Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows all the apps on your phone

peabee.substack.com

Post reply on HN
Print view View original

361–370 of 502 posts

Re: Everyone knows all the apps on your phone

#361

Post by rollcat »

3abiton wrote: post #106
captn3m0 wrote: post #69

The ACTION_MAIN loophole has been written about before: https://commonsware.com/blog/2020/04/05/android-r-package-vi... Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass. There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331

> Google refuses to patch this. That's why projects like XPL-Extended (and previously XPrivacyLua), are an absolute need. I never run an android phone without these.

> If there is one leap that the infosec community consistently fails to make, it is this: people who are not like me, who have different needs and priorities, who have less time or are less technical, STILL DESERVE PRIVACY AND SECURITY.

https://hachyderm.io/@evacide/114184706291051769

Re: Everyone knows all the apps on your phone

#362

Post by TekMol »

Etheryte wrote: post #315
TekMol wrote: post #302

So I downloaded a few dozen Indian apps I could think of on top of my head and started reading their manifest files How do you download apps from the Android app store and read their manifest files? Does this mean one could make a website that lists all those manifest file, so the users could decide against using apps that use this loophole?

Yes, it's called alternative app stores and there's quite a few of them around.

Hmm.. how do the apps from the Android app store get into the alternative app stores? And how do you know they are the same app and not altered?

Re: Everyone knows all the apps on your phone

#363

Post by qbane »

graemep wrote: post #284

The HSBC UK Android app look s at what apps you have, and refuses to run if you have apps with certain permissions (such as an alternative launcher) and now refuses to run if you have any apps from outside the Google app store. I have complained about this here before, but the end result was that I asked for a hardware security device and use the website instead.

Tired of apps using shady, fragile tricks to refuse to work and claiming that you are "secured" by them

Re: Everyone knows all the apps on your phone

#364

Post by fluidcruft »

captn3m0 wrote: post #69

The ACTION_MAIN loophole has been written about before: https://commonsware.com/blog/2020/04/05/android-r-package-vi... Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass. There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331

It seems like the ACTION_MAIN loophole could be fixed (eventually) if apps that declare it are required to actually be launchers. It seems like legitimate integrations should have more specific intents.

At that point, Android prompting if random game you just downloaded should be your defaut launcher seems pretty dangerous interaction for sneaky apps to risk. They either cause the user to bounce and report or the fools select it as default launcher, replace their launcher, can't provide the launcher functionality and break the user's home screen and end up getting reported in Play Store. I also assume actually getting published as a launcher-class app at that point brings automated testsuites and other requirements that will be burdensome for developers.

Re: Everyone knows all the apps on your phone

#365

Post by mattl »

criddell wrote: post #351
fauigerzigerk wrote: post #246

Earlier quoted context omitted.

>I don't want any text to be selectable. I don't want pull to refresh on every page. I don't want the left-swipe to take me to the previous page. Strange. This inability to select any text has always felt like one of the most hostile things developers could ever do. It feels like pure vandalism. Another thing that causes massive productivity degradation is not being able to keep multiple pages open so you can come ba…

On modern mobile and desktop operating systems, you can always copy that portion of the screen to the clipboard and it will recognize the text so you can paste it anywhere.

I’ve noticed that apps can tell when you’re taking a screenshot and often will pop up a little message first which appears in the screenshot.

Reddit on iOS was one that did it.

Re: Everyone knows all the apps on your phone

#366

Post by aucisson_masque »

djrj477dhsnv wrote: post #355
fph wrote: post #313

Earlier quoted context omitted.

A rationale from the core developer [1]: > I'm sure there are plenty of system APIs providing this information too, and I don't just mean APIs designed to directly provide the information. > It's not useful to prevent directly getting a list of installed applications without preventing detecting which applications are installed, so this specific feature request has to be rejected. It would have to be part of a larger…

I get what he's saying, but still seems like blocking the easy way of getting a list of apps, while certainty not perfect, would prevent most privacy abuse.

Yes.

Privacy is not an on off switch, it's about making things leak data less.

I really don't understand grapheneos development sometimes, like when they refuse to make a setting to invert the back and recent button. Yes it's not part of AOSP but it's so simple to do and a feature that all manufacter offer because people want it, refusing to do that is weird imo.

Re: Everyone knows all the apps on your phone

#367

Post by sota_pop »

xxprogamerxy wrote: post #202
turblety wrote: post #137

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

Simple, UX. The reality is, most webapps for mobile just suck. The UX is nowhere near that of a native application. I don't want any text to be selectable. I don't want pull to refresh on every page. I don't want the left-swipe to take me to the previous page. You can probably find workarounds for all these issues. The new Silk library ( https://silkhq.co/ ) is the first case I've seen that get's very close to a nati…

To go along with this UX argument: it’s always been my perception that native apps often lean towards a stateful design while web apps try for stateless. Maybe that’s too abstract (read - incorrect), but was always just where my intuition landed.

Re: Everyone knows all the apps on your phone

#368

Post by mattl »

carlosjobim wrote: post #326
wiseowise wrote: post #221

Earlier quoted context omitted.

> In cases where a native app and web app are both available on iOS, there’s often a huge difference in battery usage and sluggishness. Yeah, like single native instagram draining battery faster than combination of multiple websites that I visit in Safari. > For the same reason I won’t replace my real computer with a Chromebook for the foreseeable future. > real computer Where most of the modern applications are eith…

> Where most of the modern applications are either web wrappers or Electron apps. Only if you're stuck on a depreciated platform like Linux. If you are on Mac, native applications – real applications – are much more powerful and usable than any web wrapper on Linux. I've noticed Linux users have taken a habit of proposing their broken way of using a computer through the browser for other platforms as well. But on oth…

Good native Mac apps are on the decline too.

Re: Everyone knows all the apps on your phone

#370

Post by dangus »

turblety wrote: post #137

I still, will never understand the need for native "Apps". To this day, I have never seen an "App" that couldn't simply have been a website/webapp. Most of them would likely be improved by being a webapp. The only benefits I can see of "Apps", are the developer get's access to private information they really don't need. Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept intr…

So you never use native apps on your desktop? Why should a computing device not be able to run programs?

I feel like an actual security-driven design is a lot better than just relegating everything to the browser.

Post reply on HN