from Hacker News

Google Photos circumvents iOS 14 photos privacy features

by cjv on 3/16/21, 3:38 AM with 27 comments

• by ggm on 3/16/21, 4:20 AM

  I am going to put a different spin on this: If you use a service like google photos, wouldn't you want to uplift all your photos, albums and metadata into the service?

  Viewed from the "be maximally useful" perspective, it makes sense. I have 150,000 photos (maybe) -I don't want to approve each one. Even at the album granularity, I have thousands of albums. We all do.

  Yes, its a giant, egregious privacy breach. That is pretty much definitional for a cloud based Photo archive/album service.

• by megraf on 3/16/21, 4:47 AM

  I don't agree with the title at all. Detecting the auth level of access to photos is documented (PHAuthorizationStatus).

  Google photos is simply refusing to let you use their app all unless you grant them access to view all of your photos.

  I'm all for privacy -far beyond the average person- but this seems like one of those cases of uninstall it and move on if you don't agree with the product decision.

  Fwiw: Not a fan of google. Currently on iCloud + Flickr for non-sensitive photos

• by alkonaut on 3/16/21, 11:47 AM

  I find this problem more puzzling: when an app (e.g messenger) only has access to certain photos on my device, why can’t the image selector when I want to attach an image still browse all of them?

  Isn’t the image selector an OS component that shows me all my photos without the app seeing them (that is, the app isn’t rendering them)?

  If this isn’t the case - why isn’t it? Is there no iOS system level image picker that runs isolated from the app? Or is there, but apps aren’t using it?

• by cmelbye on 3/16/21, 5:00 AM

  Google Photos is not circumventing anything. It’s using a public API that was provided to developers in order to detect and react to limited permissions.

  If I paid for Google Photos and they won’t let me access my stored data without handing over even more data, then that feels outrageous.

  But if I’m using it for free, then it’s a reminder that nothing is actually free. That business model likely can’t work as a “view only” retrieval service. (If it even works at all)

• by sircastor on 3/16/21, 4:01 AM

  This is pretty egregious, but not surprising. Google wants that data and is willing to do whatever it takes to get it. I’ma little surprised though as other Google apps (hangouts) behaves and asks for access to additional photos every time I try and send a picture.

• by thitcanh on 3/16/21, 4:55 AM

  Apple should really stop allowing abuse of their APIs, from custom photo pickers that nobody needs (remember, if your app uses the default photo picker, it doesn't need any permission at all) to any app that decides to include a general-purpose cookie-less web view instead of just opening links in Safari.

• by MikeUt on 3/16/21, 5:32 AM

  > needs full access to your photos

  This is a lie. The app could be made to function with access to only a subset of photos, so "wants full access" would be the accurate phrasing. Lying to users to gain more access is what malware does.

• by alkonaut on 3/16/21, 11:44 AM

  Completely understandable for this case. I have no problem with it.

  I find the opposite problem more puzzling: when an app (e.g messenger) only has access to certain photos, why can’t the image selector still browse all of them? Isn’t the image selector an OS component that shows me all my photos without the app seeing them (that is, the app isn’t rendering them)?

  If this isn’t the case - why isn’t it? Is there no iOS system level image picker that runs isolated from the app? Or is there, but apps aren’t using it?

• by DoomHotel on 3/16/21, 10:40 AM

  An app that installs without the permissions it really wants and then refuses to function AT ALL until granted those additional permissions has got to be some kind of violation. It's basically lying about the permissions it needs to function in order to make it into the appstore.