Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

Post reply on HN
Print view View original

201–210 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#201

Post by Hoodedcrow »

inigyou wrote: post #144
microtonal wrote: post #90

Earlier quoted context omitted.

It's nice to be able to toggle it (it's also possible to revoke this permission on GrapheneOS). However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. I would guess that Play Services is one of the larger offenders, since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play…

GrapheneOS has user profiles, but they're too heavyweight for most uses.

Profiles are a thing in "stock" Android too, they just don't have the toggle to disallow them working in the background, the "Install available apps" option and Google services also keep working across profiles.

If you want something less disruptive for isolation, there's Private Space. What I like is that this can stop apps there from working in the background on stock Android as well.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#202

Post by nodamage »

throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

> most apps don't have any need to access the internet in the first place

Citation needed.

Looking through my phone the vast majority of third party apps I have installed obviously require internet access:

- Social media

- Travel (rideshare/airlines/hotels)

- Streaming

- Finance (credit cards/banks)

- Shopping

Not counting built-in apps like the calculator I'd estimate 80-90% of the apps I have installed require internet access.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#203

Post by tancop »

thewebguyd wrote: post #192
ksec wrote: post #178

Earlier quoted context omitted.

What? Why is this Chinese market only? This is exactly what I wanted. There are Apps I simply don't want them to touch internet.

Its Chinese market only because of regulation. China mandates it. Don't implement it = you don't get to sell in China. If Apple wanted to provide this willingly they would. That its only available in China due to government regulation tells you all you need to know.

i got an old EU market redmi (yes im broke) and you can turn off either wifi or cellular or both for any non system app. remember apple had to put in work to actively block the feature outside of china.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#204

Post by dunder_cat »

nomilk wrote: post #60

Why does a random app (with no special permissions given to it) get access to so much info, and why doesn't Apple tell users this (important) info? Why can't Apple make a long list of check boxes so users can dis/allow on a per-category and per-app basis? E.g. I had no idea a random app you install (and give no permissions to) instantly has a list of every app installed on the device (e.g. can infer whether you're da…

I'm in that camp of has a dating app installed but have no partner so the is-my-partner-cheating admittedly doesn't resonate with me. I've had to do some of this fingerprinting myself before for non-data-selling reasons so a lot of the system-level statistics didn't quite impress me [1], but that one was a gut-punch when I saw it pop up. It makes me wonder what apps out there have leveraged that as a signal for ads or other behavior modifications to exploit my search for a partner -- without at least having to spend a few pennies querying a data broker!

It makes sense that there's some discovery mechanism - since Google loves to use it to prefer Chrome, GMail, etc when you're in one of their apps. I wish that there were more restrictions though where you only get implicit permission to query from apps that have the same developer ID. Maybe a mutual allowlist that has to be formed, or some sort of privileged intent where you at least have to tell Apple what's going on and that gives them some contractual right to sanction you if you're using it for nefarious purposes instead.

[1] excluding the clipboard copy count, that was novel!

Re: Loupe – A iOS app that raises awareness about what native apps can see

#205

Post by yftsui »

throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

iPhones sold in China have that in settings, you can block both WLAN(Wi-Fi) and Cellular data per app. Why that turned out to be a nightmare is a different story

Re: Loupe – A iOS app that raises awareness about what native apps can see

#206

Post by bethekidyouwant »

iancarroll wrote: post #13
bethekidyouwant wrote: post #11

Earlier quoted context omitted.

Well “they” can technically “read” anything your user can.

Apps installed via the MAS have sandboxing applied to them, so this isn't really true.

Great back to my original question which (mas)“apps” do people actually have installed on their MacBook.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#207

Post by ignoramous »

saagarjha wrote: post #148
ignoramous wrote: post #115

Earlier quoted context omitted.

> However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. Folks brings up 'IPC' as if this is some chink in the armour in AOSP. It isn't. 'Apps' pretty much on most consumer OSes can 'IPC' their way with other co-operating apps to 'achieve' network access from behind a firewall, just the same. > since many apps communi…

There is very little IPC that is allowed for apps that do not share a development team on iOS.

> There is very little IPC

I am not familiar with iOS internals, but does "very little IPC" mean "zero IPC"? Because if we are talking IPC in the context of bypassing permission checks, I imagine, 'very little' doesn't cut it?

Re: Loupe – A iOS app that raises awareness about what native apps can see

#208

Post by feelamee »

throawayonthe wrote: post #50
iririririr wrote: post #29

Earlier quoted context omitted.

...wouldn't it be better to have a pocket computer you own?

if you think "desktop" operating systems aren't even worse on this, you're very mistaken

sure, without any action from the user to increase safety, desktop OS's just allow any app to read any files. On the other hand, desktop OS's allow a wide spread list of ways to control what applications have access too (especially Linux and BSD families). Although, despite all this, running malware can never be safe.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#210

Post by coffeecoders »

nodamage wrote: post #202
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

> most apps don't have any need to access the internet in the first place Citation needed. Looking through my phone the vast majority of third party apps I have installed obviously require internet access: - Social media - Travel (rideshare/airlines/hotels) - Streaming - Finance (credit cards/banks) - Shopping Not counting built-in apps like the calculator I'd estimate 80-90% of the apps I have installed require inte…

It's a selection bias issue. The categories you have listed are essentially web services wrapped in an app shell. Of course they need the internet. Consider these examples:

- Photo/Video editors - Snapsheed, Lightroom, Video trimmers etc.

- Document readers & scanners - PDF viewers, e-readers, OCR scanners

- Note taking - Obsidian

- File/Password managers - Authenticators etc.

- Single player games - Chess, puzzles etc.

- Audio/Video players - VLC players

We've just become conditioned to accept that every app needs to phone home for tracking and ad-delivery.

Post reply on HN