21–30 of 82 posts
The time is coming for Apple to support iCloud private relay for all 3rd party apps. Ideally nothing is leaving the phone without it shortly.
A bit off topic, but this website has some of the most draconian TOS I've ever seen > You agree that the information on this website is copyrighted, and you therefore agree not to distribute this information (whether the downloaded _le, copies / images / reproductions, or the link to these _les) in any manner other than by providing the following link: http://GRIZZLYREPORTS.COM So this HN submission is in violation o…
"cmd package compile" doesn't compile source code at runtime. It forces ahead-of-time compilation of an application's existing bytecode, which is something which Android already does on an as-needed basis. I'm not sure why the Temu app would be running this command (performance, maybe?), but it isn't clearly dangerous either.
https://source.android.com/docs/core/runtime/jit-compiler
The rest of the analysis doesn't seem much better, e.g.
> 3) TEMU queries information related to files, and not just its own files, but wants information on all files on the user’s device by referencing “EXTERNAL_STORAGE”, superuser rights and log files.
The EXTERNAL_STORAGE permission is literally just external storage, like the name implies. It doesn't grant access to files in internal storage, like other applications' data or system logs.
> 5) “Root” access. TEMU checks if a device has “root” access.
Yes, this is fairly common. (And indeed, the table at the top of the report notes that most of the other shopping apps they analyzed did this.)
> 6) Encryption, decryption and shifting integer signals libraries are in prior versions of Pinduoduo and TEMU apps. The only purpose of this is obscuration of malicious intent.
I'm not even sure what they're trying to suggest by this. Are they actually assuming that any use of bit-shifting operators is malicious?
> 10) [...] The TEMU app even reads and stores the MAC address, which is a unique and global hardcoded network identifier of a device. This is a big No No in internet security. A Distributed Denial of Service (DDOS) attack and other unwanted security probes could conceivably be launched against a disclosed MAC address.
This is complete nonsense. MAC addresses don't work like that.
> 11) Looking over your shoulder while you use your smartphone. TEMU calls getWindow().getDecorView().getRootView(), to make screenshots
That only captures the appearance of the Temu application, not other applications on the system.
A long writeup but very few facts: > TEMU is estimated ( Link ) to be losing $30 per order. Its ad spending and shipping costs (1-2 weeks from China, expedited to U.S. delivery) are astronomical. One is left wondering how this business could ever be profitable. > TEMU is a notoriously bad actor in its industry. We see rampant user manipulation, chain-letter-like affinity scams to drive signups, and overall, the most…
Surprisingly, for almost all the things that I've bothered to compare, Amazon is actually cheaper than Temu. Even cheap toys from China that I thought would be Temu's bread and butter. And of course the shipping is no contest. The deals look good in their app but try searching for the same item on Amazon and I bet you will be surprised. Temu sometimes gives you more flexibility to order a single copy of small items w…
A long writeup but very few facts: > TEMU is estimated ( Link ) to be losing $30 per order. Its ad spending and shipping costs (1-2 weeks from China, expedited to U.S. delivery) are astronomical. One is left wondering how this business could ever be profitable. > TEMU is a notoriously bad actor in its industry. We see rampant user manipulation, chain-letter-like affinity scams to drive signups, and overall, the most…
I'm not exactly an Android expert but... android.permission.INSTALL_PACKAGES, getRuntime.exec()... these basically are permissions for remote code execution, are they not? I think this blogpost is hyperbolic in its discussion and that's a bit unhelpful. But this does look like a serious problem on my first glance. I'd like to see what a real Android-developer thinks about these permissions though.
How did they even get the android.permission.INSTALL_PACKAGES permission approved on the play store? Google clearly states that: To use this permission, your app’s core functionality must include: Sending or receiving app packages, AND Enabling user-initiated installation of app packages. If your app does not meet the requirements for acceptable use below, you must remove it from your app's manifest in order to compl…
https://play.google.com/store/apps/details?id=com.einnovatio...
I'm not exactly an Android expert but... android.permission.INSTALL_PACKAGES, getRuntime.exec()... these basically are permissions for remote code execution, are they not? I think this blogpost is hyperbolic in its discussion and that's a bit unhelpful. But this does look like a serious problem on my first glance. I'd like to see what a real Android-developer thinks about these permissions though.