5 ms·
There is a special privilege level for screen readers. The issue is that the hypothetical malicious app pretends to be a screen reader.
by akerl_ 7y ago
There is a special privilege level for screen readers. The issue is that the hypothetical malicious app pretends to be a screen reader.
- zepto 7y agoDo you mean it hypothetically actually functions as a screen reader but also steals data, or something that just requests the privilege while being something completely different?
- akerl_ 7y agoEither one, but realistically the latter. In the former case, you just call your app SuperLegitScreenReader, prompt the user to grant accessibility access, and then snarf up data. Bonus points if you bundle in some open source or pirated screen reader code so your app can act the part, but you could probably just say “fetching reader data, screen reading will be functional in ~60 minutes” and count on most users to not bother uninstalling the app or revoking permissions. In the latter case, you call your app “CandyNinjaBirds”, and have it pop up and say “to let you share cute stickers to your friends, you need to enable accessibility access” and count on the vast majority of people to click “allow”. The latter case is way more common because the former case limits your target audience to people who actually want a screen reader.
- zepto 7y agoOk - but given the small number of actual screen readers it would be easy for a store to have extra policing for this privilege.