Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

Post reply on HN
Print view View original

71–80 of 502 posts

Re: Everyone knows all the apps on your phone

#71

Post by jorvi »

bcoates wrote: post #68
jorvi wrote: post #65

Earlier quoted context omitted.

No, that is completely wrong and would be nuts. The only way the whole session gets elevated is if you'd launch explorer.exe with an admin token. The way privilege escalation works on Windows is that pretty much everything gets launched with a standard user access token by default, and processes can request an admin access token in a few ways, UAC being the main one. When a process is supplied that token, that proces…

(Only) the process is elevated, but the process has a window on a shared session, and the OS does not successfully protect processes that share a session (and user, and registry, and disk, etc., etc.) from controlling each other. From an API point of view, only one process is elevated. From a security point of view, if one process is elevated they all are, due to a lack of any effective mechanism that actually stops…

No, even then there are things like Mandatory Integrity Control and Windows Message Restrictions / UIAccess. I'd dive into to deeper but I just got home from going out haha. Those terms should help you dig into it though!

I do fully agree that desktop OSes are a legacy security model and they can't hold a candle to that of iOS. Android is getting there, but because it also started from mostly an open all-access model it's been having the same warts.

Re: Everyone knows all the apps on your phone

#73

Post by wkat4242 »

billfruit wrote: post #72

Some apps like Obsidian needs permission to access every file on the device. It is surprising Obsidian isn't getting called out on that very much.

It's because it stores the files there so you can sync them with other permissions. And also that your notes aren't deleted like they would be if they were stored in the internal app storage. There's more granular options for filesystem access available but if you implement them you limit yourself to the latest Android releases.

According to Exodus it has no trackers and it's an open source app also so you can see what it does (though tbh I didn't check that for the mobile one)

If there's apps to call out there's way worse than Obsidian.

Re: Everyone knows all the apps on your phone

#74

Post by justonenote »

facile3232 wrote: post #15
gruez wrote: post #13

Earlier quoted context omitted.

Most windows apps aren't sandboxed, so them being able to grab window titles is the least of your worries. Any program can steal your login sessions and passwords if they wanted to. https://xkcd.com/1200/

Are you essentially discussing like a keylogger? I can't imagine windows intentionally keeps the plaintext password anywhere longer than it needs to be.

ita disconcerting to see such naivety around security issues on hn.

not that windows is keeping passwords in plaintext, but that it's not immediately obvious that un-sandboxed apps that run on your windows/linux/mac desktop have virtually unlimited other avenues to capture passwords given they can read the entire state of other windows at the very least.

I dunno maybe macos is slightly better, and wayland definitely has some things which are better about this, but desktop os and $locally_installed_app means $locally_installed_app basically has root, there is just an exploding amount of vectors.

I'd like to see a linux based distrubution use some of the sandboxing in Android, it would be a order of magnitude improvement over what is going on now.

Re: Everyone knows all the apps on your phone

#75

Post by codethief »

lurking_swe wrote: post #42
jerbear4328 wrote: post #25

Earlier quoted context omitted.

How would the OS know if the app that the browser is querying about is actually the current page? For all the OS knows, the user might be quickly visiting a ton of play.google.com pages for the top 1000 apps on the app store.

> How would the OS know if the app that the browser is querying about is actually the current page? Maybe i’m missing something, but it sounds like it would be easy for google to support this functionality by letting developers configure this in their app “bundle”. A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must.

> A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must.

Elaborating on the sibling's comment: There is already such a property that apps must set in their manifests in order for them to be able to react to links/intents for domain-associated-with-the-app.com.

But it doesn't address the question of how a browser is supposed to be able to open links to domain-associated-with-the-app.com in that app, without Android revealing to the browser whether the app is installed or not. In short: The browser will, by construction, be able to determine which apps you've got installed or not.

Re: Everyone knows all the apps on your phone

#76

Post by nexle »

captn3m0 wrote: post #69

The ACTION_MAIN loophole has been written about before: https://commonsware.com/blog/2020/04/05/android-r-package-vi... Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass. There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331

Thanks for the link, seems like the loophole is already there since the introduction of the package visibility restriction, and almost everyone and their mother knows how to bypass this restriction.

> Google refuses to patch this

While I don't believe Google engineers are not aware of this widely used loophole, do you have any source that they refused to fix it?

Re: Everyone knows all the apps on your phone

#77

Post by wkat4242 »

andsoitis wrote: post #26

> everyone knows all the alls on your phone On Android phones. iPhone doesn’t have this privacy deficiency.

On iOS it's kinda worse in some ways. If you enroll into a company MDM they can see all your apps.

On Android if they use the work profile (which is the standard method these days) they can only see the apps inside there.

Re: Everyone knows all the apps on your phone

#78

Post by billfruit »

wkat4242 wrote: post #73
billfruit wrote: post #72

Some apps like Obsidian needs permission to access every file on the device. It is surprising Obsidian isn't getting called out on that very much.

It's because it stores the files there so you can sync them with other permissions. And also that your notes aren't deleted like they would be if they were stored in the internal app storage. There's more granular options for filesystem access available but if you implement them you limit yourself to the latest Android releases. According to Exodus it has no trackers and it's an open source app also so you can see wh…

Obsidian isn't open source by most reports.

Surely Obsidian do not to see all files on the device, it only really needs to see the files the user needs it to see.

Re: Everyone knows all the apps on your phone

#79

Post by cosmic_cheese »

phony-account wrote: post #58
refulgentis wrote: post #53

Earlier quoted context omitted.

I don't think it is worth being dismissive. I snorted when I got to the self-important haughtiness about reddit. Why? - You immediately recognized what they meant. - They weren't advancing a claim, they were indicating a basis for their interrogative, likely to avoid seeming naive when claiming it out of nowhere. - The article we're commenting on describes the same mechanism you claim differentiates iOS. ("register i…

> There's strong signs you didn't read the article you linked. What could possibly indicate I didn’t read the article? Of course I read it. Isn’t your assumption of my bad faith also explicitly against HN’s guidelines? > On iOS you can register URL schemes in a plist, these aren't "external applications you intend to query" and the list does not have to be "very short and motivated" I’m also an iOS developer- and yes…

Yeah Apple used to be more loose with registered URL schemes, but tightened up a few years ago ands so now if you submit with a huge list of schemes the app has no good reason to use you’re going to get bounced.

Re: Everyone knows all the apps on your phone

#80

Post by wkat4242 »

JohnFen wrote: post #50
dandersch wrote: post #44

Earlier quoted context omitted.

packages on f-droid list all required permissions explicitly, and the mentioned permission seems to be listed as "query all packages: Allows an app to see all installed packages.". It doesn't mark the app as having "anti-features", but you can at least make a more informed decision this way.

That's pretty cool, but the article says that most apps that are doing this sort of thing aren't using the query all packages permission and instead are using the facility to provide a specific list of apps they're checking for, which is not permission-gated.

It is. It specifically says that the apps must be declared in the manifest like other permissions. So it's a specific permission for each app really. F-Droid could query that if it wants to (not sure if it does)
Post reply on HN