Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

Post reply on HN
Print view View original

81–90 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#81

Post by nomilk »

echoangle wrote: post #78
nomilk wrote: post #74

Earlier quoted context omitted.

They don't, utilise the fact that every single iPhone app has access to what other apps are installed! - purchase that info from literally any iPhone app or aggregator that has it for that user. Curious how much this would cost to purhcase - a working credit card goes for $5-10 on the black market so 'apps installed on X's iphone' might be, like, 10c?

Which even halfway credible app developer would sell you that info? You know that’s illegal right? You might get some stupid indie developer to do this but no chance for anything even half big. But if you can get actually get this data, maybe try to do this on yourself and write a blogpost about it. I highly doubt you’ll be able to.

I've never made an iOS app and don't have plans to. But my assumption is ~every >= medium-sized iOS app would be monetised by selling data to aggregators.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#83

Post by 9dev »

nomilk wrote: post #81
echoangle wrote: post #78

Earlier quoted context omitted.

Which even halfway credible app developer would sell you that info? You know that’s illegal right? You might get some stupid indie developer to do this but no chance for anything even half big. But if you can get actually get this data, maybe try to do this on yourself and write a blogpost about it. I highly doubt you’ll be able to.

I've never made an iOS app and don't have plans to. But my assumption is ~every >= medium-sized iOS app would be monetised by selling data to aggregators.

Even if that was the case - which it isn't - the aggregator data isn't keyed by the user in question. That is highly illegal pretty much everywhere and would get you in a lot of trouble. You can't "just" find out which apps an arbitrary person has installed on their phone. That's not how it works.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#85

Post by reorder9695 »

throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

AOSP has network as a regular permission for apps, so on Lineage at least (idk about Graphene as I haven't used it) you can disable network for any app including google play services etc. I have no idea why most phone companies remove this permission from their roms but android itself supports it perfectly fine.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#86

Post by backscratches »

nomilk wrote: post #70
idiotsecant wrote: post #69

Earlier quoted context omitted.

Of all things, this is where you went?

Okay it's weird but the first thing that came to mind. Logic: if I can think of a monetisable, nefarious application in 10 seconds, then it stands to reason that very many nefarious applications would be possible with more time/effort.

Not just possible, currently being implemented. People are murdered every year using this information. Last year a US politician was assassinated by someone who tracked them by buying this information from aggregator. You thought of a tame use case!

Re: Loupe – A iOS app that raises awareness about what native apps can see

#87

Post by Forgeties79 »

Cider9986 wrote: post #57
Forgeties79 wrote: post #56

This is neat and interesting, truly, but the classic “what now?” emerges. I guess the only answer is “throw out my iPhone”? Otherwise this kind of seems like a circuitous ad to make people get worried and download Psylo, which I see has in-app purchases. I’m not trying to come at you here, but it’s just hard not to feel suspicious online these days.

The only way to prevent this right now is to avoid installing apps that are doing this.

“Just don’t use it” only gets you so far and isn’t always an option. Also, as some have mentioned in this thread, many sites now make the mobile experience so painful (or remove key features) so as to force you onto the app.

I am against cars for the most part, but I can’t just get rid of my car. In this case, I can’t get rid of Slack (and other apps) because of work and unfortunately I do not work at a company that will buy me a work phone for work things.

Ultimately this has to start at a more root level. We need to claw back privacy.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#88

Post by backscratches »

RedComet wrote: post #18

Volume creation date is pretty egregious. I don't see any reason that and Pasteboard changeCount should be so granular. The "Installed Apps Probe" leak also surprised me. It is better than the current state of Android, though.

Graphene is way ahead of this

Re: Loupe – A iOS app that raises awareness about what native apps can see

#89

Post by nomilk »

9dev wrote: post #83
nomilk wrote: post #81

Earlier quoted context omitted.

I've never made an iOS app and don't have plans to. But my assumption is ~every >= medium-sized iOS app would be monetised by selling data to aggregators.

Even if that was the case - which it isn't - the aggregator data isn't keyed by the user in question. That is highly illegal pretty much everywhere and would get you in a lot of trouble. You can't "just" find out which apps an arbitrary person has installed on their phone. That's not how it works.

My understanding is it's common practice. E.g. How Shady Companies Guess Your Religion, Sexual Orientation, and Mental Health And sell that data to the highest bidder. https://slate.com/technology/2023/04/data-broker-inference-p...

Re: Loupe – A iOS app that raises awareness about what native apps can see

#90

Post by microtonal »

reorder9695 wrote: post #85
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

AOSP has network as a regular permission for apps, so on Lineage at least (idk about Graphene as I haven't used it) you can disable network for any app including google play services etc. I have no idea why most phone companies remove this permission from their roms but android itself supports it perfectly fine.

It's nice to be able to toggle it (it's also possible to revoke this permission on GrapheneOS). However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. I would guess that Play Services is one of the larger offenders, since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play Services does work that involves internet access on behalf of other apps.

You could of course disable network access to Play Services, but at least for me that broke a bunch of apps or made them unreliable.

What AOSP ROMs need besides the network permission toggle is IPC scopes functionality, akin to storage scopes.

Post reply on HN