zlacker

Everyone knows all the apps on your phone

submitted by gnitin+(OP) on 2025-03-29 21:26:32 | 1195 points 480 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
◧◩
11. gruez+Ne[view] [source] [discussion] 2025-03-29 23:45:11
>>chesch+Ce
Most windows apps aren't sandboxed, so them being able to grab window titles is the least of your worries. Any program can steal your login sessions and passwords if they wanted to.

https://xkcd.com/1200/

◧◩◪
30. phony-+ri[view] [source] [discussion] 2025-03-30 00:30:12
>>ctippe+nh
> I know someone in adtech and I'm pretty sure Apple allows a similar app manifest that allows you to check for specific apps. I could be wrong.

On iOS an app developer will need to register in advance which external applications their app intends to query, and the list needs to be very short and motivated. [1]

Incidentally, “I have a friend who says...” isn’t really a good citation anywhere outside Reddit - which HN resembles more and more each day.

[1] https://www.hackingwithswift.com/example-code/system/how-to-...

42. Tmpod+0k[view] [source] 2025-03-30 00:46:54
>>gnitin+(OP)
It requires root, but you can block/spoof this with an LSPosed[1] module such as XPrivacyLua[2]. I hear there's also the closed-source AppOps[3], but I've never used it.

[1]: https://lsposed.org [2]: https://github.com/M66B/XPrivacyLua / https://github.com/0bbedCode/XPL-EX [3]: https://appops.rikka.app

◧◩◪◨
43. halfca+8k[view] [source] [discussion] 2025-03-30 00:49:14
>>facile+Ze
> I can't imagine windows intentionally keeps the plaintext password anywhere longer than it needs to be.

Can’t tell if serious or not [1]. Also any program can read any saved password out of Windows Credential Manager.

https://en.wikipedia.org/wiki/Mimikatz

◧◩◪
54. czk+Mn[view] [source] [discussion] 2025-03-30 01:21:47
>>ctippe+nh
Not sure about the manifest but recently I've seen talk about some banking apps using SBSLaunchApplicationWithIdentifierAndURLAndLaunchOptions (undocumented function in SpringBoardServices) [0] to try to launch another app on the phone by the bundle id, and they can determine if it's installed or not.

They were using this trick to detect unauthorized apps on the phone.

https://blog.verichains.io/p/technical-analysis-improper-use...

[0] - https://gist.github.com/wh1te4ever/c7909dcb5b66c13a217b49ea3...

66. captn3+ou[view] [source] 2025-03-30 02:37:34
>>gnitin+(OP)
The ACTION_MAIN loophole has been written about before: https://commonsware.com/blog/2020/04/05/android-r-package-vi...

Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass.

There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331

◧◩◪
83. js2+oz[view] [source] [discussion] 2025-03-30 03:32:13
>>neithe+Ky
Apple calls these Smart App Banners. Webkit cooperates with iOS to present them according to a meta tag in the page:

https://developer.apple.com/documentation/webkit/promoting-a...

You can get rid of them with the Unsmartifier extension.

https://old.reddit.com/r/apple/comments/q55753/unsmartifier_...

The StopTheMadness extension can also remove them (among many other things... this extension is a must have for me):

https://underpassapp.com/StopTheMadness/support-ios.html

◧◩◪◨
91. ignora+LB[view] [source] [discussion] 2025-03-30 03:57:37
>>AznHis+cz
> refusing to fix it

Google addressed similar isolation concerns (without breaking a tonne of APIs in incompatible ways) with Private Space and Work Profile: https://source.android.com/docs/security/features/private-sp...

◧◩
109. tredre+WE[view] [source] [discussion] 2025-03-30 04:41:14
>>chesch+Ce
> How hard would it be for an app to monitor all of your web traffic based on the title alone?

Although not terribly accurate (because of the high variability of page titles), tools like ManicTime and ActivityWatch use windows titles to track your browser history if you don't install the browser plugin.

https://www.manictime.com/

https://activitywatch.net/

◧◩◪
112. mgriep+TF[view] [source] [discussion] 2025-03-30 04:56:06
>>wkat42+Cx
Apple introduced account-driven enrollments in 2021[1], which behaves similar to Android's work profile. Managed apps/data are kept in its own APFS volume, and MDM servers don't have access to anything outside of it. They also disallow system-wide commands like wipe device. The only caveat is you need managed Apple IDs[2] to use this enrollment flow, and I doubt many companies have set it up.

Regardless, MDM installed app visibility is limited to those users who opt-in to an organization managing their personal device, and isn't an effective way to broadly gather what apps a given person has installed. What's described in this post would work on any user/device, and there's no way to deny/opt-out of specific permissions.

[1] https://developer.apple.com/videos/play/wwdc2021/10136/ [2] https://support.apple.com/guide/apple-business-manager/use-m...

◧◩◪
136. turble+zL[view] [source] [discussion] 2025-03-30 06:23:03
>>zer0zz+4K
Sorry, I couldn't recreate this. I just built a tiny texteditor app: https://65cd02a1-8f00-47cb-b1d1-231493de5fc2.paged.net/

Tried putting 20k lines into it. Loaded instantly, allowed me to scroll and edit flawlessly.

But I get your point. I'm on a pretty decent 2022 iPhone, and I'm sure at some stage I would run into a performance hit. But not at 20k lines.

◧◩
138. dheera+JL[view] [source] [discussion] 2025-03-30 06:25:33
>>Tmpod+0k
I've not heard of XPrivacyLua, which is by the same author of the excellent NetGuard[0], which I've been using for years.

Interestingly XPrivacyLua is not supported anymore and the pro companion app will be removed from the Play store by Google because it uses the permission QUERY_ALL_PACKAGES.[1]

[0]: https://github.com/M66B/NetGuard [1]: https://xdaforums.com/t/closed-app-xposed-6-0-xprivacylua-an...

◧◩
143. switch+EM[view] [source] [discussion] 2025-03-30 06:37:14
>>djrj47+MB
It doesn't afaik. Only indirectly through multiple profiles

I was kind of surprised

https://discuss.grapheneos.org/d/13302-query-all-packages-pe...

https://discuss.grapheneos.org/d/7800-how-to-mitigate-identi...

Later

For the wider audience: though don't take this as GrapheneOS doesn't care about privacy. I'm sure there are reasons (I didn't read all of the linked threads) and it gives you plenty of other protections and tools - eg profiles, ability to disable all network access by app etc

◧◩◪
154. psycho+XN[view] [source] [discussion] 2025-03-30 06:54:43
>>baxtr+WM
Do you mean something like https://commons.m.wikimedia.org/wiki/Commons:VideoCutTool ?
◧◩
172. nxjx+GP[view] [source] [discussion] 2025-03-30 07:19:07
>>turble+KJ
https://en.m.wikipedia.org/wiki/Platform_economy

Becoming the middle man is the default model that supports scale. No one has come up with anything else to support a world where avg disposable income is close to 0

◧◩
188. xxprog+tR[view] [source] [discussion] 2025-03-30 07:35:24
>>turble+KJ
Simple, UX.

The reality is, most webapps for mobile just suck. The UX is nowhere near that of a native application. I don't want any text to be selectable. I don't want pull to refresh on every page. I don't want the left-swipe to take me to the previous page.

You can probably find workarounds for all these issues. The new Silk library (https://silkhq.co/) is the first case I've seen that get's very close to a native experience. But even the fact that this is a paid library comes to show how non-trivial this is.

◧◩◪
193. hk__2+ES[view] [source] [discussion] 2025-03-30 07:52:13
>>ezequi+JP
OP talks about apps in general, of course there will always be anecdotic cases like this one (see also https://xkcd.com/1172/).
◧◩
216. knlam+yV[view] [source] [discussion] 2025-03-30 08:28:29
>>andsoi+Qg
Actually you can via private API, which Apple app use all the time but forbid other app to use

https://blog.verichains.io/p/technical-analysis-improper-use...

◧◩◪◨
242. robin_+p01[view] [source] [discussion] 2025-03-30 09:26:20
>>phony-+ri
Could you take a moment of your time to read the last point in the HN Commenting Guidelines? https://news.ycombinator.com/newsguidelines.html
◧◩
261. dustin+D31[view] [source] [discussion] 2025-03-30 10:11:09
>>turble+KJ
Zuck: Betting on HTML5 was a mistake (2012) https://www.infoq.com/news/2012/09/Facebook-HTML5-Native/

https://www.sencha.com/, the vendor of the ExtJS framework tried to argue that Facebook was wrong (2012): https://www.infoq.com/news/2012/12/Fastbook/

I worked for a company that used Sencha back in the day and wrote the first React integration over their form/datagrid components in 2013. React ate their lunch

266. surmoi+B41[view] [source] 2025-03-30 10:27:40
>>gnitin+(OP)
Exodus Privacy will let you know about this kind of Android apps you should avoid installing https://exodus-privacy.eu.org/

Swiggy is actually a small player in terms of permissions requested, with 'only' 47 Compare it to Weibo with 104, Wechat with 93, Facebook with 85, Snapchat with 71 (granted those apps may offer additional services that require some additional permissions, but they are definitely not worth giving them all your data...)

◧◩◪◨
283. Eavolu+C91[view] [source] [discussion] 2025-03-30 11:30:31
>>facile+Ze
Actually windows can keep them in memory for a lot longer than you'd think, hence Mimikatz https://github.com/ParrotSec/mimikatz
◧◩◪◨⬒⬓
291. __jona+Rc1[view] [source] [discussion] 2025-03-30 12:13:10
>>_heimd+wM
This is likely in reference to a recent deal the US (Trump) has made with El Salvador, allowing them to ship US citizens off to prisons in El Salvador, whether this is actually possible is not clear at this point though [1].

Here is some more information about the conditions in these prisons in El Salvador, CECOT being the most notable one:

> Able to hold 40,000 inmates, the CECOT is made up of eight sprawling pavilions. Its cells hold 65 to 70 prisoners each. They do not receive visits. There are no programs preparing them to return to society after their sentences, no workshops or educational programs. They are never allowed outside. [2]

I believe the term gulag makes sense in that context despite it not being a forced labor camp. Not sure how this relates to Russia at all (apart from the origin of the term obviously).

[1] https://apnews.com/article/rubio-trump-deportations-usaid-f7...

[2] https://apnews.com/article/el-salvador-us-rubio-prison-de912...

◧◩◪
296. fph+Bf1[view] [source] [discussion] 2025-03-30 12:38:00
>>switch+EM
A rationale from the core developer [1]:

> I'm sure there are plenty of system APIs providing this information too, and I don't just mean APIs designed to directly provide the information.

> It's not useful to prevent directly getting a list of installed applications without preventing detecting which applications are installed, so this specific feature request has to be rejected. It would have to be part of a larger, much more comprehensive feature preventing apps from finding other apps. That implies outright preventing communication with non-system components which is a much different approach to applications and rules out a lot of things. [...]

> The request should be for preventing apps from discovering which apps are installed, since anything less than that has no privacy / security value. There's no point in disallowing access to a list while not preventing discovering which apps are installed anyway.

The open issue to restrict app visibility is [2].

[1] https://github.com/GrapheneOS/os-issue-tracker/ issues/149#issuecomment-553590002 [2] https://github.com/GrapheneOS/os-issue-tracker/issues/2197

◧◩◪◨⬒
303. schnat+Yi1[view] [source] [discussion] 2025-03-30 13:11:12
>>pava0+1X
I found this description about the security risks of rooting very eye-opening https://madaidans-insecurities.github.io/android.html It also explains the sandbox.
◧◩◪◨⬒⬓
326. ignora+sr1[view] [source] [discussion] 2025-03-30 14:18:46
>>schnat+Yi1
A more recent (2023) sandboxing + isolation overview by the Android team: https://arxiv.org/html/1904.05572v3/ (section 4.3)
◧◩◪
341. rollca+Cz1[view] [source] [discussion] 2025-03-30 15:27:52
>>3abito+RC
> If there is one leap that the infosec community consistently fails to make, it is this: people who are not like me, who have different needs and priorities, who have less time or are less technical, STILL DESERVE PRIVACY AND SECURITY.

https://hachyderm.io/@evacide/114184706291051769

350. auciss+BD1[view] [source] 2025-03-30 16:01:23
>>gnitin+(OP)
That's why I like hacker news.

I found this article yesterday and posted it on reddit android, here : https://old.reddit.com/r/Android/comments/1jmwg4w/everyone_k...

0 upvote, comment filled with what is either depressed sad people or just bots.

Here it's top 2... With mostly interesting comment.

Some subreddit are more dead than other but r/android got to be one of the worst.

◧◩◪◨
353. layer8+xE1[view] [source] [discussion] 2025-03-30 16:11:18
>>oarsin+IR
It’s not really possible in practice, see >>43522667 .
◧◩◪
365. gopkar+EN1[view] [source] [discussion] 2025-03-30 17:18:44
>>thatlo+3N1
^ This.

You can read the reports at https://blume.vc/reports/indus-valley-annual-report-2025 or archives at https://www.indusvalleyreport.com/ .

The ppt in the blog is from the 2024 report - https://docsend.com/view/zqgfupfzyud499hn. The India 1-2-3 framework is old though. IIRC it was coined by a retail sector founder (Kishore Biyani) in the 2000s.

Also Koramangala, HSR layout are also the more affluent localities in Bengaluru.

◧◩◪◨
371. Charle+JP1[view] [source] [discussion] 2025-03-30 17:34:38
>>hk__2+VS
> It is so annoying that it’s either "give access to ALL my contacts and ALL their information… […] I wish we could limit the number of contacts and the level of information we give.

iOS added fine-grained (at the contact level) access to contacts data last year.

https://lifehacker.com/tech/you-can-control-which-contacts-a...

389. zkiihn+8X1[view] [source] 2025-03-30 18:33:05
>>gnitin+(OP)
I used QUERY_ALL_PACKAGES among other things for my app Limit Buddy (https://www.limitbuddy.com). It would be impossible to make the app without it. But for more normal use cases there's no reason to have it.

Apple has a much more robust solution privacy wise with their ScreenTime API but it makes an app like Limit Buddy much harder to build.

391. therea+JX1[view] [source] 2025-03-30 18:38:19
>>gnitin+(OP)
It's a known fact in the rooting community because some banking apps searching for root only apps!

If you root (I advice against doing that) and have LSPosed installed you can hide apps to be seen by every other app with Hide My Applist (HMA) [1] or HMAL (which I like more because it is more minimalistic) [2]

[1] https://github.com/Dr-TSNG/Hide-My-Applist

[2] https://github.com/pumPCin/HMAL

◧◩
413. subscr+qi2[view] [source] [discussion] 2025-03-30 21:11:35
>>djrj47+MB
Not yet but it's on the road map. https://github.com/GrapheneOS/os-issue-tracker/issues/2197
◧◩◪◨⬒⬓
421. wkat42+mK2[view] [source] [discussion] 2025-03-31 00:47:45
>>billfr+Ck1
You probably mean this one: https://github.com/jgrafton/freebsd-obsidian

That's just a user contributed thing though. It's also just in the official ports collection. There's only a makefile there and some config files for electron (electron is kinda a PITA to compile on FreeBSD because there's no package)

Now, it can update itself automatically but it's all JavaScript. No binaries.

But it's safe enough for me anyway. Especially because the dev community uses it do much. If it did something untoward it would be noticed quickly.

◧◩◪
428. lazyco+Yb3[view] [source] [discussion] 2025-03-31 04:42:22
>>xxprog+tR
The "pull to refresh" is probably the most annoying one.

Other than that, I'd like text to be selectable! I don't like it when apps don't allow you to copy text.

I use Copy [1], and when that doesn't work I use the OCR text selection feature on my Pixel phone.

[1] https://play.google.com/store/apps/details?id=com.weberdo.ap...

◧◩◪◨⬒⬓⬔
435. pasc18+MC3[view] [source] [discussion] 2025-03-31 09:07:29
>>IshKeb+IN1
Unfortunately that seems to depend on who did the test or your GP.

There seem to be sites for your GP (which mine does via a .nhs.uk domain it used to be via https://account.patientaccess.com/ which still shows appointments but does not allow booking but still allows requests for repeat prescriptions.) or hospital portal for results.

◧◩◪◨⬒⬓
455. schnat+995[view] [source] [discussion] 2025-03-31 19:14:58
>>schnat+Yi1
As someone who cherishes the power of root privs, I'd still like to make a point for alternative solutions that came up like distros such as GrapheneOS or CalyxOS or non-root filtering options via VPN. If it weren't for backups I could manage my everyday life without root. For all other cases I would root and later unroot my phone via an OTA update :D https://github.com/schnatterer/rooted-graphene/

Hopefully GrapheneOS deliver on their promise to provide a better backup solutions than seedvault.

◧◩◪◨⬒⬓
456. schnat+F95[view] [source] [discussion] 2025-03-31 19:18:07
>>schnat+Yi1
I'd like to add one more finding about the perils of root access: https://github.com/chenxiaolong/my-avbroot-setup/blob/c52e44...

> The term [rooting] generally also includes the functionality for making runtime code patches (eg. with Zygisk) and making runtime filesystem modifications (eg. Magisk modules).

> Out of the many root-enabled apps I've studied or reverse engineered, the vast majority fail to handle arbitrary inputs properly (especially filenames). For example, some root-supporting file managers turn a seemingly benign action like listing a directory into local privilege escalation. This is trivially exploitable, especially with browsers auto-downloading files with server-provided filenames to /sdcard/Download/.

To avoid repeated root access UI prompts, some apps spawn a long-running shell session, write commands to stdin, and rely on parsing stdout and searching for the shell prompt to determine when commands complete. This approach is prone to desync, which can lead to commands being skipped or other inputs being interpreted as commands.

All in all, I simply do not trust most root-enabled apps to not leave a gaping security hole, so I avoid them entirely. There are apps that do handle root access in what I would consider a more proper way, by spawning a daemon as root and then talking to the daemon over a well defined binary protocol. Unfortunately, this approach is the extreme minority.

[go to top]