Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

Post reply on HN
Print view View original

61–70 of 502 posts

Re: Everyone knows all the apps on your phone

#61

Post by bcoates »

cheschire wrote: post #11

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Windows has a whole different (looser, older) security model. There are no security barriers between windows running on the same desktop. (In particular, "UAC is [still] not a security barrier"--when you hit ok/type in a password to elevate a process, you’re effectively elevating the whole desktop and everything you're running.)

Re: Everyone knows all the apps on your phone

#62

Post by swat535 »

phony-account wrote: post #33
ctippett wrote: post #28

Earlier quoted context omitted.

Are you sure? I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong.

> I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong. On iOS an app developer will need to register in advance which external applications their app intends to query, and the list needs to be very short and motivated. [1] Incidentally, “I have a friend who says...” isn’t really a good citation anywhere outside Reddit - which HN…

Is that also the case for alt-store apps available in EU ?

Re: Everyone knows all the apps on your phone

#63

Post by yjftsjthsd-h »

myself248 wrote: post #23
cheschire wrote: post #11

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Oh yeah, AutoHotKey's ability to do this actually underlies a lot of useful AHK scripts.

Right; I think having the API exist is a good thing, it's just a question of making sure that it's only used in ways that the user allows. Your own scripts inspecting and controlling arbitrary windows on your own machine => great, third party programs doing the same thing without your informed consent => bad. (In practice, this means I'm a big fan of extensive permission systems that have the ability to deny or fake responses at the user's direction)

Re: Everyone knows all the apps on your phone

#64

Post by milesrout »

solardev wrote: post #52

Privacy issues aside, it's kinda cool reading about how Indians use their phones, and also how they use English. I'd never heard "beyond the pale" before, and I'm still not sure what the idea of "multiple Indias" means when some of them are Mexico and some are Africa...? I've also never heard of the majority of the apps being analyzed or tracked. Must be such a different world out there.

Beyond the pale is commonly used in English. A pale is a stake, and it means beyond the boundary (set out by a fence with stakes, hence the phrase) of what is acceptable. It gaines popularity in the mid 19th century. It may be related to the term "the Pale" which referred to the better controlled more Anglicised part of Ireland around Dublin, but there isn't enough evidence to be sure of this. Certainly not an Indianism anyway.

>I'm still not sure what the idea of "multiple Indias" means when some of them are Mexico and some are Africa...?

Is it not pretty obvious? It is like the phrase "middle America". It doesn't literally mean a different country. It means different wealth categories: the Indians that when considered as a whole are economically equivalent roughly to Mexico, those roughly equivalent to Indonesia (poorer) and those roughly equivalent to Sub-Saharan Africa (poorest). There are ~1b Indians that are still so poor they aren't realistically in the market for your startup app if it wants its customers to ever spend anything, there are ~300m Indians that could be in the market for some apps, but probably mostly free ad-funded ones, and there are ~150m Indians that are quite a good market because they will happily spend money on something that provides value.

I got all this just from reading the post btw.

Re: Everyone knows all the apps on your phone

#65

Post by jorvi »

bcoates wrote: post #61
cheschire wrote: post #11

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Windows has a whole different (looser, older) security model. There are no security barriers between windows running on the same desktop. (In particular, "UAC is [still] not a security barrier"--when you hit ok/type in a password to elevate a process, you’re effectively elevating the whole desktop and everything you're running.)

No, that is completely wrong and would be nuts. The only way the whole session gets elevated is if you'd launch explorer.exe with an admin token.

The way privilege escalation works on Windows is that pretty much everything gets launched with a standard user access token by default, and processes can request an admin access token in a few ways, UAC being the main one. When a process is supplied that token, that process is elevated.

It is more akin to 'sudo' rather than 'su', which makes sense because its progenitor is 'runas' from Windows 2000.

Re: Everyone knows all the apps on your phone

#66

Post by charcircuit »

lurking_swe wrote: post #42
jerbear4328 wrote: post #25

Earlier quoted context omitted.

How would the OS know if the app that the browser is querying about is actually the current page? For all the OS knows, the user might be quickly visiting a ton of play.google.com pages for the top 1000 apps on the app store.

> How would the OS know if the app that the browser is querying about is actually the current page? Maybe i’m missing something, but it sounds like it would be easy for google to support this functionality by letting developers configure this in their app “bundle”. A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must.

Intent filters can be for domains. It's how deeplinks work. But with querying being locked down you can't know what apps can handle a deeplink.

Re: Everyone knows all the apps on your phone

#67

Post by SpaghettiCthulu »

bcoates wrote: post #61
cheschire wrote: post #11

Can windows apps (not installed from the MS store) enumerate through the window titles of all open windows? How hard would it be for an app to monitor all of your web traffic based on the title alone? Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.

Windows has a whole different (looser, older) security model. There are no security barriers between windows running on the same desktop. (In particular, "UAC is [still] not a security barrier"--when you hit ok/type in a password to elevate a process, you’re effectively elevating the whole desktop and everything you're running.)

Can you inject into an elevated process from a non-elevated one?

Re: Everyone knows all the apps on your phone

#68

Post by bcoates »

jorvi wrote: post #65
bcoates wrote: post #61

Earlier quoted context omitted.

Windows has a whole different (looser, older) security model. There are no security barriers between windows running on the same desktop. (In particular, "UAC is [still] not a security barrier"--when you hit ok/type in a password to elevate a process, you’re effectively elevating the whole desktop and everything you're running.)

No, that is completely wrong and would be nuts. The only way the whole session gets elevated is if you'd launch explorer.exe with an admin token. The way privilege escalation works on Windows is that pretty much everything gets launched with a standard user access token by default, and processes can request an admin access token in a few ways, UAC being the main one. When a process is supplied that token, that proces…

(Only) the process is elevated, but the process has a window on a shared session, and the OS does not successfully protect processes that share a session (and user, and registry, and disk, etc., etc.) from controlling each other.

From an API point of view, only one process is elevated. From a security point of view, if one process is elevated they all are, due to a lack of any effective mechanism that actually stops them.

Re: Everyone knows all the apps on your phone

#69

Post by captn3m0 »

The ACTION_MAIN loophole has been written about before: https://commonsware.com/blog/2020/04/05/android-r-package-vi...

Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass.

There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331

Re: Everyone knows all the apps on your phone

#70

Post by solardev »

milesrout wrote: post #64
solardev wrote: post #52

Privacy issues aside, it's kinda cool reading about how Indians use their phones, and also how they use English. I'd never heard "beyond the pale" before, and I'm still not sure what the idea of "multiple Indias" means when some of them are Mexico and some are Africa...? I've also never heard of the majority of the apps being analyzed or tracked. Must be such a different world out there.

Beyond the pale is commonly used in English. A pale is a stake, and it means beyond the boundary (set out by a fence with stakes, hence the phrase) of what is acceptable. It gaines popularity in the mid 19th century. It may be related to the term "the Pale" which referred to the better controlled more Anglicised part of Ireland around Dublin, but there isn't enough evidence to be sure of this. Certainly not an Indian…

Makes sense, thanks! I love reading about how other cultures do software.
Post reply on HN