. GrapheneOS wasn't working with banking apps, Google broke rooting via Magisk multiple times on the Android Beta and at some point and i stopped bothering. Maybe GrapheneOS or similar Projects could do this

FWIW,I just installed GrapheneOS this week and banking apps have been working fine (though no Google pay).

Also, as a sibling comment mentioned, I have used magisk + safety net fix in the past, and had no issues with banking apps or Google pay.

Re: When an app asks for permissions, it should have a “feed fake data” option

#290

Post by jcul »

rocho wrote: post #270
flutas wrote: post #100

Earlier quoted context omitted.

FWIW: Rooting seems fairly easy at this point in time , at least for pixel devices. Flash with magisk, install Universal Safetynet Fix ( https://github.com/Displax/safetynet-fix/ ) and you're passing safetynet / play integrity API. I haven't come across a single app that doesn't work due to root currently, but I limit my installed apps.

Last time I tried this I wasted many hours but couldn't make Google Wallet work. SafetyNet was passing but Wallet was still disallowing any card operations.

I think you need to hide root for Google wallet and some other Google services app(s).

And wipe their storage / cache too so they start from a clean slate.

Post reply on HN