Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

Post reply on HN
Print view View original

211–220 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#211

Post by fragmede »

saagarjha wrote: post #148
ignoramous wrote: post #115

Earlier quoted context omitted.

> However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. Folks brings up 'IPC' as if this is some chink in the armour in AOSP. It isn't. 'Apps' pretty much on most consumer OSes can 'IPC' their way with other co-operating apps to 'achieve' network access from behind a firewall, just the same. > since many apps communi…

There is very little IPC that is allowed for apps that do not share a development team on iOS.

What stops the app from opening a link in Safari to trackmyshit.com/uuid-uuid-uuid-uuid that closes itself.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#212

Post by fragmede »

yftsui wrote: post #205
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

iPhones sold in China have that in settings, you can block both WLAN(Wi-Fi) and Cellular data per app. Why that turned out to be a nightmare is a different story

What's the story?

Re: Loupe – A iOS app that raises awareness about what native apps can see

#213

Post by Laurel1234 »

inigyou wrote: post #150
Laurel1234 wrote: post #138

Earlier quoted context omitted.

https://browsergate.eu/

.EU? I'd be scared to publish something like that under EU jurisdiction. I could be fined for full actual damages to Microsoft's reputation and I might even be jailed for defamation.

.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#214

Post by tokioyoyo »

fauigerzigerk wrote: post #159
fizwidget wrote: post #119

Earlier quoted context omitted.

Because 99% of apps would request it & not function without it, desensitising users into blindly accepting it. Most apps do have a legitimate reason for accessing the internet, so a binary yes/no wouldn’t achieve much anyway. I just don’t think it’s an effective way of solving the problem.

100% of users have legitimate reasons to block internet access for some apps. If internet access wasn't granted by default, a lot more apps would function without it. Many other apps wouldn't exist at all, because their only reason to exist is to spy on users.

Not going to lie, it would be an absolute hell to develop an app that's actually used without getting crash/analytics.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#215

Post by fragmede »

dylan604 wrote: post #186
LoganDark wrote: post #58

Earlier quoted context omitted.

It's probably the app checking the last modified timestamp on some filesystem location that's only touched during setup. Edit: It's not a last modified timestamp, it's a volume creation timestamp: https://github.com/mysk-research/loupe/blob/2262efd4456ecba8...

Again, why is this something that an app would need access? The next test under the creation timestamp value is a test for getting the UUID of the volume. Again, why is an app allowed to access the unique identifier? Apple knows this type of thing is precisely what deanonymizing people would drool over, so why is this accessible. What part of iOS would even need to know this for a legitimate purpose? Are these calls…

To stop people from using apps they haven't paid for. As an honest person, if you want to use an app, you'd pay for it. Unfortunately, not everyone out there is honest, and there are various ways to get around having to pay for an app that costs money. Fingerprinting the device lets sellers of software find people who didn't pay for the software but are somehow using it.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#216

Post by Larrikin »

rationalist wrote: post #194
throwaway27448 wrote: post #180

Earlier quoted context omitted.

> Most apps do have a legitimate reason for accessing the internet I just flat out think this is bullshit

You are right, it is BS. Non-multiplayer games, clock, camera, contacts, phone, text message, file explorer, keyboard, launcher, notes, document viewer/editor, image viewer, audio recorder... Most of the apps on my phone do not need internet access.

Every single one of those, except for the games, is a pre-installed built in app. It seems like you just don't use apps.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#217

Post by dessimus »

throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

>most apps don't have any need to access the internet in the first place.

It would severely depend on how you categorize "most apps" because I would say I pretty much only use apps that need the Internet, barring Calculator, Camera, and a PDF reader (only because I prefer how it zooms books vs browser. Everything else implicitly needs the Internet as that app is just a better UI to using their mobile web site, if they even offer one.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#218

Post by inigyou »

Laurel1234 wrote: post #213
inigyou wrote: post #150

Earlier quoted context omitted.

.EU? I'd be scared to publish something like that under EU jurisdiction. I could be fined for full actual damages to Microsoft's reputation and I might even be jailed for defamation.

.

I live in Germany. It's extremely repressive here, especially around Palestine, or any criticism of ruling politicians or rich people.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#219

Post by throwaway27448 »

dessimus wrote: post #217
throwaway27448 wrote: post #62

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

>most apps don't have any need to access the internet in the first place. It would severely depend on how you categorize "most apps" because I would say I pretty much only use apps that need the Internet, barring Calculator, Camera, and a PDF reader (only because I prefer how it zooms books vs browser. Everything else implicitly needs the Internet as that app is just a better UI to using their mobile web site, if the…

Apps are more than just a gateway to content. Your phone is also useful as a tool in itself. Most health, hardware, creative, and productivity apps do not need access to the internet. Even downloading, say, content packs could be done via icloud if apple cared about privacy. Syncing with icloud and not some rando company's probably insecure webapp is a great deal of the appeal of an app store in the first place.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#220

Post by xnx »

nomilk wrote: post #92
aggregator-ios wrote: post #68

One correction to some comments here: an iOS app cannot list all apps that are installed. You can only check for specific apps/schemes (LSApplicationQueriesSchemes) by specifying apps you are looking to query for installation status or open. You cannot provide a large list of unrelated applications since Apple rejects that during app review. Apple added these restrictions because installed app lists can be used for f…

But a single app can request to know the presence of up to 50 apps, right? And a data broker/aggregator can purchase such data from many (e.g. thousands) of apps and aggregate it, then sell it.

People think LinkedIn is scummy (they are) for scanning for browser extensions, but what Apple is allowing is even worse.
Post reply on HN