Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When an app asks for permissions, it should have a “feed fake data” option

mastodon.gamedev.place

Post reply on HN
Print view View original

351–360 of 413 posts

Re: When an app asks for permissions, it should have a “feed fake data” option

#351

Post by jet_32951 »

Nereuxofficial wrote: post #13
progbits wrote: post #3

XPrivacy for rooted android could do this 7+ years ago and there are other modern alternatives (but I haven't rooted my phone for a long time so I can't vouch for them): https://github.com/M66B/XPrivacy Obviously that is not mainstream, I agree it should come built in. But then both Android and iOS allow bullshit like region-locked apps or preventing screenshots from DRM content, so good luck with that.

XPrivacy was incredibly cool. But on modern phones rooting and installing Xposed has either gotten massively more complicated or disabled ougright. GrapheneOS wasn't working with banking apps, Google broke rooting via Magisk multiple times on the Android Beta and at some point and i stopped bothering. Maybe GrapheneOS or similar Projects could do this

GrapheneOS has implemented storage and contact scopes. Users can set a program's permitted storage environment. Similarly, contact scopes allows users to limit access to contacts that are tagged with a keyword. On my phone the 'special' contact group includes Djimn Hovnbg, with a number in Egypt, Blin Futtum'ch with a UK number, and so on.

Re: When an app asks for permissions, it should have a “feed fake data” option

#352

Post by chii »

jrumbut wrote: post #284
ryandrake wrote: post #90

Earlier quoted context omitted.

Good question! We actually asked Apple exactly this when appealing the AppStore de-listing. How come others can require an account and we can't? What was it about our app that made us have to spend the engineering effort to add a guest login (this was a disingenuous argument that I advised against, since we deliberately spent engineering effort to require the login)? Their response, not the exact wording since it was…

> Nobody listened to me, of course. Being the voice of "this is never, ever going to be accepted into the AppStore, it is a perfect example of what you can't do" can be a very lonely journey.

as long as you aren't the person who will ultimately pay for said failure, it doesn't matter if nobody listened to you. You just need the cover-your-ass evidence that you presented this evidence to the stakeholder (who is ultimately responsible for said failure).

Re: When an app asks for permissions, it should have a “feed fake data” option

#353

Post by MBCook »

tobr wrote: post #173
lldb wrote: post #161

Earlier quoted context omitted.

Worst offender is google photos on iOS - you can’t even open the app without giving it all photos access. Selected photos doesn’t count. Even just to view photos already saved in the cloud.

Discussed recently on ATP[1] - this is a huge security hole. If you give access to all photos, apparently the app can search through the EXIF data to extract locations and timestamps, and build up a very accurate timeline of your whereabouts. 1: https://atp.fm/542

Is it though?

If you want Google Photos to back up your photo library… it needs full access to everything to do that.

Very very few apps should need full photo access. But photo backups/cloud libraries are the one I can think of that do.

I was actually surprised no one on ATP brought that up.

Re: When an app asks for permissions, it should have a “feed fake data” option

#354

Post by smoldesu »

charcircuit wrote: post #343
kerkeslager wrote: post #305

Earlier quoted context omitted.

> When you are a platform owner it is important that you evaluate the needs of all stakeholders and not just the needs of the users of the platforms. I disagree. The literal entire purpose of every single non-user entity involved in this situation is to serve users, and if it's not serving users, then that's a systemic failure. If corporations want a place at the table, they should be serving users, and if they can't…

>they should be serving users Bringing content users want to watch is serving users. >DRM should be illegal, period Why? It is preventing users from doing illegal things. Saying that DRM should be removed so that users can make illegal copies of the media they are watching is not a strong argument to me. >Our economy should be designed to serve people, not corporations People make content and people want to be able t…

> People make content and people want to be able to have their copyright not be infringed.

Tough shit. Copyright is entirely arbitrary, and it's bad actors have ruined it for everyone else. DRM will be evil for as long as "buying isn't "owning"; until then piracy will be strictly superior.

> Computers by default make it way to easy to violate the copyright of creators

And my kitchen knives by default make it way too easy to violate homicide laws. You can argue it is overall more beneficial to the consumer to disadvantage themselves so the market can thrive, but that's still an anti-consumer market.

Re: When an app asks for permissions, it should have a “feed fake data” option

#355

Post by thombles »

iamcalledrob wrote: post #171
rollcat wrote: post #59

Earlier quoted context omitted.

> it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission. Meanwhile, WhatsApp still "punishes" users for denying contacts access by hiding everyone's names (only the phone numbers are shown), including for contacts that have their own names set in their own profiles. Facebook^W Meta is scum.

WhatsApp has always done this (to my knowledge). Phone numbers -> name resolution is done using your contact list. At least last time I checked. Usernames are not given much weight in the UI--there's no guarantee that my username reflects who I really am. Feels rightly more suspicious IMO to see a message from an unknown number than from "~Elon Musk". I believe this happens regardless of whether the app has contact p…

I discovered the other day that WhatsApp (on Android at least) will not let you start a conversation with someone without selecting them from your contacts.

Re: When an app asks for permissions, it should have a “feed fake data” option

#356

Post by l33t233372 »

grishka wrote: post #334
plorkyeran wrote: post #318

Earlier quoted context omitted.

That is what sanctions do, so either no politician has ever thought about the implication of sanctions or it's an intended effect.

There's two possible explanations. 1. They don't think about these kinds of second-order effects. They see that this company is somehow involved with the government and that's it. Their electorate won't care about these kinds of details because they're "doing something" to supposedly stop the war sooner. 2. They think that Russians would somehow revolt against the government. This doesn't work — the Russian governmen…

I strongly disagree that these are the only 2 possible explanations. The first is clearly not true — these second order effects are well known and often discussed, and the fact that sanctions are used in circumstances when the population is not expected to revolt shows that the second one isn’t the only remaining reason to use sanctions.

Re: When an app asks for permissions, it should have a “feed fake data” option

#357

Post by userbinator »

wlesieutre wrote: post #328
ryandrake wrote: post #27

I’m all for the “fake data” idea, but also: Apps should be required to gracefully handle the cases where users deny permission to access real data. I know last time I developed for iOS, it was Apple’s policy that apps cannot punish users or exit() the app in retaliation for them denying a permission. Apps must gracefully handle it and continue running. Also, and this was even longer ago, apps could not require users…

I don't mind fake personal data, like contacts or photos, but once you get into locations I'm iffy. If it's being used locally for showing your location on a map, or searching for nearby businesses, sure, give it fake data. But if you're talking about an app that does internet speed tests and maps the speeds for different cellular providers, or lets users report local weather conditions to improve forecasts, then I h…

True freedom is freedom to do things that others might not like.

Re: When an app asks for permissions, it should have a “feed fake data” option

#358

Post by wlesieutre »

userbinator wrote: post #357
wlesieutre wrote: post #328

Earlier quoted context omitted.

I don't mind fake personal data, like contacts or photos, but once you get into locations I'm iffy. If it's being used locally for showing your location on a map, or searching for nearby businesses, sure, give it fake data. But if you're talking about an app that does internet speed tests and maps the speeds for different cellular providers, or lets users report local weather conditions to improve forecasts, then I h…

True freedom is freedom to do things that others might not like.

Like the freedom to operate a service that only accepts real location data?

Re: When an app asks for permissions, it should have a “feed fake data” option

#360

Post by techwizrd »

thaeli wrote: post #286
techwizrd wrote: post #268

I can see why this would be useful, but we already spend a lot of time chasing down data quality issues in AI/ML models and statistics as-is. We may be requesting permissions to workaround/correct GPS accuracy issues, comply with local regulations, or turn on a feature flag. For example, if you're on your home network I should hit HomeAssistant via a different route than if you're away from home. Or maybe local regul…

As a user, I don't care about your ML model. I care about not sending you personal info. Coarser info isn't good enough - you can convince me you actually deserve my real info, or you can get no info (preferable), or you can get fake info (alternative if you degrade or break my user experience because I wouldn't give you that info). I understand there are some legit use cases for validated info. Unfortunately, target…

You should care. My point is give me coarser info or no info, but not fake information—and I say this as a researcher working on synthetic data generation methods to improve privacy. Fake information is a pain for developers _and_ users. Unreliable fake data has real, significant (and potentially disastrous) consequences that are often difficult to anticipate.
Post reply on HN