Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

Post reply on HN
Print view View original

141–150 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#141

Post by lapcat »

throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

Curiously, the Mac App Store sandbox has a com.apple.security.network.client entitlement that a developer must justify to Apple, whereas the iOS App Store does not, allowing unrestricted access to the internet.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#142

Post by inigyou »

Cider9986 wrote: post #91
gyomu wrote: post #77

Earlier quoted context omitted.

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

This isn't effective because Little Snitch only sees the domains so apps can just serve the trackers on the same domain as essential services making blocking impossible. The only way to prevent malicious apps from affecting your privacy is to not install them or not give them network access.

Can, but they don't, because app developers are just as lazy and don't waste time to hide their trackers

Re: Loupe – A iOS app that raises awareness about what native apps can see

#143

Post by inigyou »

reorder9695 wrote: post #85
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

AOSP has network as a regular permission for apps, so on Lineage at least (idk about Graphene as I haven't used it) you can disable network for any app including google play services etc. I have no idea why most phone companies remove this permission from their roms but android itself supports it perfectly fine.

GrapheneOS not only has this permission, but it asks you every time you install an app.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#144

Post by inigyou »

microtonal wrote: post #90
reorder9695 wrote: post #85

Earlier quoted context omitted.

AOSP has network as a regular permission for apps, so on Lineage at least (idk about Graphene as I haven't used it) you can disable network for any app including google play services etc. I have no idea why most phone companies remove this permission from their roms but android itself supports it perfectly fine.

It's nice to be able to toggle it (it's also possible to revoke this permission on GrapheneOS). However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. I would guess that Play Services is one of the larger offenders, since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play…

GrapheneOS has user profiles, but they're too heavyweight for most uses.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#145

Post by saagarjha »

inigyou wrote: post #142
Cider9986 wrote: post #91

Earlier quoted context omitted.

This isn't effective because Little Snitch only sees the domains so apps can just serve the trackers on the same domain as essential services making blocking impossible. The only way to prevent malicious apps from affecting your privacy is to not install them or not give them network access.

Can, but they don't, because app developers are just as lazy and don't waste time to hide their trackers

Yet.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#146

Post by saagarjha »

CTDOCodebases wrote: post #125
gyomu wrote: post #77

Earlier quoted context omitted.

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

If I remember correctly iPhone apps used to use the devices SSL certificates so you as a user could install your own and man-in-the-middle the traffic to see what was being sent. AFAIK now the apps use certificate pinning.

Apps can choose to do what they want.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#147

Post by inigyou »

deanishe wrote: post #105
microtonal wrote: post #94

Earlier quoted context omitted.

See my comment upthread, it helps a bit, but does not close this hole since apps within the same profile can communicate through IPC, so other apps could provide network access on their behalf. I think the best example is probably Play Services, which provides functionality for a lot of apps and will communicate with Google, etc. (Yes, you can disable network access to Play Services, but it sometimes breaks things an…

I'm not an Android user. What's a profile? Is that a user thing or a developer thing?

On GrapheneOS, it's like a container, or a virtual phone. Apps in different profiles (and you can install the same app in more than one profile) can't see each other and theoretically can't even tell they're running on the same phone (although I'm sure there are leaks like IP address)

Re: Loupe – A iOS app that raises awareness about what native apps can see

#148

Post by saagarjha »

ignoramous wrote: post #115
microtonal wrote: post #90

Earlier quoted context omitted.

It's nice to be able to toggle it (it's also possible to revoke this permission on GrapheneOS). However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. I would guess that Play Services is one of the larger offenders, since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play…

> However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. Folks brings up 'IPC' as if this is some chink in the armour in AOSP. It isn't. 'Apps' pretty much on most consumer OSes can 'IPC' their way with other co-operating apps to 'achieve' network access from behind a firewall, just the same. > since many apps communi…

There is very little IPC that is allowed for apps that do not share a development team on iOS.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#149

Post by saagarjha »

solarkraft wrote: post #101
aggregator-ios wrote: post #68

One correction to some comments here: an iOS app cannot list all apps that are installed. You can only check for specific apps/schemes (LSApplicationQueriesSchemes) by specifying apps you are looking to query for installation status or open. You cannot provide a large list of unrelated applications since Apple rejects that during app review. Apple added these restrictions because installed app lists can be used for f…

It is terrifying to learn that apps are allowed knowledge about any other app being installed on my phone. Where can I see that list?

Info.plist

Re: Loupe – A iOS app that raises awareness about what native apps can see

#150

Post by inigyou »

Laurel1234 wrote: post #138
water-drummer wrote: post #124

Earlier quoted context omitted.

LinkedIn is the worst offender imo. I am not gonna list every shitty thing they do that goes away the moment you switch to desktop mode but the worst one is that they keep showing you the same feed for weeks if you're on mobile web.

https://browsergate.eu/

.EU? I'd be scared to publish something like that under EU jurisdiction. I could be fined for full actual damages to Microsoft's reputation and I might even be jailed for defamation.
Post reply on HN