Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

291–300 of 502 posts

Re: Everyone knows all the apps on your phone

#292

Earlier quoted context omitted.

It is. It specifically says that the apps must be declared in the manifest like other permissions. So it's a specific permission for each app really. F-Droid could query that if it wants to (not sure if it does)

Did you stop reading before the post got to the MAIN loophole that doesn't require the list of apps in the manifest? How does F-droid describe MAIN?

Yeah I did as the article was a bit long. But I'm sure this is detectable too as it must be in the manifest.

Re: Everyone knows all the apps on your phone

#293

Earlier quoted context omitted.

> Google refuses to patch this. That's why projects like XPL-Extended (and previously XPrivacyLua), are an absolute need. I never run an android phone without these.

XPrivactLua and other XposedMod/Magisk extensions break open the app sandbox. It is better to restrict running those on usereng/eng builds (test devices). For prod builds (user devices), I'd recommend using Work Profiles (GrapheneOS supports upto 31 in parallel) or Private Spaces (on Android 15+) to truly isolate apps from one another.

The question is: Who is the beneficiary of the app sandbox? Is it you, the user, because no malicious processes can taper with your apps? Or is it the corporations, because they prevent you from modifying their apps – which makes you a pure consumer?

I think, for the tech-savvy, the latter is more accurate and I think it is very important to be able to crack open these sandboxes and tinker with processes. Be it to inject ad blockers, automate them, modify their appearance, etc. It should be a right of a user to be able to do these things.

Re: Everyone knows all the apps on your phone

#294

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

Speed, and from that follows battery life.

Re: Everyone knows all the apps on your phone

#298

Earlier quoted context omitted.

Simple, UX. The reality is, most webapps for mobile just suck. The UX is nowhere near that of a native application. I don't want any text to be selectable. I don't want pull to refresh on every page. I don't want the left-swipe to take me to the previous page. You can probably find workarounds for all these issues. The new Silk library ( https://silkhq.co/ ) is the first case I've seen that get's very close to a nati…

You have to wonder about the motivations of the company making the browser that makes it impossible to disable some of these things, and therefore makes real apps so much superior (like swipe to go back on safari - I have never ever swiped back intentionally in over 100000 swipe backs).

> I have never ever swiped back intentionally in over 100000 swipe backs

Real question here, what are you trying to do when you "swipe back"?

Re: Everyone knows all the apps on your phone

#299

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

In other words, you believe all computers should be Chromebooks, which can only run Chrome and nothing else?

Re: Everyone knows all the apps on your phone

#300
post #13

Earlier quoted context omitted.

Most windows apps aren't sandboxed, so them being able to grab window titles is the least of your worries. Any program can steal your login sessions and passwords if they wanted to. https://xkcd.com/1200/

Are you essentially discussing like a keylogger? I can't imagine windows intentionally keeps the plaintext password anywhere longer than it needs to be.

Actually windows can keep them in memory for a lot longer than you'd think, hence Mimikatz https://github.com/ParrotSec/mimikatz
Post reply on HN