3 ms·
NewPipe is free software so I don't thing it will be able to send some covert information (even if the author is attacked /compromised). Android is designed to
by gaius_baltar 7y ago
NewPipe is free software so I don't thing it will be able to send some covert information (even if the author is attacked /compromised).
Android is designed to not allow an app to read information from another one, so it should prevent the second scenario -- except that Google has root-level access to our phones so it can spy everything anyway.
- shadowgovt 7y agoNewPipe's free-software-ness is less relevant if it's relying upon OS-supplied APIs to send network requests and nobody has Wiresharked the output of those APIs. For example, if it's fetching data from YouTube via a WebView, the HTTP requests made to the server will carry all kinds of cookie state and enable all kinds of APIs that can be used to tag a client in a cross-session fashion (though I don't personally know what WebView's state-sharing model is). Remember, the security model for web sites isn't "app"-based; it's domain-based. Hypothetically, if YouTube were setting a cookie via NewPipe's interactions onto the youtube.com domain that says "Hey this user-agent used NewPipe," then if some other piece of Android (such as the browser) were sharing the same cookie jar, it would vend that cookie back and Google could correlate it to a logged-in user. The question is whether the cookie jar gets reused.
- gaius_baltar 7y agoWell, that makes perfect sense! If Google is providing an API to easily download things through (e.g.) HTTPS, it may also intercept and poison these requests when they are directed to one of their services and get some extra information from it!