5 ms·

> I'm generally skeptical of Apple's pro-privacy messaging That's a very healthy attitude towards Apple's claims. They developed all these APIs that allow app

> I'm generally skeptical of Apple's pro-privacy messaging That's a very healthy attitude towards Apple's claims. They developed all these APIs that allow app makers to spy on their users, and then blame the app makers for spying. For example, why does any app need to know which other apps I have installed, and how long I use them? This permission should very sparingly pass the review process, and only for apps in specific categories.

buzzerbetrayed 6y ago
> why does any app need to know which other apps I have installed, and how long I use them What are you referring to? As far as I know, one app can't query the list and usage time of other installed apps on iOS. This stackoverflow question[1] seems to confirm this. But please enlighten me if I'm misunderstanding what you're referring to. [1] https://stackoverflow.com/questions/51634436/how-to-get-a-list-of-installed-apps-in-ios11-using-swift-4 https://stackoverflow.com/questions/51634436/how-to-get-a-li...
ajsnigrutin 6y ago
APIs are great.. i want an app to be able to list all the apps installed. I just don't want facebook app to do it, because it really doesn't need that data, and I don't want to give it to them. This should be done the same as with location and microphone access... ie. "ask the user". "Flashlight 2000 DX app wants to access list of apps installed - allow once, allow always, deny now, deny always". Facebook wants to track 50 different things? Well.. ask the user 50 different times and try to explain why you want access to their call history and calendar data (adding calendar entries could also be a write-only option, with optional unique ids to change/remove entries).... and give your UX team a headache. Also, "deny" should be the "bolded" default. Maybe even give the user a list of unchecked permission the app wants, with explanations why it needs them, and have the user check the ones they want to give to the app (default state is unchecked (deny)). Also granularity is key... giving location access for bluetooth connections, giving "manage calls" access to stop playing music when you get a call, etc. is just stupid.
- unishark 6y ago
  I don't think they're great, it seems like a way of obfuscating what the app really does. Your approach might work for savvy or paranoid users, but not everyone notices much beyond "contains ads" or such. Apple needs to force them to be up front from the very beginning that their stupid game or screensaver or else is also a tracking app. And boot any app that uses your phone to do anything beyond what they told you they would do in the app store description.
  - paulryanrogers 6y ago
    Didn't Apple have an ad mocking all the access prompts in Windows Vista? My how things have changed
    - 2muchcoffeeman 6y ago
      I guess timing and education matters. People would just click through all those Windows alerts. So they were useless. And maybe people weren't so savvy about privacy and security. Nowadays, people are more aware about such things, so maybe you can start to assume the users are more comfortable about computing and the internet. So they should change their direction. I'd agree with the sentiment if it was like Samsung making fun of removing a headphone jack, only to do the same thing less than a year later.
    - zepto 6y ago
      This is nothing like that. Vista popped up inscrutable boxes for all kinds of actions, with no explanation. This is a small number of permissions, each explained clearly. If Microsoft had done it this way, nobody would have laughed.
      - paulryanrogers 6y ago
        IDK MacOS blocks saving exports from Sequel Ace every single time I try. Have to do a file dialog dance each time or it silently fails. Guess devs just have to stay on top of the changing API requirements.
charcircuit 6y ago
>For example, why does any app need to know which other apps I have installed, and how long I use them? It helps collect data that can be used to help detect malicious users of services.
xGrill 6y ago
I can think of a few. An app might need to know if Twitter is installed so it can show a button to open a link in twitter or a web browser (This was before App Deeplinking was a thing). Maybe if an app company had multiple apps that it wanted to cross sell and see if they have both apps installed to enable certain functionality.
m463 6y ago
Not only do they develop these technologies (wifi location db, ibeacon, deep linking, findmy, etc) They don't give you the ability to block them. and of course, you can't find out what is going in and out of your phone over the network, and you definitely can't firewall it. ("content blockers" are nerfed)
- ogre_codes 6y ago
  You can disable almost all of those things in one way or another. The problem is all of these things you mention are also useful for things users want. Often they are useful for things users want inside their applications. Nobody wants a neutered OS.
  - m463 6y ago
    To disable ibeacon you turn off bluetooth and/or location services. I don't know about find my - it may locate other people's stuff no matter what you do. You can't really disable deep linking. If you get a text message with an amazon link, the amazon app will see it. It is not apple's way to advertise this capability is available, and give you granular control.
    - zepto 6y ago
      Find my is off by default. You are asked if you want to enable it.
amznthrwaway 6y ago
Android allows apps to list other apps installed. IOS does not allow this. The premise of your post is incorrect, and you should issue a correction and an apology to the HN community for posting ignorant horseshit.
ogre_codes 6y ago
Why does an app need to know which other apps you have installed? Because it might want to interface with those apps obviously. Apple has actually ratcheted down permissions on that API because it was abused. People want apps to be able to do things and those things can often allow tracking in addition to being useful to the user. There is pretty much one API Apple devised specifically for tracking users and this very issue is Apple attempting to shut down. Clarification: Just to be clear, Apple isn’t shutting down the API entirely, they are changing it from opt-out to opt-in.
- deleted 6y ago
  [deleted]
zepto 6y ago
> They developed all these APIs that allow app makers to spy on their users What are you talking about? They didn’t develop any such APIs, and have been progressively closing up anything that can be exploited that was left over from Mac OS. Also, they aren’t blaming anyone for using anything they have built. They are just asking users to consent to apps using it. Why is that a problem?
conradev 6y ago
I completely agree that it is a healthy attitude to have, and all of Apple's claims should be independently investigated. But I also agree that you should check facts or provide citations before spreading FUD: - There was never any API for a third party app on iOS to get the time spent in another app. The only workaround I saw to this was an app that asked you to screenshot your app usage screen, and it was able to process those screenshots in an automated way (can't find the link). - There is an API to open URLs between apps, so that one app can link to another app. When developers realized that they could check whether or not a given URL was openable to check if an app is installed, they started abusing this API to check every app on the system. Apple cracked down on the API in iOS 9 and made it so that all apps declare which other apps they can check, and App Review decides if they have a legitimate use: https://developer.apple.com/documentation/uikit/uiapplication/1622952-canopenurl https://developer.apple.com/documentation/uikit/uiapplicatio...
- lathiat 6y ago
  Good summary. And it’s common for apps that might not otherwise have a URL handler to have one for things like authentication callbacks from login with Facebook, emails from the app, etc.
ASalazarMX 6y ago
> For example, why does any app need to know which other apps I have installed, and how long I use them? This permission should very sparingly pass the review process, and only for apps in specific categories. Since I can't edit my original comment, I chose to reply to it instead of replying to everyone who corrected me. Yes, there's no API to directly query installed apps and usage on iOS. I think I got the wrong impression from years ago, when the function canOpenURL() could be abused to detect which apps were installed[0]. Thank you all for the corrections. 0. https://useyourloaf.com/blog/querying-url-schemes-with-canopenurl/ https://useyourloaf.com/blog/querying-url-schemes-with-canop...

buzzerbetrayed 6y ago

> why does any app need to know which other apps I have installed, and how long I use them What are you referring to? As far as I know, one app can't query the list and usage time of other installed apps on iOS. This stackoverflow question[1] seems to confirm this. But please enlighten me if I'm misunderstanding what you're referring to. [1] https://stackoverflow.com/questions/51634436/how-to-get-a-list-of-installed-apps-in-ios11-using-swift-4 https://stackoverflow.com/questions/51634436/how-to-get-a-li...

ajsnigrutin 6y ago

APIs are great.. i want an app to be able to list all the apps installed. I just don't want facebook app to do it, because it really doesn't need that data, and I don't want to give it to them. This should be done the same as with location and microphone access... ie. "ask the user". "Flashlight 2000 DX app wants to access list of apps installed - allow once, allow always, deny now, deny always". Facebook wants to track 50 different things? Well.. ask the user 50 different times and try to explain why you want access to their call history and calendar data (adding calendar entries could also be a write-only option, with optional unique ids to change/remove entries).... and give your UX team a headache. Also, "deny" should be the "bolded" default. Maybe even give the user a list of unchecked permission the app wants, with explanations why it needs them, and have the user check the ones they want to give to the app (default state is unchecked (deny)). Also granularity is key... giving location access for bluetooth connections, giving "manage calls" access to stop playing music when you get a call, etc. is just stupid.

unishark 6y ago
I don't think they're great, it seems like a way of obfuscating what the app really does. Your approach might work for savvy or paranoid users, but not everyone notices much beyond "contains ads" or such. Apple needs to force them to be up front from the very beginning that their stupid game or screensaver or else is also a tracking app. And boot any app that uses your phone to do anything beyond what they told you they would do in the app store description.
- paulryanrogers 6y ago
  Didn't Apple have an ad mocking all the access prompts in Windows Vista? My how things have changed
  - 2muchcoffeeman 6y ago
    I guess timing and education matters. People would just click through all those Windows alerts. So they were useless. And maybe people weren't so savvy about privacy and security. Nowadays, people are more aware about such things, so maybe you can start to assume the users are more comfortable about computing and the internet. So they should change their direction. I'd agree with the sentiment if it was like Samsung making fun of removing a headphone jack, only to do the same thing less than a year later.
  - zepto 6y ago
    This is nothing like that. Vista popped up inscrutable boxes for all kinds of actions, with no explanation. This is a small number of permissions, each explained clearly. If Microsoft had done it this way, nobody would have laughed.
    - paulryanrogers 6y ago
      IDK MacOS blocks saving exports from Sequel Ace every single time I try. Have to do a file dialog dance each time or it silently fails. Guess devs just have to stay on top of the changing API requirements.

charcircuit 6y ago

>For example, why does any app need to know which other apps I have installed, and how long I use them? It helps collect data that can be used to help detect malicious users of services.

xGrill 6y ago

I can think of a few. An app might need to know if Twitter is installed so it can show a button to open a link in twitter or a web browser (This was before App Deeplinking was a thing). Maybe if an app company had multiple apps that it wanted to cross sell and see if they have both apps installed to enable certain functionality.

m463 6y ago

Not only do they develop these technologies (wifi location db, ibeacon, deep linking, findmy, etc) They don't give you the ability to block them. and of course, you can't find out what is going in and out of your phone over the network, and you definitely can't firewall it. ("content blockers" are nerfed)

ogre_codes 6y ago
You can disable almost all of those things in one way or another. The problem is all of these things you mention are also useful for things users want. Often they are useful for things users want inside their applications. Nobody wants a neutered OS.
- m463 6y ago
  To disable ibeacon you turn off bluetooth and/or location services. I don't know about find my - it may locate other people's stuff no matter what you do. You can't really disable deep linking. If you get a text message with an amazon link, the amazon app will see it. It is not apple's way to advertise this capability is available, and give you granular control.
  - zepto 6y ago
    Find my is off by default. You are asked if you want to enable it.

amznthrwaway 6y ago

Android allows apps to list other apps installed. IOS does not allow this. The premise of your post is incorrect, and you should issue a correction and an apology to the HN community for posting ignorant horseshit.

ogre_codes 6y ago

Why does an app need to know which other apps you have installed? Because it might want to interface with those apps obviously. Apple has actually ratcheted down permissions on that API because it was abused. People want apps to be able to do things and those things can often allow tracking in addition to being useful to the user. There is pretty much one API Apple devised specifically for tracking users and this very issue is Apple attempting to shut down. Clarification: Just to be clear, Apple isn’t shutting down the API entirely, they are changing it from opt-out to opt-in.

deleted 6y ago
[deleted]

zepto 6y ago

> They developed all these APIs that allow app makers to spy on their users What are you talking about? They didn’t develop any such APIs, and have been progressively closing up anything that can be exploited that was left over from Mac OS. Also, they aren’t blaming anyone for using anything they have built. They are just asking users to consent to apps using it. Why is that a problem?

conradev 6y ago

I completely agree that it is a healthy attitude to have, and all of Apple's claims should be independently investigated. But I also agree that you should check facts or provide citations before spreading FUD: - There was never any API for a third party app on iOS to get the time spent in another app. The only workaround I saw to this was an app that asked you to screenshot your app usage screen, and it was able to process those screenshots in an automated way (can't find the link). - There is an API to open URLs between apps, so that one app can link to another app. When developers realized that they could check whether or not a given URL was openable to check if an app is installed, they started abusing this API to check every app on the system. Apple cracked down on the API in iOS 9 and made it so that all apps declare which other apps they can check, and App Review decides if they have a legitimate use: https://developer.apple.com/documentation/uikit/uiapplication/1622952-canopenurl https://developer.apple.com/documentation/uikit/uiapplicatio...

lathiat 6y ago
Good summary. And it’s common for apps that might not otherwise have a URL handler to have one for things like authentication callbacks from login with Facebook, emails from the app, etc.

ASalazarMX 6y ago

> For example, why does any app need to know which other apps I have installed, and how long I use them? This permission should very sparingly pass the review process, and only for apps in specific categories. Since I can't edit my original comment, I chose to reply to it instead of replying to everyone who corrected me. Yes, there's no API to directly query installed apps and usage on iOS. I think I got the wrong impression from years ago, when the function canOpenURL() could be abused to detect which apps were installed[0]. Thank you all for the corrections. 0. https://useyourloaf.com/blog/querying-url-schemes-with-canopenurl/ https://useyourloaf.com/blog/querying-url-schemes-with-canop...