Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google to ban financial lending apps from accessing user photos, contacts

pcmag.com

Post reply on HN
Print view View original

81–90 of 165 posts

Re: Google to ban financial lending apps from accessing user photos, contacts

#81

Post by celdon25 »

josephcsible wrote: post #6

This feels like treating one particularly visible symptom of the problem instead of fixing the actual problem. What Google should do instead is prevent apps from refusing to work or disabling unrelated functionality just because some permissions are denied (e.g., if you deny your banking app permission to access your camera, everything but mobile check deposit should still have to work). They should use a two-pronged…

The actual problem is that travesties of this scale are allowed to happen on Google’s watch for so long, despite the Orwellian grip it has on deciding what apps are allowed to be listed. A good example of why that system needs to be reformed.

This particular issue didn’t get addressed until at least 8 months after TechCrunch exposed the practice. Where was Google?

Control of the App Store and Play Stores should be carefully transferred to an independent organization, with an open governance model and a mission to serve consumer interests. It won’t be perfect but it would be a big step up.

If that can’t be done for whatever reason, find another way to disrupt the App Store. I struggle to think of why not doing so is a net good for society.

Re: Google to ban financial lending apps from accessing user photos, contacts

#82

Post by autoexec »

Volker_W wrote: post #70

I never understood why Program permissions is such a big deal on Android and IOS, but not on Desktop Windows/Linux, where any application can to everything .

I'd love permissions for desktop apps too, but it's not as big a deal because on a desktop I have root access and can monitor what applications are doing myself. I can see which files or hardware is being accessed and when. I can see what network traffic is being sent and to where. I have full control over what applications are installed and what they are allowed to do. I can even fully sandbox apps or run them in VMs.

The phone in my pocket isn't mine, I paid for it, but it belongs to Google, and they make changes to it all the time without my permission and without giving any indication to me that something was changed on my device. Google prevents me from being able to see what the apps on it are doing, and prevents me from changing how they run, or from monitoring all in/outbound communication.

Google's shitty permissions system is such a big deal for mobile because it's literally all we have "protecting" us, and that isn't much. Naturally that leaves us with zero protection from Google itself. but that's the price we pay for having a mobile device that gives us more freedom than Apple ever would.

Re: Google to ban financial lending apps from accessing user photos, contacts

#83

Post by wilg »

fbdab103 wrote: post #40
HeavyFeather wrote: post #25

Earlier quoted context omitted.

With that logic you really shouldn't use your computer.

We are rapidly approaching that point. Apple is/was/will going to enable on-device scanning for someone's definition of naughty. Not hard to imagine that naughty will soon includes images of Winnie the Pooh, union formation, abortion, minority group X, what have you. Automatic notification of the authorities to follow. Edit: To be clear, I am obviously opposed to CSAM, but on-device scanning is a privacy violation. N…

The problem is the top-level poster was also suggesting banning apps based on their definition of naughty (and "related" features).

Re: Google to ban financial lending apps from accessing user photos, contacts

#84

Post by AlexandrB »

ezfe wrote: post #60
the_snooze wrote: post #33

Earlier quoted context omitted.

It's the same with location data. iOS allows you to restrict apps to only approximate location, but apps like YouTube TV and ESPN require precise data just to do region checking. I wish iOS just wouldn't allow apps to figure out if they're getting precise vs. approximate location.

Yeah, I had Snapchat location map enabled with imprecise locations during iOS beta, but they disabled that...like, why! just show the error bar on the map if you care.

If I had to guess, probably because some of Snapchat's revenue comes from selling your location data and the general location is far less valuable.

Re: Google to ban financial lending apps from accessing user photos, contacts

#85

Post by AlexandrB »

supriyo-biswas wrote: post #17
version_five wrote: post #4

It's "good" in the same way that "google stops punching man in the face" might be good. In a sea of predatory applications, why is lending the only one that gets blocked here? A whitelist would be better (say approved photo and contact apps could access photos and contacts), and better still would be the app can only access what you transfer to it and doesn't get blanket permissions. I also agree with the other comme…

> In a sea of predatory applications, why is lending the only one that gets blocked here? Because lending apps are the only one to engage in egregious behavior, see [1] as an example. The relevant sections are quoted below: > If a user was late to repay, the app had previously indiscriminately texted or called contacts in the user’s phone as part of loan collection efforts. This process began immediately after a loan…

> If a user was late to repay, the app had previously indiscriminately texted or called contacts in the user’s phone as part of loan collection efforts.

Didn't LinkedIn do something similar early on? Harvest your contacts and then email everyone trying to get them to join.

Re: Google to ban financial lending apps from accessing user photos, contacts

#86

Post by joshuaissac »

supriyo-biswas wrote: post #42
waboremo wrote: post #35

Earlier quoted context omitted.

Only if you use fake contacts and photos that look real. Instead whenever this is done elsewhere, there is text on the image and the names are obvious. Google can even add a page within privacy where you see the fake options before you can enable it system-wide/per-app.

The app could also detect the fake text based on general testing (after all, there's gonna be only so many variations of "Biggus Dickus") and refuse to dispense the functionality in question.

The OS could add an option to automatically generate realistic mock data. It could be tuned based on the distribution of names in the location that is revealed to the app (whether that is the real location or a mocked one).

Re: Google to ban financial lending apps from accessing user photos, contacts

#87

Post by AlexandrB »

nerdjon wrote: post #26
mattzito wrote: post #21

Earlier quoted context omitted.

Android has it: https://techcrunch.com/2022/04/26/google-play-launches-its-o...

Unless I am missing something, that is all on the play store side before you download an app? I am talking after you have the app installed to actually see what it is doing. Specifically what it is doing. On iOS I can see that an app is accessing photos and I can see when, but I can't see what or how much. The feature you mentioned is similar to the labels that iOS has. It even says that in the header.

Yeah, something like Little Snitch but for any access to "sensitive" areas of a phone (location, contacts, camera, microphone, photos) in addition to network access would be cool.

Re: Google to ban financial lending apps from accessing user photos, contacts

#88

Post by AlexandrB »

thomasahle wrote: post #73
Volker_W wrote: post #70

I never understood why Program permissions is such a big deal on Android and IOS, but not on Desktop Windows/Linux, where any application can to everything .

It's just that innovation on the desktop side died years ago.

You say that, but Microsoft is only a few years away from integrating Bonzi Buddy into Windows 11 and Edge. For the benefit of the user, of course! /s

Re: Google to ban financial lending apps from accessing user photos, contacts

#89

Post by amelius »

josephcsible wrote: post #6

This feels like treating one particularly visible symptom of the problem instead of fixing the actual problem. What Google should do instead is prevent apps from refusing to work or disabling unrelated functionality just because some permissions are denied (e.g., if you deny your banking app permission to access your camera, everything but mobile check deposit should still have to work). They should use a two-pronged…

I wrote almost exactly this comment more than five years ago. It is a shame that it is taking them so long to get security right. Do they even use their own software?

Re: Google to ban financial lending apps from accessing user photos, contacts

#90

Post by [deleted] »

josephcsible wrote: post #6

This feels like treating one particularly visible symptom of the problem instead of fixing the actual problem. What Google should do instead is prevent apps from refusing to work or disabling unrelated functionality just because some permissions are denied (e.g., if you deny your banking app permission to access your camera, everything but mobile check deposit should still have to work). They should use a two-pronged…

[deleted]
Post reply on HN