Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

21–30 of 502 posts

Re: Everyone knows all the apps on your phone

#21
post #19

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!

When a user visits a play.google.com URL Google wants to be able to show either an "install" or a "launch" button contingent on whether the app is already installed.

In other words, blame Google product management.

Re: Everyone knows all the apps on your phone

#22
post #19

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!

[deleted]

Re: Everyone knows all the apps on your phone

#23

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Oh yeah, AutoHotKey's ability to do this actually underlies a lot of useful AHK scripts.

Re: Everyone knows all the apps on your phone

#24
post #19

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!

When a user visits a play.google.com URL Google wants to be able to show either an "install" or a "launch" button contingent on whether the app is already installed. In other words, blame Google product management.

this doesn’t make sense and sounds like an excuse IMO.

Instead of the browser enumerating all apps, why can’t it check when you visit a page if the current page (ONLY the current page) is installed as an app?

Re: Everyone knows all the apps on your phone

#25

Earlier quoted context omitted.

When a user visits a play.google.com URL Google wants to be able to show either an "install" or a "launch" button contingent on whether the app is already installed. In other words, blame Google product management.

this doesn’t make sense and sounds like an excuse IMO. Instead of the browser enumerating all apps, why can’t it check when you visit a page if the current page (ONLY the current page) is installed as an app?

How would the OS know if the app that the browser is querying about is actually the current page? For all the OS knows, the user might be quickly visiting a ton of play.google.com pages for the top 1000 apps on the app store.

Re: Everyone knows all the apps on your phone

#28

> everyone knows all the alls on your phone On Android phones. iPhone doesn’t have this privacy deficiency.

Are you sure? I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong.

Re: Everyone knows all the apps on your phone

#29

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Not only can most apps see the titles of all other open windows on the system, but they can log all your keystrokes, take screenshots, record audio/video of you or your screen, or copy/delete all the files in your home directory, without any explicit permission or notification. This is at least true for Windows and most traditional (X11 at least) *nix systems. That is one thing I think Android got right... by default…

Originally Android apps could draw over top of any other app though which is a phishing nightmare. It took them a long time to make that a permission, and then everyone granted it until they finally added the bubbles API recently.

Permissions are difficult to get right, and Android is unfortunately pretty slow to react.

Post reply on HN