AppLovin nonconsensual installs • Hacker News Board

Re: AppLovin nonconsensual installs

#61

Post by lurtbancaster » Thu, Oct 16, 2025, 10:16 AM UTC

cudgy wrote: post #59

lurtbancaster wrote: post #53

> ad tap (just clicking an ad, potentially a misclick aiming for a tiny X button, with no Install button even visible on screen) > AppLovin’s X’s are unusually tiny, so mis-taps are especially likely This is why I use Intent Intercept - https://f-droid.org/en/packages/de.k3b.android.intentinterce... It tells me exactly what's about to happen from my tap(accidental or intentional), and gives me the option to undo my t…

Makes sense. Pretty sad to have to install a tool like that to get security on a platform that is used by billions of users. Even more shocking that apps get installed just from clicking a small close button on a silly ad without even prompting for the install? Installing random tools to hopefully get more security, though is risky also. Hopefully that tool doesn’t get compromised as it is privy to all intent activit…

> Pretty sad to have to install a tool like that to get security on a platform that is used by billions of users.

You click on a banner ad inside an app, and if you have Intent Intercept installed, it won't immediately register as an "impression" and take you to wherever the banner has been programmed to take you to by default. Since Intent Intercept also affects the ad industry(of which Google is a big part), I don't expect Google to build a similar less-nerdy tool into Android by default.

> Installing random tools to hopefully get more security, though is risky also. Hopefully that tool doesn’t get compromised as it is privy to all intent activity.

Intent Intercept is open source(Apache License 2.0 https://github.com/k3b/intent-intercept) and its release binaries are hosted on F-Droid, arguably the most trusted Android "store" for Free and Open Source apps. So I'm not too worried.

Re: AppLovin nonconsensual installs

#62

Post by cudgy » Thu, Oct 16, 2025, 3:19 PM UTC

lurtbancaster wrote: post #61

cudgy wrote: post #59

Earlier quoted context omitted.

Makes sense. Pretty sad to have to install a tool like that to get security on a platform that is used by billions of users. Even more shocking that apps get installed just from clicking a small close button on a silly ad without even prompting for the install? Installing random tools to hopefully get more security, though is risky also. Hopefully that tool doesn’t get compromised as it is privy to all intent activit…

> Pretty sad to have to install a tool like that to get security on a platform that is used by billions of users. You click on a banner ad inside an app, and if you have Intent Intercept installed, it won't immediately register as an "impression" and take you to wherever the banner has been programmed to take you to by default. Since Intent Intercept also affects the ad industry(of which Google is a big part), I don'…

I think we should always be worried when installing even open source tools that are injected within operating system functions, especially tools that pull in many external libraries. It adds to the threat surface area.

However, in this case, this tool will hopefully mitigate that risk and, as you said, the creator of the OS is actually a threat too (by leaving their OS vulnerable in order to facilitate their ad business).

Re: AppLovin nonconsensual installs

#63

Post by doctorpangloss » Fri, Oct 17, 2025, 2:21 AM UTC

bedelman wrote: post #32

doctorpangloss wrote: post #18

AppLovin has been doing this for a long time. BlueStacks and some other vendors have been doing this for literally a decade. The root problem is that Google Play is poorly curated. One problem it has is that it ranks apps that have many downloads higher than those with fewer downloads. AppLovin is used to boost downloads for the purposes of the Google Play algorithm. Of course, this is known to Google.

Are you sure BlueStacks installs apps without user consent? I know BlueStacks as an emulator to play Android games on PC and Mac. That's a legitimate business, 100% consistent with what users want. Versus what I (author of the piece linked above) reported is that AppLovin is installing apps that users don't want -- installing silently, installing when users tap X, installing after a quick (5 second) countdown.

> Are you sure BlueStacks installs apps without user consent?

You think deeply about that question.

Re: AppLovin nonconsensual installs

#64

Post by bedelman » Fri, Oct 17, 2025, 6:19 AM UTC

nightpool wrote: post #57

bedelman wrote: post #31

Earlier quoted context omitted.

Ben Edelman here, author of the page you linked above and the full article at https://www.benedelman.org/applovin-nonconsensual-installs/ (linked from top of this page). Happy to answer any questions.

I think the structure of this article definitely made it harder to find the details to some of these questions—the fact that it's posted as 5-8 different "blog" entries instead of a single webpage made it harder then it needed to be to get to the technical conclusions section. Also, some of the method call listings on this page: https://www.benedelman.org/applovin-execution-path/ were unnecessarily verbose, and dupli…

Thanks for these suggestions. You may be right. I split the article into pages based on feedback from early readers that it was too long. Custom nav bar in the top-right, but maybe still not quite right. I've never previously posted anything of this length or complexity.

Thanks also for reading so carefully. My web stats say many people stopped at the summary!