Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

Post reply on HN
Print view View original

51–60 of 502 posts

Re: Everyone knows all the apps on your phone

#51

Post by JohnFen »

marcodiego wrote: post #37
JohnFen wrote: post #30

Earlier quoted context omitted.

How does that address the problem? Does F-Droid do some sort of additional screening to keep out apps that do this?

First, f-droid only accepts OSS apps, so the incentives for spyware is simply not there. Second, anti-features are explicitly marked on f-droid. Third, f-droid apps are curated like a very rigorous linux repo.

Being an OSS app is not sufficient protection. Most OSS apps aren't terribly misbehaved, but some are. Being OSS in and of itself is not anything like a guarantee with this sort of thing.

> Third, f-droid apps are curated like a very rigorous linux repo.

Yes, I know. My question is is this one of the things they're screening for?

Re: Everyone knows all the apps on your phone

#52

Post by solardev »

Privacy issues aside, it's kinda cool reading about how Indians use their phones, and also how they use English. I'd never heard "beyond the pale" before, and I'm still not sure what the idea of "multiple Indias" means when some of them are Mexico and some are Africa...?

I've also never heard of the majority of the apps being analyzed or tracked. Must be such a different world out there.

Re: Everyone knows all the apps on your phone

#53

Post by refulgentis »

phony-account wrote: post #33
ctippett wrote: post #28

Earlier quoted context omitted.

Are you sure? I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong.

> I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong. On iOS an app developer will need to register in advance which external applications their app intends to query, and the list needs to be very short and motivated. [1] Incidentally, “I have a friend who says...” isn’t really a good citation anywhere outside Reddit - which HN…

I don't think it is worth being dismissive.

I snorted when I got to the self-important haughtiness about reddit.

Why?

- You immediately recognized what they meant.

- They weren't advancing a claim, they were indicating a basis for their interrogative, likely to avoid seeming naive when claiming it out of nowhere.

- The article we're commenting on describes the same mechanism you claim differentiates iOS. ("register in advance...which applications...intends to query, and the list needs to be very short and motivated.")

- I've worked heavily on iOS and Android since 2009. As close to a graybeard as you can get in mobile. I'm searching, reaching, grasping for any sign you've done anything other than Google and link the first article you saw, and I can't find _any_. At all. But I don't think that's wrong. You're trying. Why is it wrong for the person you asked to try too?

- There's strong signs you didn't read the article we're commenting on.

- If you had, it is unlikely you would have said iOS was differentiated, then laid out the exact same mechanism described in the article.

- There's strong signs you didn't read the article you linked.

- On iOS you can register URL schemes in a plist, these aren't "external applications you intend to query" and the list does not have to be "very short and motivated"

I get cranky too, but, I am grateful I recognize it is very reddit to cry Reddit and edit it out, or delete.

Re: Everyone knows all the apps on your phone

#54

Post by rashidujang »

solardev wrote: post #52

Privacy issues aside, it's kinda cool reading about how Indians use their phones, and also how they use English. I'd never heard "beyond the pale" before, and I'm still not sure what the idea of "multiple Indias" means when some of them are Mexico and some are Africa...? I've also never heard of the majority of the apps being analyzed or tracked. Must be such a different world out there.

From the context, what I gather was meant by the idea of "multiple Indias" was the socioeconomic status of different demographics in India and their app usage. The presence of specific apps gives a tell to which demographic they belong to.

In other words, the richest demographic used certain apps and was equated to folks in Mexico, followed by the less rich equated to folks in Indonesia and the poor to Sub-Saharan Africa.

Re: Everyone knows all the apps on your phone

#55

Post by DevKoala »

> How is knowing whether I have the Xbox or the Playstation app installed on my phone essential to their Swiggy's core functionality? How will knowing if I have the Naukri or Upstox app help them deliver groceries to my doorstep?

It is for fingerprinting purposes

Re: Everyone knows all the apps on your phone

#56

Post by Numerlor »

ranger_danger wrote: post #20
cheschire wrote: post #11

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Not only can most apps see the titles of all other open windows on the system, but they can log all your keystrokes, take screenshots, record audio/video of you or your screen, or copy/delete all the files in your home directory, without any explicit permission or notification. This is at least true for Windows and most traditional (X11 at least) *nix systems. That is one thing I think Android got right... by default…

On windows you shouldn't be able to do (most of) these directly with apps running under admin, though that's a small consolation when the browser is a normal process.

I'm not sure if we'll get away from these anytime soon as any out of the box solution will inherently limit the user's freedom that has persistently been there for decades on PCs

Re: Everyone knows all the apps on your phone

#57

Post by czk »

ctippett wrote: post #28
andsoitis wrote: post #26

> everyone knows all the alls on your phone On Android phones. iPhone doesn’t have this privacy deficiency.

Are you sure? I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong.

Not sure about the manifest but recently I've seen talk about some banking apps using SBSLaunchApplicationWithIdentifierAndURLAndLaunchOptions (undocumented function in SpringBoardServices) [0] to try to launch another app on the phone by the bundle id, and they can determine if it's installed or not.

They were using this trick to detect unauthorized apps on the phone.

https://blog.verichains.io/p/technical-analysis-improper-use...

[0] - https://gist.github.com/wh1te4ever/c7909dcb5b66c13a217b49ea3...

Re: Everyone knows all the apps on your phone

#58

Post by phony-account »

refulgentis wrote: post #53
phony-account wrote: post #33

Earlier quoted context omitted.

> I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong. On iOS an app developer will need to register in advance which external applications their app intends to query, and the list needs to be very short and motivated. [1] Incidentally, “I have a friend who says...” isn’t really a good citation anywhere outside Reddit - which HN…

I don't think it is worth being dismissive. I snorted when I got to the self-important haughtiness about reddit. Why? - You immediately recognized what they meant. - They weren't advancing a claim, they were indicating a basis for their interrogative, likely to avoid seeming naive when claiming it out of nowhere. - The article we're commenting on describes the same mechanism you claim differentiates iOS. ("register i…

> There's strong signs you didn't read the article you linked.

What could possibly indicate I didn’t read the article? Of course I read it. Isn’t your assumption of my bad faith also explicitly against HN’s guidelines?

> On iOS you can register URL schemes in a plist, these aren't "external applications you intend to query" and the list does not have to be "very short and motivated"

I’m also an iOS developer- and yes it does.

Re: Everyone knows all the apps on your phone

#59

Post by kelvinjps10 »

cheschire wrote: post #11

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

In windows you can there is a api for windows titles, I knwo because I was building an app that needed it

Re: Everyone knows all the apps on your phone

#60

Post by Jach »

Borealid wrote: post #21
zx8080 wrote: post #19

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!

When a user visits a play.google.com URL Google wants to be able to show either an "install" or a "launch" button contingent on whether the app is already installed. In other words, blame Google product management.

I don't buy this. Google has this information on their backend, they don't need to query any local state. Indeed, when I visit a play.google.com URL, google checks if my browser is logged in or not. If it is not, the default is "Install" no matter what. If I do have a session, then it's either "Install" if I don't have it installed, or "Install on more devices" if I do have it installed.
Post reply on HN