Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

Post reply on HN
Print view View original

81–90 of 502 posts

Re: Everyone knows all the apps on your phone

#81

Post by facile3232 »

justonenote wrote: post #74
facile3232 wrote: post #15

Earlier quoted context omitted.

Are you essentially discussing like a keylogger? I can't imagine windows intentionally keeps the plaintext password anywhere longer than it needs to be.

ita disconcerting to see such naivety around security issues on hn. not that windows is keeping passwords in plaintext, but that it's not immediately obvious that un-sandboxed apps that run on your windows/linux/mac desktop have virtually unlimited other avenues to capture passwords given they can read the entire state of other windows at the very least. I dunno maybe macos is slightly better, and wayland definitely…

So like a keylogger. Thanks

Re: Everyone knows all the apps on your phone

#82

Post by refulgentis »

phony-account wrote: post #58
refulgentis wrote: post #53

Earlier quoted context omitted.

I don't think it is worth being dismissive. I snorted when I got to the self-important haughtiness about reddit. Why? - You immediately recognized what they meant. - They weren't advancing a claim, they were indicating a basis for their interrogative, likely to avoid seeming naive when claiming it out of nowhere. - The article we're commenting on describes the same mechanism you claim differentiates iOS. ("register i…

> There's strong signs you didn't read the article you linked. What could possibly indicate I didn’t read the article? Of course I read it. Isn’t your assumption of my bad faith also explicitly against HN’s guidelines? > On iOS you can register URL schemes in a plist, these aren't "external applications you intend to query" and the list does not have to be "very short and motivated" I’m also an iOS developer- and yes…

> What could possibly indicate I didn’t read the article?

What I laid out, namely, that you described iOS the same as the article, while simultaneously claiming iOS differs significantly.

> On iOS you can register URL schemes in a plist, these aren't "external applications you intend to query" and the list does not have to be "very short and motivated"

> I’m also an iOS developer- and yes it does.

Which part is "yes it does"?

We both can agree quite quickly that URL schemes in a plist aren't "registering apps." You can drag this out a couple turns by playing shell games first by ignoring the URL schemes difference, then by making me do the leg work to show it's trivial to find apps with dozens of apps in that list.

Either which way, I continue to be taken aback by your snarkiness towards the original post and cries of Reddit given you know you were 100% wrong on this.

You're in a really bizarre situation where too much territory was staked out and you're defending it all: you can't claim this was a remotely accurate description and you read the article about Android and iOS is different. It's already a farce, then throw in scolding about how HN is Reddit because of low quality posts...my goodness, my friend.

> Of course I read it. Isn’t your assumption of my bad faith also explicitly against HN’s guidelines?

No, because I said "There are strong signs", I didn't say "You didn't read it."

Also, why would not reading be "bad faith"?

You are extremely focused on making attacks and perceiving them in others, please take a step back and note: "But I don't think that's wrong. You're trying. Why is it wrong for the person you asked to try too?" - you shouldn't have to make up an interpretation where gently chiding you for being rude turns into invoking rules and accusing you of bad faith

Re: Everyone knows all the apps on your phone

#83

Post by refulgentis »

ctippett wrote: post #38
phony-account wrote: post #33

Earlier quoted context omitted.

> I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong. On iOS an app developer will need to register in advance which external applications their app intends to query, and the list needs to be very short and motivated. [1] Incidentally, “I have a friend who says...” isn’t really a good citation anywhere outside Reddit - which HN…

Thanks for the information. I suppose a more appropriate term of phrase would've been "I'd heard anecdotally...", but I agree I was lazy with my original reply. I appreciate the feedback.

You're too kind, their reply was extremely rude to you. I have been here 16 years, been an iOS developer just as long, and have no idea why your comment is "Reddit."

A simple thought exercise for me is "Which of these two comments is more Reddit?" - I'd say the one that came with curiosity is HN, the one that bats around half truths combatively and invoking Reddit isn't.

Re: Everyone knows all the apps on your phone

#84

Post by neither_color »

andsoitis wrote: post #26

> everyone knows all the alls on your phone On Android phones. iPhone doesn’t have this privacy deficiency.

Speaking of iPhone, Im curious about something. On occasion, I log into the [former] bird app using the web app because it's enough to check up on some key follows.

Recently, they released a major update to their LLM feature and I installed the app to check it out. While I had the app installed, every time I checked the mobile website there was a large banner directing me to go to the app. Ad blockers and distraction blockers would not get rid of it. When I deleted the app again, it was gone. What gives? Why does the mobile website know whether I have the app installed? How come content+distraction blockers are enough to block all reminders to use the app when it's not installed, but are irrevocable if I have the app installed?

Re: Everyone knows all the apps on your phone

#85

Post by AznHisoka »

nexle wrote: post #76
captn3m0 wrote: post #69

The ACTION_MAIN loophole has been written about before: https://commonsware.com/blog/2020/04/05/android-r-package-vi... Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass. There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331

Thanks for the link, seems like the loophole is already there since the introduction of the package visibility restriction, and almost everyone and their mother knows how to bypass this restriction. > Google refuses to patch this While I don't believe Google engineers are not aware of this widely used loophole, do you have any source that they refused to fix it?

That loophole was published 5 years ago, it hasnt been fixed since.

Do you need someone from Google to explicitly write an official note, notarized, indicating they are refusing to fix it?

Re: Everyone knows all the apps on your phone

#86

Post by js2 »

neither_color wrote: post #84
andsoitis wrote: post #26

> everyone knows all the alls on your phone On Android phones. iPhone doesn’t have this privacy deficiency.

Speaking of iPhone, Im curious about something. On occasion, I log into the [former] bird app using the web app because it's enough to check up on some key follows. Recently, they released a major update to their LLM feature and I installed the app to check it out. While I had the app installed, every time I checked the mobile website there was a large banner directing me to go to the app. Ad blockers and distraction…

Apple calls these Smart App Banners. Webkit cooperates with iOS to present them according to a meta tag in the page:

https://developer.apple.com/documentation/webkit/promoting-a...

You can get rid of them with the Unsmartifier extension.

https://old.reddit.com/r/apple/comments/q55753/unsmartifier_...

The StopTheMadness extension can also remove them (among many other things... this extension is a must have for me):

https://underpassapp.com/StopTheMadness/support-ios.html

Re: Everyone knows all the apps on your phone

#87

Post by hnburnsy »

>For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps.

'Extreme' my a*. My bank app has this permission, as well as my camera app, contacts app, clock app, Google Home, and on and on. My bank app was moved to an old iPad because of this.

Re: Everyone knows all the apps on your phone

#88

Post by [deleted] »

Borealid wrote: post #21
zx8080 wrote: post #19

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!

When a user visits a play.google.com URL Google wants to be able to show either an "install" or a "launch" button contingent on whether the app is already installed. In other words, blame Google product management.

[deleted]

Re: Everyone knows all the apps on your phone

#90

Post by izacus »

captn3m0 wrote: post #69

The ACTION_MAIN loophole has been written about before: https://commonsware.com/blog/2020/04/05/android-r-package-vi... Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass. There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331

What do you mean with "refused to patch this"? Google will reject any app publishing attempt that asks for that filter and isn't a launcher on Play store.
Post reply on HN