Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

Post reply on HN
Print view View original

121–130 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#121

Post by henryhchchc »

throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

iPhones purchased in mainland China (with model number ending in CH/A) do provide options for setting per-app Internet access permissions. There are three options [0]: Off, WLAN only, WLAN and Cellular.

[0] https://old.reddit.com/r/ios/comments/aib10i/in_china_ios_al...

Re: Loupe – A iOS app that raises awareness about what native apps can see

#122

Post by mazzystar »

throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

This resonates from the dev side. I made an offline photo search app a while back — you search your library in plain language ("a boy and a girl by the river"), CLIP embeddings all computed on device. It needs full photo access but I deliberately requested zero network permission. Was kind of proud of that.

Problem is there's no way for users to actually know that. iOS has no "this app can't reach the internet" indicator, so the whole guarantee is invisible. I even had people assume the opposite — app reads your whole library, therefore it must be uploading it somewhere. Exactly backwards.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#123

Post by withinboredom »

ramses0 wrote: post #16
matthewfcarlson wrote: post #10

Earlier quoted context omitted.

Is the threat model tracking across multiple apps to correlate what you're doing? In that case, a single app wouldn't show you the fudging.

```Based on a binomial/Poisson distribution and a baseline of 21 million U.S. device sales per release, a fingerprint relying on "seconds since setup" fails to uniquely identify individuals. In the high-density Early Adopter phase, you will share your exact setup second with an average of 1.01 other people (a total matching pool of ~2 people). Six months into the cycle, you will still share that second with an averag…

Reminds me of a meeting I was party to with the Safari team. We worked with them on some standards stuff at an old job. They claimed to have creepy-level tracking of users back then. We were discussing how to identify users for an A/B test across millions of sites and comparing what fingerprints we could both derive to most likely end up on the same user.

If you use a closed source browser. That’s the kinda shit they do.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#124

Post by water-drummer »

cute_boi wrote: post #27
Gigachad wrote: post #19

Earlier quoted context omitted.

Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web browser when possible.

These days many things don't work on browser. Even reddit is very difficult as we get constant nagging.

LinkedIn is the worst offender imo. I am not gonna list every shitty thing they do that goes away the moment you switch to desktop mode but the worst one is that they keep showing you the same feed for weeks if you're on mobile web.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#125

Post by CTDOCodebases »

gyomu wrote: post #77
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

If I remember correctly iPhone apps used to use the devices SSL certificates so you as a user could install your own and man-in-the-middle the traffic to see what was being sent. AFAIK now the apps use certificate pinning.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#126

Post by cocoto »

Today I have simply given up trying not to share my personal information. What I do instead is simply blocking all ads and don’t use apps/websites that can’t be used without ad blocking. They may have many personal details like my favorite ice cream flavor but I get zero ads so I don’t care that much (I would prefer no one having this information but I’m pragmatic in such terrible society).

Re: Loupe – A iOS app that raises awareness about what native apps can see

#127

Post by maccard »

echoangle wrote: post #99
RedComet wrote: post #75

Earlier quoted context omitted.

Even that is overkill if all you're interested in is if a change occured.

What’s an easier way? I’m assuming they want the app to be able to detect when “a”, was copied, then “b” and then “a” again, so just looking at the value probably isn’t enough.

I don’t think an app should have access to that (without some sort of very special permission).

Re: Loupe – A iOS app that raises awareness about what native apps can see

#128

Post by maccard »

echoangle wrote: post #78
nomilk wrote: post #74

Earlier quoted context omitted.

They don't, utilise the fact that every single iPhone app has access to what other apps are installed! - purchase that info from literally any iPhone app or aggregator that has it for that user. Curious how much this would cost to purhcase - a working credit card goes for $5-10 on the black market so 'apps installed on X's iphone' might be, like, 10c?

Which even halfway credible app developer would sell you that info? You know that’s illegal right? You might get some stupid indie developer to do this but no chance for anything even half big. But if you can get actually get this data, maybe try to do this on yourself and write a blogpost about it. I highly doubt you’ll be able to.

Get your hands on a random selection of 10 iPhones and look at the apps installed. I suspect you’d be horrified. As an example - any parent who has installed a free game for their kids likely has all of this info, plus more via tied in logins.

That said, I agree with the rest of your point - you’re not going to go to a developer and offer them $100 for this data on a person (and if you could, you’d still need to tell them which person, which if you could do you could just get the data yourself)

Re: Loupe – A iOS app that raises awareness about what native apps can see

#129

Post by prime17569 »

gyomu wrote: post #77
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

This exists already! You can see it by going to Settings > Privacy & Security and turning on the App Privacy Report at the bottom.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#130

Post by echoangle »

latexr wrote: post #117
echoangle wrote: post #71

Earlier quoted context omitted.

And how would the is-my-partner-cheating get their app onto the victims device to detect the other apps?

Ask any domestic abuser. Most of them seem to be successful at it. https://www.npr.org/sections/alltechconsidered/2014/09/15/34... It’s crazy to me that people are being so skeptical of the idea. A lot of people share their logins freely with their spouses. I have never done it nor would I condone it, but it would be trivial for me to install spyware on the devices of many people I know, because they rightfully trust…

If you can get the app onto my phone in person, you can also just check which apps I have on my phone
Post reply on HN