Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

Post reply on HN
Print view View original

91–100 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#91

Post by Cider9986 »

gyomu wrote: post #77
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

This isn't effective because Little Snitch only sees the domains so apps can just serve the trackers on the same domain as essential services making blocking impossible.

The only way to prevent malicious apps from affecting your privacy is to not install them or not give them network access.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#92

Post by nomilk »

aggregator-ios wrote: post #68

One correction to some comments here: an iOS app cannot list all apps that are installed. You can only check for specific apps/schemes (LSApplicationQueriesSchemes) by specifying apps you are looking to query for installation status or open. You cannot provide a large list of unrelated applications since Apple rejects that during app review. Apple added these restrictions because installed app lists can be used for f…

But a single app can request to know the presence of up to 50 apps, right?

And a data broker/aggregator can purchase such data from many (e.g. thousands) of apps and aggregate it, then sell it.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#93

Post by Cider9986 »

backscratches wrote: post #88
RedComet wrote: post #18

Volume creation date is pretty egregious. I don't see any reason that and Pasteboard changeCount should be so granular. The "Installed Apps Probe" leak also surprised me. It is better than the current state of Android, though.

Graphene is way ahead of this

Apps on grapheneos can see a list of other apps in the same profile.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#94

Post by microtonal »

hellcow wrote: post #63
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

GrapheneOS lets you restrict the internet access of any app on install. But yes, agreed it should be everywhere.

See my comment upthread, it helps a bit, but does not close this hole since apps within the same profile can communicate through IPC, so other apps could provide network access on their behalf. I think the best example is probably Play Services, which provides functionality for a lot of apps and will communicate with Google, etc.

(Yes, you can disable network access to Play Services, but it sometimes breaks things and the general point of IPC as a hole still stands.)

Re: Loupe – A iOS app that raises awareness about what native apps can see

#95

Post by gyomu »

Cider9986 wrote: post #91
gyomu wrote: post #77

Earlier quoted context omitted.

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

This isn't effective because Little Snitch only sees the domains so apps can just serve the trackers on the same domain as essential services making blocking impossible. The only way to prevent malicious apps from affecting your privacy is to not install them or not give them network access.

I derive lots of value from Little Snitch on my Mac, so this approach is more effective than not having anything.

And yes, having the ability to deny any app network access on iOS would be great.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#96

Post by Cider9986 »

Forgeties79 wrote: post #87
Cider9986 wrote: post #57

Earlier quoted context omitted.

The only way to prevent this right now is to avoid installing apps that are doing this.

“Just don’t use it” only gets you so far and isn’t always an option. Also, as some have mentioned in this thread, many sites now make the mobile experience so painful (or remove key features) so as to force you onto the app. I am against cars for the most part, but I can’t just get rid of my car. In this case, I can’t get rid of Slack (and other apps) because of work and unfortunately I do not work at a company that…

I'm not saying it's not a problem and I understand you have to use some apps. I'm just saying that currently the only way to effectively prevent apps gathering and selling this info is to never install the app in the first place.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#98

Post by microtonal »

Forgeties79 wrote: post #56

This is neat and interesting, truly, but the classic “what now?” emerges. I guess the only answer is “throw out my iPhone”? Otherwise this kind of seems like a circuitous ad to make people get worried and download Psylo, which I see has in-app purchases. I’m not trying to come at you here, but it’s just hard not to feel suspicious online these days.

Don't install apps outside trustable apps that don't embed tracking. Even if you cannot uninstall every app, the fewer you have, the less cross-app tracking. Also donate to and consider installing privacy-conscious alternative phone OSes. They may not have closed all holes (yet), but at least their incentives are aligned with yours.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#99

Post by echoangle »

RedComet wrote: post #75
echoangle wrote: post #73

Earlier quoted context omitted.

Just generate a new random value instead of incrementing

Even that is overkill if all you're interested in is if a change occured.

What’s an easier way? I’m assuming they want the app to be able to detect when “a”, was copied, then “b” and then “a” again, so just looking at the value probably isn’t enough.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#100

Post by microtonal »

aggregator-ios wrote: post #68

One correction to some comments here: an iOS app cannot list all apps that are installed. You can only check for specific apps/schemes (LSApplicationQueriesSchemes) by specifying apps you are looking to query for installation status or open. You cannot provide a large list of unrelated applications since Apple rejects that during app review. Apple added these restrictions because installed app lists can be used for f…

You cannot provide a large list of unrelated applications since Apple rejects that during app review.

Thank you for the clarification!

You cannot provide a large list of unrelated applications since Apple rejects that during app review.

It does not need to be a large list though I think? You just need a small list that is very discriminative and adds enough additional entropy to uniquely identify you in combination with the other data leaked.

Post reply on HN