Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google to ban financial lending apps from accessing user photos, contacts

pcmag.com

Post reply on HN
Print view View original

141–150 of 165 posts

Re: Google to ban financial lending apps from accessing user photos, contacts

#141

Post by prepend »

saagarjha wrote: post #126
prepend wrote: post #116

Earlier quoted context omitted.

And those people should avoid scammy apps that require their bank credentials.

What should they do instead?

Not use those services. I don’t think there’s any essential digital services that require bank access.

The closest is many Venmo/PayPal/cash app but there’s a way to use without giving login access. Instead it just uses the account and routing numbers to make ach transactions on my account.

This is still risky but still much safer, I think. ACH can be reversed. A login with my bank can do all sorts of stuff that my bank holds me liable.

Re: Google to ban financial lending apps from accessing user photos, contacts

#142

Post by throwaway290 »

hakre wrote: post #133
actionablefiber wrote: post #108

Earlier quoted context omitted.

WeChat will loudly grumble every time you try to send a photo if you haven't given access to all photos. But at least it works.

And if you tell me now, that it works without having access to contacts, its lightyears ahead of WhatsApp. But still, these moaning dialogs aren't trust-building. I wish there would be better guidance with UX in the industry.

WhatsApp works without access to contacts now, no?

Re: Google to ban financial lending apps from accessing user photos, contacts

#143

Post by plagiarist »

josephcsible wrote: post #6

This feels like treating one particularly visible symptom of the problem instead of fixing the actual problem. What Google should do instead is prevent apps from refusing to work or disabling unrelated functionality just because some permissions are denied (e.g., if you deny your banking app permission to access your camera, everything but mobile check deposit should still have to work). They should use a two-pronged…

> Make Android present convincing fake data to apps when permissions are denied.

I have wanted this for years. I eventually left Android because the permissions models were deranged (IIRC the number of apps that "need" phone access to pause something during a call). iOS isn't perfect but they seemed to be enforcing your prong #1 at least a little more than Android when I switched.

Re: Google to ban financial lending apps from accessing user photos, contacts

#144

Post by smileybarry »

patch_cable wrote: post #103
charrondev wrote: post #62

Earlier quoted context omitted.

This is how photos access on iOS works. An app can ask for access to photos and you can choose 3 options: - no photos - only specific photos (the system picker will appear to select them) - all photos

Regretfully, it seems on iOS apps can tell they’ve been given access to only specific photos. Googles Photo app refuses to work unless it gets access to all photos.

This was an annoying issue with one of the Twitter competitors a while ago; their app asked for photo access, I gave it partial access, it grumbled that it needs ALL of it, and refused to let me upload any photo. I thought it was a "total photos < X" heuristic, so I went back and picked like 30 old photos, and it still knew that wasn't all of it.

Re: Google to ban financial lending apps from accessing user photos, contacts

#145

Post by smileybarry »

throwaway290 wrote: post #142
hakre wrote: post #133

Earlier quoted context omitted.

And if you tell me now, that it works without having access to contacts, its lightyears ahead of WhatsApp. But still, these moaning dialogs aren't trust-building. I wish there would be better guidance with UX in the industry.

WhatsApp works without access to contacts now, no?

WhatsApp still uses your contacts as its "friends list", i.e.: people appearing in "new chat". You can still text any number with wa.me links but the UI doesn't offer number input IIRC.

Re: Google to ban financial lending apps from accessing user photos, contacts

#146

Post by HWR_14 »

Closi wrote: post #130
HWR_14 wrote: post #56

Earlier quoted context omitted.

Why would the unfriendlessness of payday lenders be essential to the business model?

> Why would the unfriendlessness of payday lenders be essential to the business model? The amount is small, the lending is short term, and customer acquisition costs can be fairly high. This means that the fees / interest must inevitably be quite high - i.e. if you are genuinely lending out $250 for 30 days and you only want to make $25 margin then the effective APR is >120%. Then you are generally giving these loans…

The lending term may be short, but the average lifetime value of a customer is very high, because they usually keep coming back and churn is low.

Meanwhile, in the US (based on FTC complaints statements) "we'll send some people to recover goods" is extremely illegal.

Re: Google to ban financial lending apps from accessing user photos, contacts

#147

Post by SilasX »

gleenn wrote: post #119
SilasX wrote: post #118

Earlier quoted context omitted.

That was a change that seemed to add inconvenience but no additional security. Now I have to first approve an individual photo, then search the pre-approved photos for the photo I just added (they will be sorted by time). Why can't they just let me approve and add a photo at the same time?

But it absolutely provides more security... the app can see only the exact photos you allow. It is a bit annoying as an extra step, but I'll happily give apps access to a single photo selectively versus the all-or-nothing approach where I might choose to completely stop using an app.

Sorry, yes, the segmenting out of permissions on a per-picture basis adds security. What I mean is, the additional hassle added, but the way iOS and apps currently do it, is not necessary for that security. There should be an interface directly from the prompt for pictures on the app's side, to the selection of photo's on my phone's side, to the point that adding pictures is just as easy as it was before. There's no reason for the extra steps to get this added security.

Re: Google to ban financial lending apps from accessing user photos, contacts

#148

Post by pleb_nz »

Recently wanted to know what day a particular date was, so on Samsung, I opened the first calendar app I could find. On opening it asked for location, I denied its request and the application shut down. WTF. I understand why a calendar might want location, but it did not need it to be used as a calendar. Such crap....

Re: Google to ban financial lending apps from accessing user photos, contacts

#149

Post by mrbungie »

never_inline wrote: post #131
mrbungie wrote: post #122

Earlier quoted context omitted.

I think it's a good design decision that just lacks control during the app review process. There are apps that need full access to your photo gallery to be really useful (i.e. where limited pool of photos may have little sense in those contexts), photo deduplication apps being a case on point. At least that piece of information gives the app a chance to tell the user that it may not work as expected. Now, if an app m…

I am the user, and if I allow only Screenshot and Whatsapp images folder to be accessed by your deduplication app, I want it to work on these 2 folders only, without accessing my camera. Same for lets say backup app.

Yeah sure, that's what should happen. I'm not saying otherwise, read the comment again.

Re: Google to ban financial lending apps from accessing user photos, contacts

#150

Post by flangola7 »

saagarjha wrote: post #125
flangola7 wrote: post #43

Earlier quoted context omitted.

Running arbitrary and proprietary code without being able to review it first was always a mistake but we crossed that bridge over twenty years ago. Every OS and chip manufacturer is working towards "secure core" architectures now. Executed code will run inside OS and silicon-level sandboxes. Memory spaces will not only be randomized, but encrypted and authenticated through dedicated secure enclaves. Hardened IOMMU mo…

I wish you’re right but I don’t see how what you’ve mentioned stops most malware.

In a nutshell, because an application won't be able to do anything evil. We're already halfway there on mobile devices. An Android app cannot access system files or files of other apps, period. "Run as admin" doesn't exist. It can't access shared files like camera photos or documents without explicit user permission.

This is mostly accomplished using SELinux, which is an afterthought slapped onto the original OS architecture.

There are exploits that defeat these walls, but it's getting harder. Walls built from the hardware level up will be almost impenetrable and might require finding an error in the chips' microcircuit designs.

Post reply on HN