41–50 of 165 posts
> predatory loan apps Loan sharks?! We reached a point when I don't even allow chat app (WhatsApp) to access my contacts. Banks' apps love contacts as well ("send money to phone number"). With "convenience" bait they get birth dates, physical addresses, emails, profile photos, and whatnot. I see from behind my keyboard how banks salivate to calculate some credit worthiness from the contacts uploaded (and confirmed by…
Earlier quoted context omitted.
That approach would leave users confused as they see fake contacts or photos being surfaced through the app that was denied said permissions.
Only if you use fake contacts and photos that look real. Instead whenever this is done elsewhere, there is text on the image and the names are obvious. Google can even add a page within privacy where you see the fake options before you can enable it system-wide/per-app.
Earlier quoted context omitted.
As a good rule of thumb, apps are malicious. If they are not, the libraries they include are. If, somehow, even the libraries aren’t malicious, the attackers who compromise the app or its backend are definitely malicious.
With that logic you really shouldn't use your computer.
Every OS and chip manufacturer is working towards "secure core" architectures now. Executed code will run inside OS and silicon-level sandboxes. Memory spaces will not only be randomized, but encrypted and authenticated through dedicated secure enclaves. Hardened IOMMU modules will negotiate bus communication. System code is partitioned off and verified through hardware root of trust.
Malware as we have known it will be extinct in a few years.
Earlier quoted context omitted.
There is such a thing as going too far though. An app I'm familiar with had Apple rejecting the app for accessing contacts, even though the contacts stay on device at all times and the only way they are exported is if you send a debug log which has a warning modal about their contacts being logged and gives the user the chance to edit those out. There was nothing to be done that would satiate Apple besides disabling…
What did the app need the contacts for? I'd say I side with apple on that (I can see how it could be abused to shut down competition though). There really would need to be a good reason to have the contacts. (I don't want to debate the threshold, just interested in a "benign" example of needing contacts)
Earlier quoted context omitted.
There is such a thing as going too far though. An app I'm familiar with had Apple rejecting the app for accessing contacts, even though the contacts stay on device at all times and the only way they are exported is if you send a debug log which has a warning modal about their contacts being logged and gives the user the chance to edit those out. There was nothing to be done that would satiate Apple besides disabling…
As the other person said, what did it actually need the contacts for? Was it being rejected for asking or for being broken if it didnt get the permissions? Or was it simply not able to give a justifiable reason to Apple for needing the permission? You say it was staying on device but once you have access to those contacts it would be trivial to add the ability to send them to a server or have them leak via third part…
There were no social SDKs integrated, and the app and build pipeline are public on GitLab.
Earlier quoted context omitted.
Only if you use fake contacts and photos that look real. Instead whenever this is done elsewhere, there is text on the image and the names are obvious. Google can even add a page within privacy where you see the fake options before you can enable it system-wide/per-app.
The app could also detect the fake text based on general testing (after all, there's gonna be only so many variations of "Biggus Dickus") and refuse to dispense the functionality in question.
Earlier quoted context omitted.
Unless I am missing something, that is all on the play store side before you download an app? I am talking after you have the app installed to actually see what it is doing. Specifically what it is doing. On iOS I can see that an app is accessing photos and I can see when, but I can't see what or how much. The feature you mentioned is similar to the labels that iOS has. It even says that in the header.
I have that feature on my tablet (Android 12L or 13), but like you I can only see when ("last 24h"), nothing else. Edit: I just checked because the screen design felt weird compared to the rest of the settings, it's controlled by Google: com.google.android.permissioncontroller (and it hides Google permission usage by default...)
As well as seeing iCloud at the top of my “most contacted domains”.
But under app network activity I don’t see system level processes (at least I don’t think I do). Unless it still falls under an app… like iCloud domain lists safari and find my for the related apps.
Honestly I just want an audit log. I’m glad both are putting steps in catch bad apps but it’s missing the data to really see if it’s misbehaving.
They need to ban that Dave app. I signed up because it offered a loan for $500, but when I got in the app they forced me to "connect" my checking account, sucked up all the data, then offered me only $20. With a daily notification to setup one of their "checking accounts". The app was advertised as a short-term loan with borrower-friendly terms ("give us a tip!") -- yeah right. Come to find out it's just a new accoun…
This feels like treating one particularly visible symptom of the problem instead of fixing the actual problem. What Google should do instead is prevent apps from refusing to work or disabling unrelated functionality just because some permissions are denied (e.g., if you deny your banking app permission to access your camera, everything but mobile check deposit should still have to work). They should use a two-pronged…