Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I must say, I like the Mysk team, and wish them well; AI or not.
It seems a bit quixotic, but anything that goes against $_BIGCORP is tilting at windmills, anyway.
Of course, the one narrative I almost never hear, no matter who it is, is "Simply don't collect any extra data."
It's that simple. If you don't have the data, your app could be Swiss cheese, and no one can get anything dangerous.
But, in today's tech world, data is money, so every app and Web site out there, goes to any length, to hoover up as much data as possible.
I regularly get prompted to join "teams," and "leaderboards," or do "challenges," on my solitaire games.
- On a tangential point, one thing that should definitely not be possible for apps these days is determining whether you enabled a VPN. AFAIK, it’s possible indirectly in iOS by enumerating network interfaces with specific/telling names.by phmx
- Holy cow, did not know ios lets apps access so many finger printable information such as apps installed, last wipe and number of copy actions. Installed the browser as I am confident it will be good also.
Thank you!
by kamyarg - Idk, I actually got the opposite impression. Most of the info is just what I would expect everyone to see: date formats, languages, various webview kind of stuff, network info. This is already more than enough for fingerprinting
> information such as apps installed
This is what surprised me too, but if you read their hint, it’s not like list API. They probe various ‘open URL in app’ to see what apps registered them, so are installed. I guess this i) won’t allow you to track apps that don’t have ‘open in app’ urls, and ii) probably hard to limit without affecting UX
> number of copy actions
This is odd, yeah, not sure why is it exposed
> last wipe
They deduce this from the volume creation date. Probably possible to hide, but also not really that important, at least to me. Fingerprinting will work with way fewer info anyway
To summarize, I think iOS is still very solid in terms of involuntary info exposure (if you trust Apple itself). Most of really sensitive info requires separate permissions. Yes, you can harden it further, but that will be more like a paranoid mode
by ololobus - Is something similar already available for Android phones?by jiri
- Outdated, but gives the general idea: https://github.com/nandan-desai-extras/PrivacyBreacherby nobody42
- This is why I avoid installing apps and don’t have a lot of them.by api
- ...wouldn't it be better to have a pocket computer you own?by iririririr
- Why does a random app (with no special permissions given to it) get access to so much info, and why doesn't Apple tell users this (important) info? Why can't Apple make a long list of check boxes so users can dis/allow on a per-category and per-app basis?
E.g. I had no idea a random app you install (and give no permissions to) instantly has a list of every app installed on the device (e.g. can infer whether you're dating [or cheating!] from presence of tinder/bumble/hinge). That alone seems instantly monetizable by unscrupulous actors via 'is-my-partner-cheating' as a service: charge $10 to give a probable answer.
by nomilk - And how would the is-my-partner-cheating get their app onto the victims device to detect the other apps?by echoangle
- Of all things, this is where you went?by idiotsecant
- I'm in that camp of has a dating app installed but have no partner so the is-my-partner-cheating admittedly doesn't resonate with me. I've had to do some of this fingerprinting myself before for non-data-selling reasons so a lot of the system-level statistics didn't quite impress me [1], but that one was a gut-punch when I saw it pop up. It makes me wonder what apps out there have leveraged that as a signal for ads or other behavior modifications to exploit my search for a partner -- without at least having to spend a few pennies querying a data broker!
It makes sense that there's some discovery mechanism - since Google loves to use it to prefer Chrome, GMail, etc when you're in one of their apps. I wish that there were more restrictions though where you only get implicit permission to query from apps that have the same developer ID. Maybe a mutual allowlist that has to be formed, or some sort of privileged intent where you at least have to tell Apple what's going on and that gives them some contractual right to sanction you if you're using it for nefarious purposes instead.
[1] excluding the clipboard copy count, that was novel!
by dunder_cat - This is excellent. Seeing this makes me appreciate how much visual awareness tools like this are needed.
I built something similar, for the web. https://neberej.github.io/exposedbydefault/
by coffeecoders - For anyone without an iPhone or doesn't want to install the app you can see a demo here (same video different platforms):
https://odysee.com/@techlore:3/permission-not-required-the-o...
https://www.youtube.com/watch?v=_n_SpEWtqog
by Cider9986 - One correction to some comments here: an iOS app cannot list all apps that are installed. You can only check for specific apps/schemes (LSApplicationQueriesSchemes) by specifying apps you are looking to query for installation status or open. You cannot provide a large list of unrelated applications since Apple rejects that during app review.
Apple added these restrictions because installed app lists can be used for fingerprinting and privacy invasive profiling.
- It is terrifying to learn that apps are allowed knowledge about any other app being installed on my phone. Where can I see that list?by solarkraft
- > Apple added these restrictions because installed app lists can be used for fingerprinting and privacy invasive profiling.
And this was heavily exploited by Facebook before Apple patched it
by NietTim - You cannot provide a large list of unrelated applications since Apple rejects that during app review.
Thank you for the clarification!
You cannot provide a large list of unrelated applications since Apple rejects that during app review.
It does not need to be a large list though I think? You just need a small list that is very discriminative and adds enough additional entropy to uniquely identify you in combination with the other data leaked.
by microtonal - But a single app can request to know the presence of up to 50 apps, right?
And a data broker/aggregator can purchase such data from many (e.g. thousands) of apps and aggregate it, then sell it.
by nomilk - Volume creation date is pretty egregious. I don't see any reason that and Pasteboard changeCount should be so granular.
The "Installed Apps Probe" leak also surprised me. It is better than the current state of Android, though.
by RedComet - Graphene is way ahead of this
- Pasteboard counter exists to help apps to not ask again about the same item in the buffer.
And nothing stops from using reset it every day.
by xenator - Damn. The "iPhone last setup or erased on ..." is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS.by regecks
- Is the threat model tracking across multiple apps to correlate what you're doing? In that case, a single app wouldn't show you the fudging.
- Maybe I'm being really thick, but why is this information that the OS would make available to apps?by dylan604
- Seems like in general the iPhone was not designed to avoid fingerprinting from installed apps. Only protection would be avoid installing apps and use the web browser when possible.by Gigachad
- I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior
- It is opt-in on iOS for Applications. Applications have to declare upfront what sites they will communicate with.
It is called app transport security. if you don't set it up your app boots in a sandbox with no network.
Settings -> Privacy Security -> App Privacy Report
Unfortunately 1 - as a _user_ you cannot opt-in or out. I wish Apple would take the next step and let us select which sites an app is not allowed to communicate with. Or ideally even globally for all apps.
Unfortunately 2 - the list of sites the app wants to communicate with is not clearly communicated upfront like before you install.
Unfortunately 3 - the list can also contain wildcard domains
Small steps - they really need to push this to the next phase IMO.
by st3fan - >most apps don't have any need to access the internet in the first place.
It would severely depend on how you categorize "most apps" because I would say I pretty much only use apps that need the Internet, barring Calculator, Camera, and a PDF reader (only because I prefer how it zooms books vs browser. Everything else implicitly needs the Internet as that app is just a better UI to using their mobile web site, if they even offer one.
by dessimus - GrapheneOS lets you restrict the internet access of any app on install.
But yes, agreed it should be everywhere.
by hellcow