Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

Post reply on HN
Print view View original

111–120 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#111

Post by Cider9986 »

deanishe wrote: post #105
microtonal wrote: post #94

Earlier quoted context omitted.

See my comment upthread, it helps a bit, but does not close this hole since apps within the same profile can communicate through IPC, so other apps could provide network access on their behalf. I think the best example is probably Play Services, which provides functionality for a lot of apps and will communicate with Google, etc. (Yes, you can disable network access to Play Services, but it sometimes breaks things an…

I'm not an Android user. What's a profile? Is that a user thing or a developer thing?

You can make different profiles. They can have different unlock methods and can have different apps installed. If you have one app installed in both it's shared.

They were designed so multiple people could use one device.

Some people use them to separate identities or contain apps they view as bad. I'm not sure if the efficacy of this.

Grapheneos improves them significantly https://grapheneos.org/features#improved-user-profiles

Re: Loupe – A iOS app that raises awareness about what native apps can see

#112

Post by echoangle »

solarkraft wrote: post #103
echoangle wrote: post #78

Earlier quoted context omitted.

Which even halfway credible app developer would sell you that info? You know that’s illegal right? You might get some stupid indie developer to do this but no chance for anything even half big. But if you can get actually get this data, maybe try to do this on yourself and write a blogpost about it. I highly doubt you’ll be able to.

Most app publishers are halfway credible at best, so it's not much of a problem. Even the halfway credible ones often use SDKs that do this.

Ok but if the SDKs do this they use it themselves to serve ads and don’t sell the raw data, right?

Re: Loupe – A iOS app that raises awareness about what native apps can see

#113

Post by latexr »

wiseowise wrote: post #76
nomilk wrote: post #60

Why does a random app (with no special permissions given to it) get access to so much info, and why doesn't Apple tell users this (important) info? Why can't Apple make a long list of check boxes so users can dis/allow on a per-category and per-app basis? E.g. I had no idea a random app you install (and give no permissions to) instantly has a list of every app installed on the device (e.g. can infer whether you're da…

[flagged]

It already happens all the time. It even has a name.

https://en.wikipedia.org/wiki/Stalkerware

Re: Loupe – A iOS app that raises awareness about what native apps can see

#114

Post by [deleted] »

microtonal wrote: post #55
camkego wrote: post #45

Earlier quoted context omitted.

This. This is why everyone who wants to fingerprint and collect tons of data on end users pushes them hard on installing an app. The amount of valuable data is 10x what’s available in the browser

And it is not just the fingerprinting, it is also that a good number of people will install an ad/tracker blocker in their browser, but almost nobody knows or cares about the multiple trackers that most apps have. To make it worse, Apple's naming undermines consciousness about this issue, since they have an option to block cross-app/site tracking (which IIRC blocks access to the advertising identifier), but called it…

[deleted]

Re: Loupe – A iOS app that raises awareness about what native apps can see

#115

Post by ignoramous »

microtonal wrote: post #90
reorder9695 wrote: post #85

Earlier quoted context omitted.

AOSP has network as a regular permission for apps, so on Lineage at least (idk about Graphene as I haven't used it) you can disable network for any app including google play services etc. I have no idea why most phone companies remove this permission from their roms but android itself supports it perfectly fine.

It's nice to be able to toggle it (it's also possible to revoke this permission on GrapheneOS). However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. I would guess that Play Services is one of the larger offenders, since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play…

> However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved.

Folks brings up 'IPC' as if this is some chink in the armour in AOSP. It isn't. 'Apps' pretty much on most consumer OSes can 'IPC' their way with other co-operating apps to 'achieve' network access from behind a firewall, just the same.

> since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play Services does work that involves internet access on behalf of other apps

If the OS or its privileged component will fchown the socket to the origin app, think the INTERNET permission will be enforced as expected.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#116

Post by amelius »

gyomu wrote: post #95
Cider9986 wrote: post #91

Earlier quoted context omitted.

This isn't effective because Little Snitch only sees the domains so apps can just serve the trackers on the same domain as essential services making blocking impossible. The only way to prevent malicious apps from affecting your privacy is to not install them or not give them network access.

I derive lots of value from Little Snitch on my Mac, so this approach is more effective than not having anything. And yes, having the ability to deny any app network access on iOS would be great.

Yeah but it might be because you are part of a minority. Once/if this is built into the OS, the app builders will have a strong incentive to do things differently.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#117

Post by latexr »

echoangle wrote: post #71
nomilk wrote: post #60

Why does a random app (with no special permissions given to it) get access to so much info, and why doesn't Apple tell users this (important) info? Why can't Apple make a long list of check boxes so users can dis/allow on a per-category and per-app basis? E.g. I had no idea a random app you install (and give no permissions to) instantly has a list of every app installed on the device (e.g. can infer whether you're da…

And how would the is-my-partner-cheating get their app onto the victims device to detect the other apps?

Ask any domestic abuser. Most of them seem to be successful at it.

https://www.npr.org/sections/alltechconsidered/2014/09/15/34...

It’s crazy to me that people are being so skeptical of the idea. A lot of people share their logins freely with their spouses. I have never done it nor would I condone it, but it would be trivial for me to install spyware on the devices of many people I know, because they rightfully trust me. Not only do I know some of their device passwords¹, being “the computer guy” I could just outright ask for it or get them to input it anywhere while fixing some issue they have.

¹ And many more I have forgotten, because I make it a point to not record them, even mentally.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#118

Post by iLoveOncall »

hellcow wrote: post #63
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

GrapheneOS lets you restrict the internet access of any app on install. But yes, agreed it should be everywhere.

iOS lets you turn off data access (so outside of wifi) for apps as well, it's just not asked at install, which honestly makes sense given the demographics of iPhone users.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#119

Post by fizwidget »

throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

Because 99% of apps would request it & not function without it, desensitising users into blindly accepting it. Most apps do have a legitimate reason for accessing the internet, so a binary yes/no wouldn’t achieve much anyway.

I just don’t think it’s an effective way of solving the problem.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#120

Post by fizwidget »

gyomu wrote: post #77
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

It’s not quite that detailed but iOS’s builtin “app privacy report” does give a fair amount of info, including a list of domains accessed.
Post reply on HN