6 ms·

> How would you prevent this from happening? Very simply - enforce security permissions at the OS level, rather than the app store level. There's no technical

by fouric 5y ago

> How would you prevent this from happening? Very simply - enforce security permissions at the OS level, rather than the app store level. There's no technical reason an app store also has to handle permissions. Leave the discoverability/reviews/curation functionality in the app store, and then just move the app installation functionality into the OS - the app store delivers an app package which the OS accepts, parses the manifest file, prompts user for permissions. Put APIs behind a sane, capabilities-like model where the OS has to approve everything. Facebook and Google can make their own app stores - but they still won't be able to spy on you by using privileged APIs without your consent. (yes, they'll still be able to spy on you using data collection and aggregation - but then Apple's App Store privacy labels becomes a differentiating feature that build user trust and add value to the system, and Apple could add a warning when you install another App Store "privacy labels don't transfer, etc.")

CountSessine 5y ago
"Facebook wants access to your address book: In order to view your facebook timeline and newsfeed, we need access to your address book. Please allow access. Allow/Deny" There's no automated capabilities-based OS-level permissions model that can protect against this. Accessing the address book is a legitimate app request - just not for Facebook Inc. in my opinion. But they can gate access to your timeline and friends by demanding it. And I guarantee you that 9/10 smartphone users will grant it. This is why you need curation and app store rules.
- swiley 5y ago
  Deny shouldn't break the API, it just means the app gets garbage data instead.
  - CountSessine 5y ago
    It’s just a cat and mouse game. I see your address book and verify that the entries aren’t in your friends list and I ask again until you give me the real stuff. And then your ROM devs figure out how to make the data more convincing. And then I start running AI algorithms on it. It’s like captcha - there’s no end to the competition. And in the meantime you can’t see your timeline until you give me the real stuff. Or, Google and Apple tell me to f*cking cut it out and threaten to toss me out of the App Store.
    - swiley 5y ago
      I don't keep contacts in the standard app so I wouldn't be allowed on Facebook anymore then. At some point they can just tell you to upload your contacts and drivers license via email or a web form if you want to use the app, WTF do you plan on doing then?
      - CountSessine 5y ago
        I don't keep contacts in the standard app so I wouldn't be allowed on Facebook anymore then. Probably for the best. Social media is poison. At some point they can just tell you to upload your contacts and drivers license via email or a web form if you want to use the app, WTF do you plan on doing then? I'm really trying to help you understand why Google and Apple can't rely on OS-level caps and perms. If you don't understand how app devs can cheat you blind regardless of what system-level perms you set, you're clearly not an app dev. I can ID your device and send it encrypted back to my server. I can find your non-standard address book and read it off the user partition by nicely offering you a utility service like backup. It's gzipped and encrypted and sent back to my db and forget about your privacy. I can do a lot more on your ROM'ed android device than you expect, and I can do it all with permissions and a bit of social engineering. Now just imagine what I can do with your grandma.
        swiley 5y ago
        I have older family members that have uploaded images of their state ID because the app they wanted to use told them to. No amount of careful OS design could fix that and the two companies running App Stores are unwilling to perform the curation required to fix it. At this point the only safe curated app store is F-Droid.
fauigerzigerk 5y ago
I don't think it's that simple, and relegating the main issue to a bracketed footnote doesn't make it so. I agree with you that permissions and a sandbox that actually works would have to be part of any solution. But you can rest assured that Facebook wouldn't have made such a fuss if all that was at stake is losing access to IDFA and getting slapped with some unenforceable privacy warning. What's creating a real problem for Facebook is the enforceable legal obligation that Apple has put in place as a precondition for being allowed on iOS devices at all. It works exactly because it is not a technology based solution. It has created a choice that we didn't previously have. So I wonder how we can keep this choice without making Apple this all powerful, rent seeking, patronising overlord that also happens to be an ideal attack vector for censorship happy authoritarian governments all over the world.
- smoldesu 5y ago
  I think they do have a point though. If Apple's primary concern was security, they would be approaching this from a fundamentally different perspective; their current solution is a pretty dubious stopgap that bridges "human consent" and "your app". A fundamentally secure approach would ultimately let the user audit and manually control their API interfaces to prevent abuse, instead of just hoping Apple has your best intentions at mind.
  - simondotau 5y ago
    Many of Apple’s “security” policies are fundamentally editorial rather than technical restrictions. How do you propose that such editorial policies be enforced? For example: an app which targets children and asks them to supply personal information. Similarly, Apple’s new, much-lauded anti-tracking policy does have a technical component to it, but it would be easy enough for motivated developers to get around it. All that stops them is app review, or more precisely, the threat of app review. In both cases, I assert that such editorial control cannot survive store diversification. Right now the App Store policies are able to nudge developers towards pro-consumer behaviours. Any substantive amount of store competition flips the script and means stores will compete to appease developers, rather than apply principles in the long term interest of consumers. The nanosecond after Apple is forced to change their product, big names like Google and Facebook will be the first to set up their own shops, specifically to escape Apple’s pro-consumer editorial policies.

by fouric 5y ago

CountSessine 5y ago

"Facebook wants access to your address book: In order to view your facebook timeline and newsfeed, we need access to your address book. Please allow access. Allow/Deny" There's no automated capabilities-based OS-level permissions model that can protect against this. Accessing the address book is a legitimate app request - just not for Facebook Inc. in my opinion. But they can gate access to your timeline and friends by demanding it. And I guarantee you that 9/10 smartphone users will grant it. This is why you need curation and app store rules.

swiley 5y ago
Deny shouldn't break the API, it just means the app gets garbage data instead.
- CountSessine 5y ago
  It’s just a cat and mouse game. I see your address book and verify that the entries aren’t in your friends list and I ask again until you give me the real stuff. And then your ROM devs figure out how to make the data more convincing. And then I start running AI algorithms on it. It’s like captcha - there’s no end to the competition. And in the meantime you can’t see your timeline until you give me the real stuff. Or, Google and Apple tell me to f*cking cut it out and threaten to toss me out of the App Store.
  - swiley 5y ago
    I don't keep contacts in the standard app so I wouldn't be allowed on Facebook anymore then. At some point they can just tell you to upload your contacts and drivers license via email or a web form if you want to use the app, WTF do you plan on doing then?
    - CountSessine 5y ago
      I don't keep contacts in the standard app so I wouldn't be allowed on Facebook anymore then. Probably for the best. Social media is poison. At some point they can just tell you to upload your contacts and drivers license via email or a web form if you want to use the app, WTF do you plan on doing then? I'm really trying to help you understand why Google and Apple can't rely on OS-level caps and perms. If you don't understand how app devs can cheat you blind regardless of what system-level perms you set, you're clearly not an app dev. I can ID your device and send it encrypted back to my server. I can find your non-standard address book and read it off the user partition by nicely offering you a utility service like backup. It's gzipped and encrypted and sent back to my db and forget about your privacy. I can do a lot more on your ROM'ed android device than you expect, and I can do it all with permissions and a bit of social engineering. Now just imagine what I can do with your grandma.
      - swiley 5y ago
        I have older family members that have uploaded images of their state ID because the app they wanted to use told them to. No amount of careful OS design could fix that and the two companies running App Stores are unwilling to perform the curation required to fix it. At this point the only safe curated app store is F-Droid.

fauigerzigerk 5y ago

I don't think it's that simple, and relegating the main issue to a bracketed footnote doesn't make it so. I agree with you that permissions and a sandbox that actually works would have to be part of any solution. But you can rest assured that Facebook wouldn't have made such a fuss if all that was at stake is losing access to IDFA and getting slapped with some unenforceable privacy warning. What's creating a real problem for Facebook is the enforceable legal obligation that Apple has put in place as a precondition for being allowed on iOS devices at all. It works exactly because it is not a technology based solution. It has created a choice that we didn't previously have. So I wonder how we can keep this choice without making Apple this all powerful, rent seeking, patronising overlord that also happens to be an ideal attack vector for censorship happy authoritarian governments all over the world.

smoldesu 5y ago
I think they do have a point though. If Apple's primary concern was security, they would be approaching this from a fundamentally different perspective; their current solution is a pretty dubious stopgap that bridges "human consent" and "your app". A fundamentally secure approach would ultimately let the user audit and manually control their API interfaces to prevent abuse, instead of just hoping Apple has your best intentions at mind.
- simondotau 5y ago
  Many of Apple’s “security” policies are fundamentally editorial rather than technical restrictions. How do you propose that such editorial policies be enforced? For example: an app which targets children and asks them to supply personal information. Similarly, Apple’s new, much-lauded anti-tracking policy does have a technical component to it, but it would be easy enough for motivated developers to get around it. All that stops them is app review, or more precisely, the threat of app review. In both cases, I assert that such editorial control cannot survive store diversification. Right now the App Store policies are able to nudge developers towards pro-consumer behaviours. Any substantive amount of store competition flips the script and means stores will compete to appease developers, rather than apply principles in the long term interest of consumers. The nanosecond after Apple is forced to change their product, big names like Google and Facebook will be the first to set up their own shops, specifically to escape Apple’s pro-consumer editorial policies.