Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

231–240 of 502 posts

Re: Everyone knows all the apps on your phone

#231

> everyone knows all the alls on your phone On Android phones. iPhone doesn’t have this privacy deficiency.

Actually you can via private API, which Apple app use all the time but forbid other app to use

https://blog.verichains.io/p/technical-analysis-improper-use...

Re: Everyone knows all the apps on your phone

#232
post #13

Earlier quoted context omitted.

Most windows apps aren't sandboxed, so them being able to grab window titles is the least of your worries. Any program can steal your login sessions and passwords if they wanted to. https://xkcd.com/1200/

Are you essentially discussing like a keylogger? I can't imagine windows intentionally keeps the plaintext password anywhere longer than it needs to be.

That, but consider also how an application running with your user privileges has full access to the filesystem with those privileges, so it can read your entire home directory, for example. That includes your browser profile with all cookies, and all credentials that applications store there unencrypted. Not to mention how that allows for all the fingerprinting even the most nefarious marketer could wish for.

Oh, and the UAC confirmations to elevate your apps permissions to root? People will gleefully confirm them without reading what needs access anyway, so you’re golden to do whatever you want.

The security model of Windows doesn’t exist.

Re: Everyone knows all the apps on your phone

#233

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

Imagine a world in which your smartphone's battery lasted more than a day... ... and ram requirements for good performance went down by 66% ...

…but give it one little webview…

Re: Everyone knows all the apps on your phone

#234
post #215

Earlier quoted context omitted.

Simple, UX. The reality is, most webapps for mobile just suck. The UX is nowhere near that of a native application. I don't want any text to be selectable. I don't want pull to refresh on every page. I don't want the left-swipe to take me to the previous page. You can probably find workarounds for all these issues. The new Silk library ( https://silkhq.co/ ) is the first case I've seen that get's very close to a nati…

Mmh, the examples you've listed are actually super easy to do if you're using a framework such as angular with it's plugins for pwa and touch controls. And prolly tailwind for css/disabling selection if you really want to, but I'd call that an anti feature in almost all cases.

In theory. In practice not so much.

I've had enough browser apps try that on my phone. Usually they start to lag out and become unbearably slow due to the framework bloat, compared to native apps that have no such issues.

Re: Everyone knows all the apps on your phone

#235
post #19

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!

Indeed some of these apps really ask for such expansive set of permissions than they need.

Obsidian for example asks for permission for entire filesystem, while it really needs to access the files which the user needs it to see.

Re: Everyone knows all the apps on your phone

#237

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

Simple, UX. The reality is, most webapps for mobile just suck. The UX is nowhere near that of a native application. I don't want any text to be selectable. I don't want pull to refresh on every page. I don't want the left-swipe to take me to the previous page. You can probably find workarounds for all these issues. The new Silk library ( https://silkhq.co/ ) is the first case I've seen that get's very close to a nati…

Most apps for mobile suck too. A lot of them are worse because they are not in a web browser, eg YouTube or Reddit or similar apps that work via urls.

Browsers are some of the very few apps that work well on a phone. Most of the other ones feel like a mess (except games I guess).

Re: Everyone knows all the apps on your phone

#238

"the one that blue tick twitter accounts living in certain pin codes of Bengaluru passionately discuss amongst themselves for a week every year" To someone embarrassingly unfamiliar with Indian culture, what does it mean?

The PowerPoint he talks about and is displayed the line below it

Re: Everyone knows all the apps on your phone

#239

Earlier quoted context omitted.

> Google refuses to patch this. That's why projects like XPL-Extended (and previously XPrivacyLua), are an absolute need. I never run an android phone without these.

XPrivactLua and other XposedMod/Magisk extensions break open the app sandbox. It is better to restrict running those on usereng/eng builds (test devices). For prod builds (user devices), I'd recommend using Work Profiles (GrapheneOS supports upto 31 in parallel) or Private Spaces (on Android 15+) to truly isolate apps from one another.

What do you mean by "break open the app sandbox"?

Re: Everyone knows all the apps on your phone

#240
post #172

Earlier quoted context omitted.

Do you mean something like https://commons.m.wikimedia.org/wiki/Commons:VideoCutTool ?

I mean something like CapCut that has access to the phone camera for capturing video.

Browsers have camera and local file access if the user grants permissions, what do you mean isn't possible with the browser?
Post reply on HN