by gniting on 3/29/25, 9:26 PM with 482 comments
by captn3m0 on 3/30/25, 2:37 AM
Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass.
There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331
by turblety on 3/30/25, 5:53 AM
The only benefits I can see of "Apps", are the developer get's access to private information they really don't need.
Yeah, they get to be on the "App Store". But the "App Store" is a totally unnecessary concept introduced by Apple/Google so they could scrape a huge percentage in sales.
Web browsers have good (not perfect) sandboxing, costs no fees to "submit" and are accessible to everyone on every phone.
by aucisson_masque on 3/30/25, 4:01 PM
I found this article yesterday and posted it on reddit android, here : https://old.reddit.com/r/Android/comments/1jmwg4w/everyone_k...
0 upvote, comment filled with what is either depressed sad people or just bots.
Here it's top 2... With mostly interesting comment.
Some subreddit are more dead than other but r/android got to be one of the worst.
by nindalf on 3/30/25, 6:47 AM
This loan app is profiling people on the basis of race (Tamil, Odia) and religion (Qibla Direction Finder is used by Muslims, mandir apps by Hindus).
by graemep on 3/30/25, 10:32 AM
I have complained about this here before, but the end result was that I asked for a hardware security device and use the website instead.
by DevKoala on 3/30/25, 1:13 AM
It is for fingerprinting purposes
by zx8080 on 3/29/25, 11:53 PM
Why would browser need to enumerate the installed apps?
Why?!
by andsoitis on 3/30/25, 12:11 AM
On Android phones. iPhone doesn’t have this privacy deficiency.
by Tmpod on 3/30/25, 12:46 AM
[1]: https://lsposed.org [2]: https://github.com/M66B/XPrivacyLua / https://github.com/0bbedCode/XPL-EX [3]: https://appops.rikka.app
by cheschire on 3/29/25, 11:43 PM
Legit question. ChatGPT isn't super helpful here since it agrees with everything when I'm really looking for someone to say why this isn't really feasible in the real world.
by hnburnsy on 3/30/25, 3:38 AM
'Extreme' my a*. My bank app has this permission, as well as my camera app, contacts app, clock app, Google Home, and on and on. My bank app was moved to an old iPad because of this.
by weinzierl on 3/30/25, 8:42 AM
To someone embarrassingly unfamiliar with Indian culture, what does it mean?
by surmoi on 3/30/25, 10:27 AM
Swiggy is actually a small player in terms of permissions requested, with 'only' 47 Compare it to Weibo with 104, Wechat with 93, Facebook with 85, Snapchat with 71 (granted those apps may offer additional services that require some additional permissions, but they are definitely not worth giving them all your data...)
by turrini on 3/30/25, 12:35 PM
by einszwei on 3/29/25, 11:31 PM
by solardev on 3/30/25, 1:03 AM
I've also never heard of the majority of the apps being analyzed or tracked. Must be such a different world out there.
by photonthug on 3/30/25, 6:51 AM
Nope! Nope, nope, nope. If you're wondering how we got into this situation.. well, it's exactly stuff like this. Weird to see someone who's digging into it at all also making excuses for it.
No one ever said "I want to avoid a single extra click once every other month, so I guess I better irrevocably open my data/phone/life up completely to megacorp forever". And they certainly did not say this about tinycorp. People just absolutely suck at adversarial thinking, and good guys need to do it for them before bad guys can. Do you want organized crime blackmailing your politicians about dating apps and infidelity? Do you want to make it easy to do large scale targeting of ${vulnerable_people} the next time the cultural or political climate shifts?
Come on. Anyway shouldn't the phone OS itself handle this rather than apps launching apps?? If not.. just let people pick a payment option, and then throw an error if the option is not available.
by djrj477dhsnv on 3/30/25, 3:57 AM
by rkagerer on 3/29/25, 11:40 PM
by therealmarv on 3/30/25, 6:38 PM
If you root (I advice against doing that) and have LSPosed installed you can hide apps to be seen by every other app with Hide My Applist (HMA) [1] or HMAL (which I like more because it is more minimalistic) [2]
by Yaggo on 3/30/25, 7:18 AM
by RKFADU_UOFCCLEL on 3/30/25, 2:48 PM
by bustling-noose on 3/30/25, 4:58 AM
Big companies like Swiggy and Zepto will mine the F out of your data. Some of it is for their benefit but some of it they could sell in the future. These so called founders are really just another wolf of app street looking to pump and dump. So when they do dump, or when some VC comes with money, they don’t just sell their app they sell it as a whole package of data and analytics that some company can use to sell their product or something VC can leverage to sell their stock to someone else. It’s not that difficult.
As far as smaller apps go these apps outsource their development to people who come with ‘packages’ to develop and maintain their app. These packages are the same logic as above but it’s just that they come from some template so you might be asked for location permission or camera or microphone by some really random app that has nothing to do with it.
While the quality of iOS is degrading, some of these things are really important and simply work better on iOS.
by DeathArrow on 3/30/25, 8:06 AM
Who are those data brokers? Are they publicly known? Do they have an API where a business sends customer ID, mail or something and get an spending profile that helps adjusting price for a particular customer?
I know this sounds evil. But didn't banks and insurance companies collaborate to profile their customers since tens of years ago? That is not similarly evil?
by amelius on 3/29/25, 11:28 PM
Probably has to do with feeding adtech's hunger for personal information, or fingerprinting maybe (not sure if that's a thing in the context of phone apps).
by avsteele on 3/30/25, 12:23 AM
by BGizzle on 4/9/25, 6:48 AM
by TekMol on 3/30/25, 11:40 AM
So I downloaded a few dozen Indian apps
I could think of on top of my head and
started reading their manifest files
Does this mean one could make a website that lists all those manifest file, so the users could decide against using apps that use this loophole?
by nsonha on 3/31/25, 3:57 PM
by Tewboo on 3/30/25, 11:20 AM
by HackerThemAll on 3/30/25, 9:03 PM
by OutOfHere on 3/29/25, 11:28 PM
by bloomingeek on 3/30/25, 2:12 PM
edit: Oops, I left out texting. Which phone for that?
by nickvec on 3/30/25, 4:13 AM
by dTal on 3/29/25, 11:46 PM
by aussieguy1234 on 3/31/25, 3:26 AM
by marcodiego on 3/30/25, 12:31 AM
by anonym29 on 3/30/25, 1:00 PM
Alternatively, you can continue with the standard setup, accepting that you’re willingly providing companies with an unprecedented level of access to your personal data. It’s puzzling that many seem more concerned about breaking a familiar routine than about the risks associated with sharing every detail of their lives with companies that, in turn, share that data with one (or more) hostile government(s).
There is certainly a lot of justified concern about government overreach and abuse of power on HN. It remains difficult to understand why many with these warranted concerns do nothing to adopt a more coherent and rational approach — such as merely attempting to protect their personal data by not deliberately and voluntarily feeding it entirely to companies that are secretly coordinating with the very same hostile governments these people claim to seriously fear and detest.
by smallnix on 3/29/25, 11:22 PM
by 6510 on 3/30/25, 5:00 AM
by zer0zzz on 3/30/25, 6:00 AM
by ErigmolCt on 3/30/25, 9:53 AM
by anymouse123456 on 3/30/25, 1:55 PM
At best, it's a designer's hubris (mixed with contempt) like, "You want to select some text out of your SMS message? I've decided. NOPE."
But mostly we're treated with contempt simply because we're an annoyance that is obstructing the goal of serving the actual customer (advertiser) who is paying for the work.
App Stores are no mystery. They are a funnel for rent-seekers and adtech info brokers.
If you think they are intended to benefit you in any way at all, you are badly mistaken.
by zkiihne on 3/30/25, 6:33 PM
Apple has a much more robust solution privacy wise with their ScreenTime API but it makes an app like Limit Buddy much harder to build.
by tmtvl on 3/30/25, 9:56 AM
by whalesalad on 3/30/25, 7:22 PM
by daft_pink on 3/30/25, 5:34 AM
by DeathArrow on 3/30/25, 8:07 AM
by bpbp-mango on 3/30/25, 11:15 AM
by billfruit on 3/30/25, 2:52 AM