6 ms·

Native phone apps give me the creeps. I assume the developer's are able to track me in various ways even without my giving permissions. Is that an unfounded fea

by xiaomai 10mo ago

Native phone apps give me the creeps. I assume the developer's are able to track me in various ways even without my giving permissions. Is that an unfounded fear on my part? Can an app uniquely identify me if I don't give it control over my phone number / nearby devices? Can apps geo-locate me if the location permission has not been granted? (seems like they could just make a network request to their servers and use the IP address of the request for a rough idea). I _really_ wish using the network was a permission (even if it was an "advanced mode" thing).

beAbU 10mo ago
Are you not exposed to all these things via a webpage as well?
noman-land 10mo ago
Simply your IP address can be used to track you so any app or website you visit knows roughly where you are with every http request unless you use an always on VPN. It can also fingerprint you in various ways without the need for any special permissions.
- bji9jhff 10mo ago
  Then the VPN provider does geolocation instead and get the list of hosts you accessed
  - noman-land 10mo ago
    At the very least the VPN provider promises not to and their reputation depends on their not being caught doing this. Whereas your ISP and various sites you visit will already be collecting this data no matter what.
- xiaomai 10mo ago
  Agree with you about fingerprinting (also a bummer). I guess the difference here though is that I must be actively engaging with a website in order for it to be tracking me, but an app (I assume) can be tracking me basically whenever it wants.
  - raw_anon_1111 10mo ago
    An app on iOS doesn’t just run constantly in the background unless it’s playing sound or using the GPS. For almost everything else you can explicitly turn off “allow background refresh” on a per app basis
encom 10mo ago
>Is that an unfounded fear on my part? Given the security record of app stores, probably not.
disambiguation 10mo ago
Netguard solves this, available on the play store and F droid https://netguard.me/ https://netguard.me/
- Flere-Imsaho 10mo ago
  Pro tip: use the fdroid version as it allows you to set a host file to also filter ads, etc. https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md
- lsaferite 10mo ago
  I love netguard. Some apps refuse to work without network access, but most work fine. The lack of ads is great.
- n4bz0r 10mo ago
  How does it work without root? Any app can just block other apps from connecting to the internet?
  - jeroenhd 10mo ago
    An app can use the VPN API to intercept network traffic. This is all done with plenty of security popups (one to inform you an app is trying to register as a VPN, the another popup when it's first activated, and the while it's active there's a permanent notification that says "your connection may be monitored" with a quick button to kill the VPN). The API is supposed to let apps do things like "route intranet/corporate app traffic over a VPN, let other traffic go through", but you can just as easily use it to drop traffic destined for certain addresses (such as ad servers), or to drop all traffic for specific apps. It's also possible to make decisions like "let this app connect to the internet on wifi but not on data". It should be noted that system applications (phone OS, Google, sometimes carrier apps) can bind to specific network interfaces bypassing this API entirely. This means you can't use this API to 100% block internet access to preinstalled apps, even though apps will need to explicitly implement networking code to bypass such firewalls. It should be noted that Google doesn't really like apps abusing the VPN API like this, in past because of the massive privacy risk. Google cut a bunch of these apps from Google Play, though there's not much they can do about APKs you download from F-Droid or github.
throw4039 10mo ago
Network is a permission on Android, it's just that phone manufacturers and likely Google don't want you to be able to control it. Most custom ROMs, including GrapheneOS expose it properly, often at the install dialog.
- TrianguloY 10mo ago
  On play store you can see the permissions that an app uses and they are grouped by category. Have full network access is set in the "others" category, same as notifications and vibration. This is a category where (supposedly) permissions are automatically granted. But to be honest, other similar dangerous permissions like "view network connections" and "receive data from internet" are also there, categories are for "camera", "microphone" etc. I suppose that the average user is more concerned about specific features, and since basically almost all apps require internet it may be there to avoid noise. Still, an "internet" category would have been nice...
  - tavavex 10mo ago
    The reason why internet access/downloading from the internet isn't a "major" permission is that asking about it would let people conveniently disable it for any offline apps with ads in them to remove the ads. Google doesn't like that, obviously. Of course, you can still disable your wifi/mobile data connection entirely, but it has friction that most average consumers won't trouble themselves with. But if the app asked if you wanted to give it internet access on launch, Google's ad revenue would probably be visibly affected.
- lsaferite 10mo ago
  They really should just let me spoof all the permissions and associated data for apps if I don't want them to have the access.
  - Zak 10mo ago
    Some time ago, I used a module for Xposed on Android called XPrivacy which did exactly that. Yes, creepy app, you can have my location. It's Antarctica. It does look like Xposed has successors, but my current approach is to just be selective about installing apps.
frizlab 10mo ago
They can track you on a website perhaps even more reliably than on an app, at least on iOS…
- galleywest200 10mo ago
  The difference is I am not carrying around my desktop computer, the location data stays static.
raw_anon_1111 10mo ago
You realize that if you are concerned about apps tracking you without you explicitly giving it your location, a website could do the same since there are browser APIs that can retrieve the same information only gated by the same OS controls? When you go to a website, they have always known the originating IP address.
- doctor_radium 10mo ago
  Better (?) browsers also have an internal switch to disable location.
  - raw_anon_1111 10mo ago
    Controlled by the same company that wrote the OS in case of Chrome on Android and Safari on iOS. If you don’t trust the operating system to do the right thing on the OS level why do you trust the same company to do the right thing in the browser?
- rejhgadellaa 10mo ago
  Not entirely true. Browsers are paranoid by default (because visiting a website is as easy as clicking a link). Operating systems aren't (because the user explicitly installed an app, it's been "vetted" by app store experts, and because... well, the OS vendor wants you to build native apps and not a website, so they have to make it worth the extra trouble of building a separate app for each platform instead of one website that works everywhere). Also, browsers tend to bring their own sandbox (on top of what the OS already does). For example, Chromium was able to mitigate Meltdown/Spectre before OS vendors shipped an update (except on iOS where browsers can't bring their own engines, so iPhone users had to wait for Apple to ship an OS update...)
  - raw_anon_1111 10mo ago
    Again why would you think Apple the browser maker would be any more or less careful about Safari not allowing websites to access your camera, GPS, photos than Apple the operating system maker? No one thinks that app review is what stops malicious apps from circumventing permissions. It’s the operating system itself. And you really don’t want to compare the state of iOS updates to the state of Android updates do you?
snthd 10mo ago
Facebook & Yandex used apps to correlate browsing sessions to the app user. https://localmess.github.io/ https://localmess.github.io/
jampa 10mo ago
In the beginning of Android / iOS, just installing an app and registering was enough for the company to get your device's MAC address and thus your indoor location with accurate precision. They could access your Wi-Fi network's BSSID (whose location is often public due to wardriving databases), and in public places, they had partner companies (malls, airports, etc.) whose routers would triangulate your position based on Wi-Fi signal strength and share information like "John is in the food court near McDonald's." All of this happened without you even needing to connect to their Wi-Fi, because your phone used to broadcast its MAC address if the Wi-Fi was simply on. But now your MAC is now randomized, but it took a lot of time for Google / Apple to this.
- fluoridation 10mo ago
  What do you mean? The MAC address is used to identify the device within the same network segment. A program running on the device cannot derive location information just from the MAC address. It's a meaningless number. What the MAC address can do is make you visible to other devices in the same network segment. So for example, a wireless router can know you're nearby because your known MAC address has joined the network, but this is a problem regardless of what apps your phone is running.
  - sampullman 10mo ago
    That's what the GP was saying, I think. Once they get the MAC address, they can find you. Not via software on the phone, from exfiltrating and using shady third parties that collect data from access points, etc.
    - fluoridation 10mo ago
      Okay, but if there's collusion between the app developers and external routers then it doesn't matter if the MAC is randomized. The app can still see the current MAC address and report it, and you can still be located, if nothing else, to within the range of a wireless router. Nothing is solved by randomizing the MAC address.
  - 10mo ago
Flere-Imsaho 10mo ago
Android 15 supports Private Space [0] that is essentially a separate profile you can install apps into that you can put to sleep. Basically I put all low trust apps into it, but can still access easily enough. [0] https://support.google.com/android/answer/15341885?hl=en https://support.google.com/android/answer/15341885?hl=en
- bashkiddie 10mo ago
  The web page says Private Spaces can hide an app from the user. What I want to do is hide my address book and gallery from the app.
  - sadeshmukh 10mo ago
    To the best of my knowledge it acts as an isolated profile entirely.
    - Flere-Imsaho 10mo ago
      Precisely, it creates a whole new Google account.
ChrisMarshallNY 10mo ago
iOS always asks for permissions. I suspect the same is true for unrooted Android. But the general pattern is that you install some stupid vendor crapplet, and the first thing it does, is ask for every permission on your phone. Native apps can access a lot more stuff than ones restricted to a WebView sandbox. That's why they want you to use them. No thankee.
- raw_anon_1111 10mo ago
  Exactly what do you think an app can get off of your device that a website can’t without your permission?
  - ChrisMarshallNY 10mo ago
    I write native apps. They can "fingerprint" devices more easily. They have access to all kinds of subsystems, like Bluetooth, NFC, gestures (at low level), etc. Many require the user to give permission, but the first thing the app does, is ask for permission. As long as the statement in the request passes Apple muster, the app won't fail review, I seriously doubt that Apple will test after the app has shipped, to make sure that they stick to their word. Some of this can be caught by the App Review process, if they do things like access private APIs, but we keep reading about clever app developers (and there are a lot of really smart crooks out there) that can fool the App Review testers. I read about a dodgy app that detected when it was in review, and modified its behavior (ala Volkswagen). Really, I am not sure if there's a way to ensure the app works the same after review, than during. I would probably put a 4-day timer on it, starting the day of submission. After the timer expires, the app starts accessing private APIs via a hand-coded assembly interface. I would hope that Apple has already thought about this (It wouldn't be too difficult to test -just run it on a device with an advanced clock).
    - raw_anon_1111 10mo ago
      > They can "fingerprint" devices more easily. They have access to all kinds of subsystems, like Bluetooth, NFC, gestures (at low level), etc. Many require the user to give permission, but the first thing the app does, is ask for permission Bluetooth https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetooth_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetoo... Accelerometer https://developer.mozilla.org/en-US/docs/Web/API/Accelerometer https://developer.mozilla.org/en-US/docs/Web/API/Acceleromet... So it’s a great conspiracy that apps have permission to do things after you explicitly give it permission? No one is claiming that the app review process helps protect your privacy. The challenge is find something a native app can do surreptitiously to track you more than a website without you giving it permission bypassing OS safeguards. And on iOS an app can’t access your NFC chip without you giving it permission.
deleted 10mo ago
[deleted]
ivanjermakov 10mo ago
> Can an app uniquely identify me Even browsers can identify* you, if they really want to. *not as cleanly though, could be tricky for fingerprinting to track one user across different devices/browsers/netowrks. Recent discussion on fingerprinting: https://news.ycombinator.com/item?id=46016249 https://news.ycombinator.com/item?id=46016249
m463 10mo ago
> Is that an unfounded fear on my part? no. especially with the value of data. Many apps just link into some advertising sdk that does anything it can get away with. and it is unfortunate that people are shamed for being conservative (want a tinfoil hat?)

by xiaomai 10mo ago

beAbU 10mo ago

Are you not exposed to all these things via a webpage as well?

noman-land 10mo ago

Simply your IP address can be used to track you so any app or website you visit knows roughly where you are with every http request unless you use an always on VPN. It can also fingerprint you in various ways without the need for any special permissions.

bji9jhff 10mo ago
Then the VPN provider does geolocation instead and get the list of hosts you accessed
- noman-land 10mo ago
  At the very least the VPN provider promises not to and their reputation depends on their not being caught doing this. Whereas your ISP and various sites you visit will already be collecting this data no matter what.
xiaomai 10mo ago
Agree with you about fingerprinting (also a bummer). I guess the difference here though is that I must be actively engaging with a website in order for it to be tracking me, but an app (I assume) can be tracking me basically whenever it wants.
- raw_anon_1111 10mo ago
  An app on iOS doesn’t just run constantly in the background unless it’s playing sound or using the GPS. For almost everything else you can explicitly turn off “allow background refresh” on a per app basis

encom 10mo ago

>Is that an unfounded fear on my part? Given the security record of app stores, probably not.

disambiguation 10mo ago

Netguard solves this, available on the play store and F droid https://netguard.me/ https://netguard.me/

Flere-Imsaho 10mo ago
Pro tip: use the fdroid version as it allows you to set a host file to also filter ads, etc. https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md
lsaferite 10mo ago
I love netguard. Some apps refuse to work without network access, but most work fine. The lack of ads is great.
n4bz0r 10mo ago
How does it work without root? Any app can just block other apps from connecting to the internet?
- jeroenhd 10mo ago
  An app can use the VPN API to intercept network traffic. This is all done with plenty of security popups (one to inform you an app is trying to register as a VPN, the another popup when it's first activated, and the while it's active there's a permanent notification that says "your connection may be monitored" with a quick button to kill the VPN). The API is supposed to let apps do things like "route intranet/corporate app traffic over a VPN, let other traffic go through", but you can just as easily use it to drop traffic destined for certain addresses (such as ad servers), or to drop all traffic for specific apps. It's also possible to make decisions like "let this app connect to the internet on wifi but not on data". It should be noted that system applications (phone OS, Google, sometimes carrier apps) can bind to specific network interfaces bypassing this API entirely. This means you can't use this API to 100% block internet access to preinstalled apps, even though apps will need to explicitly implement networking code to bypass such firewalls. It should be noted that Google doesn't really like apps abusing the VPN API like this, in past because of the massive privacy risk. Google cut a bunch of these apps from Google Play, though there's not much they can do about APKs you download from F-Droid or github.

throw4039 10mo ago

Network is a permission on Android, it's just that phone manufacturers and likely Google don't want you to be able to control it. Most custom ROMs, including GrapheneOS expose it properly, often at the install dialog.

TrianguloY 10mo ago
On play store you can see the permissions that an app uses and they are grouped by category. Have full network access is set in the "others" category, same as notifications and vibration. This is a category where (supposedly) permissions are automatically granted. But to be honest, other similar dangerous permissions like "view network connections" and "receive data from internet" are also there, categories are for "camera", "microphone" etc. I suppose that the average user is more concerned about specific features, and since basically almost all apps require internet it may be there to avoid noise. Still, an "internet" category would have been nice...
- tavavex 10mo ago
  The reason why internet access/downloading from the internet isn't a "major" permission is that asking about it would let people conveniently disable it for any offline apps with ads in them to remove the ads. Google doesn't like that, obviously. Of course, you can still disable your wifi/mobile data connection entirely, but it has friction that most average consumers won't trouble themselves with. But if the app asked if you wanted to give it internet access on launch, Google's ad revenue would probably be visibly affected.
lsaferite 10mo ago
They really should just let me spoof all the permissions and associated data for apps if I don't want them to have the access.
- Zak 10mo ago
  Some time ago, I used a module for Xposed on Android called XPrivacy which did exactly that. Yes, creepy app, you can have my location. It's Antarctica. It does look like Xposed has successors, but my current approach is to just be selective about installing apps.

frizlab 10mo ago

They can track you on a website perhaps even more reliably than on an app, at least on iOS…

galleywest200 10mo ago
The difference is I am not carrying around my desktop computer, the location data stays static.

raw_anon_1111 10mo ago

You realize that if you are concerned about apps tracking you without you explicitly giving it your location, a website could do the same since there are browser APIs that can retrieve the same information only gated by the same OS controls? When you go to a website, they have always known the originating IP address.

doctor_radium 10mo ago
Better (?) browsers also have an internal switch to disable location.
- raw_anon_1111 10mo ago
  Controlled by the same company that wrote the OS in case of Chrome on Android and Safari on iOS. If you don’t trust the operating system to do the right thing on the OS level why do you trust the same company to do the right thing in the browser?
rejhgadellaa 10mo ago
Not entirely true. Browsers are paranoid by default (because visiting a website is as easy as clicking a link). Operating systems aren't (because the user explicitly installed an app, it's been "vetted" by app store experts, and because... well, the OS vendor wants you to build native apps and not a website, so they have to make it worth the extra trouble of building a separate app for each platform instead of one website that works everywhere). Also, browsers tend to bring their own sandbox (on top of what the OS already does). For example, Chromium was able to mitigate Meltdown/Spectre before OS vendors shipped an update (except on iOS where browsers can't bring their own engines, so iPhone users had to wait for Apple to ship an OS update...)
- raw_anon_1111 10mo ago
  Again why would you think Apple the browser maker would be any more or less careful about Safari not allowing websites to access your camera, GPS, photos than Apple the operating system maker? No one thinks that app review is what stops malicious apps from circumventing permissions. It’s the operating system itself. And you really don’t want to compare the state of iOS updates to the state of Android updates do you?

snthd 10mo ago

Facebook & Yandex used apps to correlate browsing sessions to the app user. https://localmess.github.io/ https://localmess.github.io/

jampa 10mo ago

In the beginning of Android / iOS, just installing an app and registering was enough for the company to get your device's MAC address and thus your indoor location with accurate precision. They could access your Wi-Fi network's BSSID (whose location is often public due to wardriving databases), and in public places, they had partner companies (malls, airports, etc.) whose routers would triangulate your position based on Wi-Fi signal strength and share information like "John is in the food court near McDonald's." All of this happened without you even needing to connect to their Wi-Fi, because your phone used to broadcast its MAC address if the Wi-Fi was simply on. But now your MAC is now randomized, but it took a lot of time for Google / Apple to this.

fluoridation 10mo ago
What do you mean? The MAC address is used to identify the device within the same network segment. A program running on the device cannot derive location information just from the MAC address. It's a meaningless number. What the MAC address can do is make you visible to other devices in the same network segment. So for example, a wireless router can know you're nearby because your known MAC address has joined the network, but this is a problem regardless of what apps your phone is running.
- sampullman 10mo ago
  That's what the GP was saying, I think. Once they get the MAC address, they can find you. Not via software on the phone, from exfiltrating and using shady third parties that collect data from access points, etc.
  - fluoridation 10mo ago
    Okay, but if there's collusion between the app developers and external routers then it doesn't matter if the MAC is randomized. The app can still see the current MAC address and report it, and you can still be located, if nothing else, to within the range of a wireless router. Nothing is solved by randomizing the MAC address.
- 10mo ago

Flere-Imsaho 10mo ago

Android 15 supports Private Space [0] that is essentially a separate profile you can install apps into that you can put to sleep. Basically I put all low trust apps into it, but can still access easily enough. [0] https://support.google.com/android/answer/15341885?hl=en https://support.google.com/android/answer/15341885?hl=en

bashkiddie 10mo ago
The web page says Private Spaces can hide an app from the user. What I want to do is hide my address book and gallery from the app.
- sadeshmukh 10mo ago
  To the best of my knowledge it acts as an isolated profile entirely.
  - Flere-Imsaho 10mo ago
    Precisely, it creates a whole new Google account.

ChrisMarshallNY 10mo ago

iOS always asks for permissions. I suspect the same is true for unrooted Android. But the general pattern is that you install some stupid vendor crapplet, and the first thing it does, is ask for every permission on your phone. Native apps can access a lot more stuff than ones restricted to a WebView sandbox. That's why they want you to use them. No thankee.

raw_anon_1111 10mo ago
Exactly what do you think an app can get off of your device that a website can’t without your permission?
- ChrisMarshallNY 10mo ago
  I write native apps. They can "fingerprint" devices more easily. They have access to all kinds of subsystems, like Bluetooth, NFC, gestures (at low level), etc. Many require the user to give permission, but the first thing the app does, is ask for permission. As long as the statement in the request passes Apple muster, the app won't fail review, I seriously doubt that Apple will test after the app has shipped, to make sure that they stick to their word. Some of this can be caught by the App Review process, if they do things like access private APIs, but we keep reading about clever app developers (and there are a lot of really smart crooks out there) that can fool the App Review testers. I read about a dodgy app that detected when it was in review, and modified its behavior (ala Volkswagen). Really, I am not sure if there's a way to ensure the app works the same after review, than during. I would probably put a 4-day timer on it, starting the day of submission. After the timer expires, the app starts accessing private APIs via a hand-coded assembly interface. I would hope that Apple has already thought about this (It wouldn't be too difficult to test -just run it on a device with an advanced clock).
  - raw_anon_1111 10mo ago
    > They can "fingerprint" devices more easily. They have access to all kinds of subsystems, like Bluetooth, NFC, gestures (at low level), etc. Many require the user to give permission, but the first thing the app does, is ask for permission Bluetooth https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetooth_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetoo... Accelerometer https://developer.mozilla.org/en-US/docs/Web/API/Accelerometer https://developer.mozilla.org/en-US/docs/Web/API/Acceleromet... So it’s a great conspiracy that apps have permission to do things after you explicitly give it permission? No one is claiming that the app review process helps protect your privacy. The challenge is find something a native app can do surreptitiously to track you more than a website without you giving it permission bypassing OS safeguards. And on iOS an app can’t access your NFC chip without you giving it permission.

deleted 10mo ago

[deleted]

ivanjermakov 10mo ago

> Can an app uniquely identify me Even browsers can identify* you, if they really want to. *not as cleanly though, could be tricky for fingerprinting to track one user across different devices/browsers/netowrks. Recent discussion on fingerprinting: https://news.ycombinator.com/item?id=46016249 https://news.ycombinator.com/item?id=46016249

m463 10mo ago

> Is that an unfounded fear on my part? no. especially with the value of data. Many apps just link into some advertising sdk that does anything it can get away with. and it is unfortunate that people are shamed for being conservative (want a tinfoil hat?)