Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

51–60 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#51

Apps like TikTok can know which username we logged in with, even if we uninstall and reinstall the app. This is egregious, as many companies like Facebook have SDKs embedded in many apps, allowing them to accurately interconnect user activity. Apple should be ashamed that they aren't putting effort to randomize these fingerprints....

That’s just keychain. It’s not even fingerprinting.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#52
For anyone without an iPhone or doesn't want to install the app you can see a demo here (same video different platforms):

https://odysee.com/@techlore:3/permission-not-required-the-o...

https://www.youtube.com/watch?v=_n_SpEWtqog

https://inv.nadeko.net/watch?v=_n_SpEWtqog

https://techlore.tv/w/d7dh4P7y4dVngNoL7u7s3B

Re: Loupe – A iOS app that raises awareness about what native apps can see

#54
post #8

Damn. The "iPhone last setup or erased on ..." is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS.

Maybe I'm being really thick, but why is this information that the OS would make available to apps?

Maybe it’s derived

Re: Loupe – A iOS app that raises awareness about what native apps can see

#55
post #45

Earlier quoted context omitted.

Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web browser when possible.

This. This is why everyone who wants to fingerprint and collect tons of data on end users pushes them hard on installing an app. The amount of valuable data is 10x what’s available in the browser

And it is not just the fingerprinting, it is also that a good number of people will install an ad/tracker blocker in their browser, but almost nobody knows or cares about the multiple trackers that most apps have.

To make it worse, Apple's naming undermines consciousness about this issue, since they have an option to block cross-app/site tracking (which IIRC blocks access to the advertising identifier), but called it "Allow Apps to Request to Track". A lot of people seem to hold the belief that disabling this option blocks all in-app trackers. It just blocks one way to correlate, but as this app shows, there are other ways to correlate (as well as correlating server-side using IP addresses, etc.).

On this topic, I somehow missed that Apple added a generic URL filtering API to macOS/iOS 26, which extends Safari filtering to the whole OS (well, as long as apps are using Apple's APIs). It's not perfect, but a nice addition to DNS-based blocking:

https://adguard.com/en/blog/apple-url-filter-system-wide-fil...

The author of Wipr added support to Wipr 2 as an extra in-app purchase:

https://kaylees.site/wipr2-whats-new.html#filtr

Aside from technical methods to address this, all this in-app tracking must be a violation of the GDPR, no? I can't imagine this all falls under legitimate interest.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#56
This is neat and interesting, truly, but the classic “what now?” emerges. I guess the only answer is “throw out my iPhone”? Otherwise this kind of seems like a circuitous ad to make people get worried and download Psylo, which I see has in-app purchases. I’m not trying to come at you here, but it’s just hard not to feel suspicious online these days.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#57

This is neat and interesting, truly, but the classic “what now?” emerges. I guess the only answer is “throw out my iPhone”? Otherwise this kind of seems like a circuitous ad to make people get worried and download Psylo, which I see has in-app purchases. I’m not trying to come at you here, but it’s just hard not to feel suspicious online these days.

The only way to prevent this right now is to avoid installing apps that are doing this.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#58

Earlier quoted context omitted.

Maybe I'm being really thick, but why is this information that the OS would make available to apps?

Maybe it’s derived

It's probably the app checking the last modified timestamp on some filesystem location that's only touched during setup.

Edit: It's not a last modified timestamp, it's a volume creation timestamp: https://github.com/mysk-research/loupe/blob/2262efd4456ecba8...

Re: Loupe – A iOS app that raises awareness about what native apps can see

#60
Why does a random app (with no special permissions given to it) get access to so much info, and why doesn't Apple tell users this (important) info? Why can't Apple make a long list of check boxes so users can dis/allow on a per-category and per-app basis?

E.g. I had no idea a random app you install (and give no permissions to) instantly has a list of every app installed on the device (e.g. can infer whether you're dating [or cheating!] from presence of tinder/bumble/hinge). That alone seems instantly monetizable by unscrupulous actors via 'is-my-partner-cheating' as a service: charge $10 to give a probable answer.

Post reply on HN