Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

141–150 of 502 posts

Re: Everyone knows all the apps on your phone

#141

Earlier quoted context omitted.

That loophole was published 5 years ago, it hasnt been fixed since. Do you need someone from Google to explicitly write an official note, notarized, indicating they are refusing to fix it?

> refusing to fix it Google addressed similar isolation concerns (without breaking a tonne of APIs in incompatible ways) with Private Space and Work Profile: https://source.android.com/docs/security/features/private-sp...

[deleted]

Re: Everyone knows all the apps on your phone

#142
post #19

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!

[dead]

Re: Everyone knows all the apps on your phone

#143

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

There are also an increasing number of services which are ONLY available as apps now, including, but not limited to, many financial apps such as Revolut.

A big issue with this trend is that unlike the web, the whole Android ecosystem is a walled garden which is strictly controlled by Google. In principle you can run your own custom Android ROM, but in practice this will lock you out from any app which uses Play Integrity API to enforce Google's totalitarian regime which dictates what software YOU are allowed to run on "your" hardware.

Re: Everyone knows all the apps on your phone

#144

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

During earthquake in Bangkok in Friday Grab (local superior version of Uber) helped me to order taxi and get my kids home. Needless to say that cell phones network collapsed for most of the day. All people want to know what happens and is their family and friends are safe. They definitely have very optimized network layer for poor connections. I bet they can switch to udp or something. I'm glad that it wasn't web app.

In many other cases I agree with you.

Re: Everyone knows all the apps on your phone

#145

Earlier quoted context omitted.

You're nice. I don't appreciate the extremely tired "hn looks more and more like Reddit every day" slop and I think you handled it with grace.

Comparing HN to resdit is explicitly against HN guidelines. Though sometimes I think the only reason it’s never “true” is because Reddit is a moving target. Both HN and reddit get worse over time, so HN never catches up to how bad Reddit is. Also the bots have not invaded HN, which is a truly massive distinction.

> Both HN and reddit get worse over time

I think this is probably true of any online community. I’d wager that an online community needs more users to grow and be sustainable, and more users inevitably means more content, and more content means less _high-quality_ content overall.

Re: Everyone knows all the apps on your phone

#146

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

For me, there are a lot of applications that I want to be able to load regardless of whether I have a connection to the Internet or not: calendar, notes, mail etc. They can sync/send/whatever whenever I am next online.

Re: Everyone knows all the apps on your phone

#147

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

The most basic app, a notepad, I often prefer native. When I go between google keep or notion to apple notes I can tell the difference. If the text is long enough, the web apps just can not load the content. Just to confirm: I dumped all of my notes from my insanely large apple notes (about 16000 lines of text) and pasted them into Google Keep, Notion, Google Docs. With the exception of Google Docs the rest of them f…

Sorry, I couldn't recreate this. I just built a tiny texteditor app: https://65cd02a1-8f00-47cb-b1d1-231493de5fc2.paged.net/

Tried putting 20k lines into it. Loaded instantly, allowed me to scroll and edit flawlessly.

But I get your point. I'm on a pretty decent 2022 iPhone, and I'm sure at some stage I would run into a performance hit. But not at 20k lines.

Re: Everyone knows all the apps on your phone

#148
post #146

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

For me, there are a lot of applications that I want to be able to load regardless of whether I have a connection to the Internet or not: calendar, notes, mail etc. They can sync/send/whatever whenever I am next online.

Ah yeah. While this is mostly implemented terrible, a web app can absolutely do this for you using service workers. So you can install a webapp to your homescreen and use it without an internet connection at all.

Re: Everyone knows all the apps on your phone

#149
post #45

It requires root, but you can block/spoof this with an LSPosed[1] module such as XPrivacyLua[2]. I hear there's also the closed-source AppOps[3], but I've never used it. [1]: https://lsposed.org [2]: https://github.com/M66B/XPrivacyLua / https://github.com/0bbedCode/XPL-EX [3]: https://appops.rikka.app

I've not heard of XPrivacyLua, which is by the same author of the excellent NetGuard[0], which I've been using for years.

Interestingly XPrivacyLua is not supported anymore and the pro companion app will be removed from the Play store by Google because it uses the permission QUERY_ALL_PACKAGES.[1]

[0]: https://github.com/M66B/NetGuard [1]: https://xdaforums.com/t/closed-app-xposed-6-0-xprivacylua-an...

Re: Everyone knows all the apps on your phone

#150
post #50

Earlier quoted context omitted.

That's pretty cool, but the article says that most apps that are doing this sort of thing aren't using the query all packages permission and instead are using the facility to provide a specific list of apps they're checking for, which is not permission-gated.

It is. It specifically says that the apps must be declared in the manifest like other permissions. So it's a specific permission for each app really. F-Droid could query that if it wants to (not sure if it does)

Did you stop reading before the post got to the MAIN loophole that doesn't require the list of apps in the manifest? How does F-droid describe MAIN?
Post reply on HN