Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google to ban financial lending apps from accessing user photos, contacts

pcmag.com

Post reply on HN
Print view View original

31–40 of 165 posts

Re: Google to ban financial lending apps from accessing user photos, contacts

#31

Post by marissachan »

josephcsible wrote: post #6

This feels like treating one particularly visible symptom of the problem instead of fixing the actual problem. What Google should do instead is prevent apps from refusing to work or disabling unrelated functionality just because some permissions are denied (e.g., if you deny your banking app permission to access your camera, everything but mobile check deposit should still have to work). They should use a two-pronged…

"2. Make Android present convincing fake data to apps when permissions are denied"

This is actually a feature with MIUI, though I am not sure if this is part of the global release or only Xiaomi.eu, a modified version of the chinese release). https://xiaomi.eu/community/attachments/screenshot_2022-10-2...

Re: Google to ban financial lending apps from accessing user photos, contacts

#33

Post by the_snooze »

HeavyFeather wrote: post #27
20after4 wrote: post #11

Earlier quoted context omitted.

iOS already has this feature precisely. I can either grant access to all photos or only a selected subset, or even just one.

And I love it, but it has two issues: - Apps can refuse to work with that, like Google Photos (it used to work during the beta and it was perfect for me) - Apps still offer their awful photo picker on top of your already-picked photos, so selecting new ones requires a lot of taps. I wish Apple would reign in some of these apps. In-app browsers and custom photo pickers should be banned unless they have demonstrated ad…

It's the same with location data. iOS allows you to restrict apps to only approximate location, but apps like YouTube TV and ESPN require precise data just to do region checking. I wish iOS just wouldn't allow apps to figure out if they're getting precise vs. approximate location.

Re: Google to ban financial lending apps from accessing user photos, contacts

#34

Post by riedel »

marissachan wrote: post #31
josephcsible wrote: post #6

This feels like treating one particularly visible symptom of the problem instead of fixing the actual problem. What Google should do instead is prevent apps from refusing to work or disabling unrelated functionality just because some permissions are denied (e.g., if you deny your banking app permission to access your camera, everything but mobile check deposit should still have to work). They should use a two-pronged…

"2. Make Android present convincing fake data to apps when permissions are denied" This is actually a feature with MIUI, though I am not sure if this is part of the global release or only Xiaomi.eu, a modified version of the chinese release). https://xiaomi.eu/community/attachments/screenshot_2022-10-2...

This is cool, why is that not a wider available feature in custom ROMs particularly. I used XPrivacy with xposed some time ago to inject that functionality. It was even possible to only expose randomised or fixed GPS and an excerpt from the address book (only favourites).

Re: Google to ban financial lending apps from accessing user photos, contacts

#35

Post by waboremo »

supriyo-biswas wrote: post #14
josephcsible wrote: post #6

This feels like treating one particularly visible symptom of the problem instead of fixing the actual problem. What Google should do instead is prevent apps from refusing to work or disabling unrelated functionality just because some permissions are denied (e.g., if you deny your banking app permission to access your camera, everything but mobile check deposit should still have to work). They should use a two-pronged…

That approach would leave users confused as they see fake contacts or photos being surfaced through the app that was denied said permissions.

Only if you use fake contacts and photos that look real. Instead whenever this is done elsewhere, there is text on the image and the names are obvious. Google can even add a page within privacy where you see the fake options before you can enable it system-wide/per-app.

Re: Google to ban financial lending apps from accessing user photos, contacts

#36

Post by hadrien01 »

nerdjon wrote: post #26
mattzito wrote: post #21

Earlier quoted context omitted.

Android has it: https://techcrunch.com/2022/04/26/google-play-launches-its-o...

Unless I am missing something, that is all on the play store side before you download an app? I am talking after you have the app installed to actually see what it is doing. Specifically what it is doing. On iOS I can see that an app is accessing photos and I can see when, but I can't see what or how much. The feature you mentioned is similar to the labels that iOS has. It even says that in the header.

I have that feature on my tablet (Android 12L or 13), but like you I can only see when ("last 24h"), nothing else.

Edit: I just checked because the screen design felt weird compared to the rest of the settings, it's controlled by Google: com.google.android.permissioncontroller (and it hides Google permission usage by default...)

Re: Google to ban financial lending apps from accessing user photos, contacts

#37

Post by isametry »

20after4 wrote: post #11
jbritton wrote: post #10

I think the OS should provide the ability to select items and then give opaque handles to applications. The app could send a message to the OS to display photo selector. The OS could send a message back with a handle to selected photo. One could then asks the OS to send a handle, which would forward selected item somewhere else.

iOS already has this feature precisely. I can either grant access to all photos or only a selected subset, or even just one.

Yes, or better yet, UIimagePickerController [0].

It’s a hook for the system’s built-in image picker sheet — as such, it allows the user to browse their entire library, however the the app only gets (one-time) access to the individual piece of content they pick. Nice thing is that the app doesn’t need to ask any photo permissions at all (as far as read access is concerned).

With some exceptions like Messages, which presents a custom picker UI, this API gets dog-fooded by almost all Apple’s stock apps (Safari, Notes, Mail, the “iWork” office suite etc…).

An example of a 3rd party app implementation is MaskerAid by Casey Liss [1]. However, the amount of apps I’ve encountered that use this interface is suspiciously low.

The realistic answer is probably that the sheet looks pretty barebones, and most developers seem to prefer a sleeker, custom-designed integrated gallery view, and/or need write access.

But the paranoid part of me raises the question: why do so many apps insist on continuous access to at least a portion, but preferably the entirety of the user’s photo library?

0 – https://developer.apple.com/documentation/uikit/uiimagepicke...

1 – https://apps.apple.com/app/maskeraid/id1590163828

Re: Google to ban financial lending apps from accessing user photos, contacts

#38

Post by iamleppert »

They need to ban that Dave app. I signed up because it offered a loan for $500, but when I got in the app they forced me to "connect" my checking account, sucked up all the data, then offered me only $20. With a daily notification to setup one of their "checking accounts".

The app was advertised as a short-term loan with borrower-friendly terms ("give us a tip!") -- yeah right. Come to find out it's just a new accounts funnel. Yet this app is allowed to blatantly exist on the app stores, despite not doing anything like what it was advertised to do and tricking you into handing over all your transactions data from your checking account (probably to look at your cash flow and decide how valuable you are from a new accounts perspective).

Re: Google to ban financial lending apps from accessing user photos, contacts

#39

Post by xrd »

Wow, those are an entirely new category of dark patterns. Sending manipulated photos of relatives to get someone to pay a debt. Incredible. All those Meta employees that were lamenting the damage caused by their work at a social media company can rest easy when they tell themselves that at least they aren't working for a Kenyan scammy loan app.

Re: Google to ban financial lending apps from accessing user photos, contacts

#40

Post by fbdab103 »

HeavyFeather wrote: post #25
amluto wrote: post #22

Earlier quoted context omitted.

As a good rule of thumb, apps are malicious. If they are not, the libraries they include are. If, somehow, even the libraries aren’t malicious, the attackers who compromise the app or its backend are definitely malicious.

With that logic you really shouldn't use your computer.

We are rapidly approaching that point. Apple is/was/will going to enable on-device scanning for someone's definition of naughty. Not hard to imagine that naughty will soon includes images of Winnie the Pooh, union formation, abortion, minority group X, what have you. Automatic notification of the authorities to follow.

Edit: To be clear, I am obviously opposed to CSAM, but on-device scanning is a privacy violation. Nobody knows what hashes trigger a flag, and they could be updated at anytime without the user being aware.

Post reply on HN