Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

Post reply on HN
Print view View original

181–190 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#181

Post by throwaway27448 »

henryhchchc wrote: post #121
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

iPhones purchased in mainland China (with model number ending in CH/A) do provide options for setting per-app Internet access permissions. There are three options [0]: Off, WLAN only, WLAN and Cellular. [0] https://old.reddit.com/r/ios/comments/aib10i/in_china_ios_al...

Crazy. So they're explicitly selling crippled devices to most of the world.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#182

Post by throwaway27448 »

nashashmi wrote: post #165
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

The evolution of development was to make things easy and simple for the consumer. If internet was an opt-in (and it cannot be opt-out), then app function would be ostensibly limited. And the user would be given a harder time setting things up. This is the Apple mindset. Make things easy. Do not make things complicated.

The attitude was never "don't give the user control", though. Until ios.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#183

Post by developerDan »

ksec wrote: post #179
isodev wrote: post #102

Earlier quoted context omitted.

Yes indeed, the limit is 50 which is of course enough to fully profile "regular people" who only have a handful of apps. Also don't forget, Meta/Google/TikTok/WhateverPalantir are updated weekly which means they can tweak their LSApplicationQueriesSchemes list and cover even more apps if they want to.

Are there legitimate reasons why an App should know I have installed?

Back before Apple allowed users to set the default browser I had a feature in my app that presented a list of installed browsers when a user opens an external link, giving them the option to choose where it opened.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#184

Post by hnav »

ksec wrote: post #179
isodev wrote: post #102

Earlier quoted context omitted.

Yes indeed, the limit is 50 which is of course enough to fully profile "regular people" who only have a handful of apps. Also don't forget, Meta/Google/TikTok/WhateverPalantir are updated weekly which means they can tweak their LSApplicationQueriesSchemes list and cover even more apps if they want to.

Are there legitimate reasons why an App should know I have installed?

E.g if gmail knows that you have maps or chrome it can deep link you into a particular view instead of opening safari.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#185

Post by backscratches »

inigyou wrote: post #153
backscratches wrote: post #86

Earlier quoted context omitted.

Not just possible, currently being implemented. People are murdered every year using this information. Last year a US politician was assassinated by someone who tracked them by buying this information from aggregator. You thought of a tame use case!

Which politician? I want to read more

https://en.wikipedia.org/wiki/2025_shootings_of_Minnesota_le... search for 'data broker' in page. Nightmare world we live in.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#186

Post by dylan604 »

LoganDark wrote: post #58
UqWBcuFx6NV4r wrote: post #54

Earlier quoted context omitted.

Maybe it’s derived

It's probably the app checking the last modified timestamp on some filesystem location that's only touched during setup. Edit: It's not a last modified timestamp, it's a volume creation timestamp: https://github.com/mysk-research/loupe/blob/2262efd4456ecba8...

Again, why is this something that an app would need access? The next test under the creation timestamp value is a test for getting the UUID of the volume. Again, why is an app allowed to access the unique identifier? Apple knows this type of thing is precisely what deanonymizing people would drool over, so why is this accessible. What part of iOS would even need to know this for a legitimate purpose? Are these calls using private methods that Apple does not intend for use being abused for purpose? I'm not an iOS dev, so I have no familiarity with this.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#188

Post by floam »

CTDOCodebases wrote: post #125
gyomu wrote: post #77

Earlier quoted context omitted.

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

If I remember correctly iPhone apps used to use the devices SSL certificates so you as a user could install your own and man-in-the-middle the traffic to see what was being sent. AFAIK now the apps use certificate pinning.

Certificate pinning is actually rarer today than it was a few years ago. You see it mostly in bank apps, and some system services. It’s not a best practice.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#189

Post by cute_boi »

diebeforei485 wrote: post #39
cute_boi wrote: post #26

Apps like TikTok can know which username we logged in with, even if we uninstall and reinstall the app. This is egregious, as many companies like Facebook have SDKs embedded in many apps, allowing them to accurately interconnect user activity. Apple should be ashamed that they aren't putting effort to randomize these fingerprints....

This is probably Keychain, right?

Probably, the most stupid thing with apple is there is no way to clear this keychain AFAIK without resetting whole phone.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#190

Post by RedComet »

fizwidget wrote: post #119
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

Because 99% of apps would request it & not function without it, desensitising users into blindly accepting it. Most apps do have a legitimate reason for accessing the internet, so a binary yes/no wouldn’t achieve much anyway. I just don’t think it’s an effective way of solving the problem.

"99% of apps would request it & not function without it"

Apple could refuse to publish them, then. Isn't that why we are forced to go through the App Store? Because Apple ensures every app there works in the best interest of the user?

Post reply on HN