Earlier quoted context omitted.
What “apps” do you use on a mac?
Google Chrome, VS Code, among others
Well “they” can technically “read” anything your user can.
Loupe – A iOS app that raises awareness about what native apps can see
11–20 of 263 posts
Re: Loupe – A iOS app that raises awareness about what native apps can see
#12Would love this for MacOS as well.
Fortunately, if you read the README (and decide to go past the “this was mostly built by AI” part, > Loupe also builds for macOS. The Mac version is mostly complete, but a few things still need work before it's polished.
> and decide to go past the “this was mostly built by AI” part
I got that feeling just seeing the title use "native" as a synonym of "not a website".
Re: Loupe – A iOS app that raises awareness about what native apps can see
#13Re: Loupe – A iOS app that raises awareness about what native apps can see
#14It's likely to be trolled by the WPA folks, who will insist that WPAs are just as insecure as native apps, so there's no difference ... But very cool.
You mean PWA?
Re: Loupe – A iOS app that raises awareness about what native apps can see
#15It's likely to be trolled by the WPA folks, who will insist that WPAs are just as insecure as native apps, so there's no difference ... But very cool.
You mean PWA?
Yes. Got my ps and ws mixed up. I was just reading about the Mt. Rushmore project (I was curious whether or not it was a WPA project -it wasn’t, officially).
Re: Loupe – A iOS app that raises awareness about what native apps can see
#16Damn. The "iPhone last setup or erased on ..." is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS.
Is the threat model tracking across multiple apps to correlate what you're doing? In that case, a single app wouldn't show you the fudging.
```Based on a binomial/Poisson distribution and a baseline of 21 million U.S. device sales per release, a fingerprint relying on "seconds since setup" fails to uniquely identify individuals. In the high-density Early Adopter phase, you will share your exact setup second with an average of 1.01 other people (a total matching pool of ~2 people). Six months into the cycle, you will still share that second with an average of 0.68 other people.```
In the U.S., device setup time (to the second) very conservatively gets you clubbed into a single group of 100 individuals as an "advanced persistent threat" tracker. Even compressing activations to "80/20 during business hours" the math kindof maxes out at a pool of ~5 people, and assuming worst case "20x" of that still means you're still pretty darned identifiable.
If you get ~6-8 more bits of entropy (eg: Device Type + Capacity is easily 2-3 bits, and Time Zone is probably another 2-3 bits) you're cooked!
Re: Loupe – A iOS app that raises awareness about what native apps can see
#17Earlier quoted context omitted.
Well “they” can technically “read” anything your user can.
Apps installed via the MAS have sandboxing applied to them, so this isn't really true.
Yes but chrome is not from MAS. I have none MAS apps installed because they are simply not available via MAS.
Re: Loupe – A iOS app that raises awareness about what native apps can see
#18Volume creation date is pretty egregious. I don't see any reason that and Pasteboard changeCount should be so granular.
The "Installed Apps Probe" leak also surprised me. It is better than the current state of Android, though.
Re: Loupe – A iOS app that raises awareness about what native apps can see
#19Damn. The "iPhone last setup or erased on ..." is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS.
Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web browser when possible.
Re: Loupe – A iOS app that raises awareness about what native apps can see
#20This is why I avoid installing apps and don’t have a lot of them.