Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

11–20 of 502 posts

Re: Everyone knows all the apps on your phone

#11
Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone?

Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Re: Everyone knows all the apps on your phone

#12
post #9

Can you see in the Play store before installing an app exactly which other apps it's allowed to talk to? Can you see it on your phone and override?

No, not in any straightforward way, although you can theoretically:

1. download the APK from a mirror site

2. disassemble it to get the android manifest

3. inspect the android manifest to check for the things the blog post discusses

Re: Everyone knows all the apps on your phone

#13

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Most windows apps aren't sandboxed, so them being able to grab window titles is the least of your worries. Any program can steal your login sessions and passwords if they wanted to.

https://xkcd.com/1200/

Re: Everyone knows all the apps on your phone

#15
post #13

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Most windows apps aren't sandboxed, so them being able to grab window titles is the least of your worries. Any program can steal your login sessions and passwords if they wanted to. https://xkcd.com/1200/

Are you essentially discussing like a keylogger? I can't imagine windows intentionally keeps the plaintext password anywhere longer than it needs to be.

Re: Everyone knows all the apps on your phone

#16

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Yep, not difficult at all.

This prompt got me some mostly looks OK Python

> Can you make a simple windows program that will get all the window titles from active programs running

Re: Everyone knows all the apps on your phone

#17
post #6

Just wow. I assumed that Google patched this few years back but guess they left a few backdoors.

It's probably an oversight than a "backdoor". They already have a "frontdoor" in the form of a permission that's pre-granted to them by the OS, so there's little need for them to devise backdoors like the android.intent.action.MAIN query that the blog post mentions.

Re: Everyone knows all the apps on your phone

#18
post #13

Earlier quoted context omitted.

Most windows apps aren't sandboxed, so them being able to grab window titles is the least of your worries. Any program can steal your login sessions and passwords if they wanted to. https://xkcd.com/1200/

Are you essentially discussing like a keylogger? I can't imagine windows intentionally keeps the plaintext password anywhere longer than it needs to be.

Obviously there's no way for a malicious program to grab your login credentials that you've entered into an incognito tab that have been closed. There might not be sandboxing, but viruses can't timetravel yet. However that's not going to be much of a defense when many users use password managers, and are terrible at detecting malware (so it's only a matter of time before their passwords are keylogged).

Re: Everyone knows all the apps on your phone

#19
> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps.

Why would browser need to enumerate the installed apps?

Why?!

Re: Everyone knows all the apps on your phone

#20

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Not only can most apps see the titles of all other open windows on the system, but they can log all your keystrokes, take screenshots, record audio/video of you or your screen, or copy/delete all the files in your home directory, without any explicit permission or notification.

This is at least true for Windows and most traditional (X11 at least) *nix systems.

That is one thing I think Android got right... by default it runs every application as a different user. That means different home folders and no visibility into other apps.

Post reply on HN