4 ms·

Sideloading is a threat to privacy because it allows apps to ignore the consent requirements the App Store enforces. As it stands, if any app wants access to y

Sideloading is a threat to privacy because it allows apps to ignore the consent requirements the App Store enforces. As it stands, if any app wants access to your contacts, your camera, your microphone, your photos, etc, it must ask first. Allowing sideloading removes this protection, and apps installed that way could simply siphon all your data silently. You even describe how that can be the case, but you couch it as being with third-party app stores. While what you say is not false, it is also not limited to that case: the removal of both privacy and security protections happens as soon as you stop having the App Store be the sole source for iOS software. Yes, of course, a hypothetical "Facebook App Store" with all Facebook apps being exclusive to it would have a higher chance of getting nefarious data-siphoning apps onto users' iPhones than any old random sideloaded app, but it's hardly a necessary part of the threat to privacy. It's just a way of guaranteeing much more widespread compromises of privacy.

8note 5y ago
I would imagine that the OS's APIs should be the ones to enforce that, rather than the app store
- interpol_p 5y ago
  One of App Store review's uses is to block misuses of valid API Some good examples are: * Exorbitant subscription pricing (3-day free trial, then $20 per week) * Misusing in-app purchase dialogues. There are some apps that dim the screen down to zero brightness when the in-app payment prompt pops up, and tells the user to rest their finger on the home button * Ensuring data collection practices match the claimed data collection practices in the privacy policy / "nutrition label" I don't know whether Apple is any good at enforcing those. We can only see the ones that slip through the cracks, and there are many. But not enforcing them hurts trust in the App Store and decreases revenue for all legitimate developers. I know two people who refuse to accept any free trials due to being burnt by subscription scams on iOS. And I personally have an app in the App Store with a free trial (no subscription, just a once-off lifetime purchase!) and constantly get one-star reviews claiming I run a subscription scam Lack of enforcement of the above is directly hurting my revenue. So I worry that allowing side-loading opens up the above channels to all sorts of scammy behaviour, and that then reflects poorly on the official App Store (many users won't know the difference, doesn't matter how many dire warnings / official dialogs you pop up)
vanviegen 5y ago
Sideloaded apps on Android have needed to ask the user for permissions since day one. This is not (necessarily) a feature of the store.
shkkmo 5y ago
What about an EFF store that only allows strongly vetted open source apps? Wouldn't that allow users to have more security and more privacy?
adriancr 5y ago
sideloading also disallows stores like f-droid. The same argument could have been used by microsoft a long tjme ago to lock machines to windows and kill linux. It would not have worked then, it should not now. What apple does is basically avoiding competition. That's not fine when you have 50+% market share
- srtjstjsj 5y ago
  Huh? Locking a machine to Windows is the manufacturer's choice, not Microsoft's. A better comparison is if MS banned installing apps not distributed by MS.
  - adriancr 5y ago
    > Huh? Locking a machine to Windows is the manufacturer's choice, not Microsoft's. Microsoft used to tax OEMs on all pcs with x86 sold as having windows pre-installed on them (otherwise OEMs wouldn't be allowed to sell windows at all). This got them into anti-trust issues. By the same mechanism they could have asked OEMs to lock machines to windows. Anti-trust lawsuit could have lead to Microsoft being broken up into separate companies. It would be funny if Microsoft avoided that only for Apple to be broken down into separate companies. (one for app store, one for iphone, etc) > A better comparison is if MS banned installing apps not distributed by MS. If they did this what would be the consequences?, are potential anti-trust lawsuits going to appear again? Also see what happened with bundling internet explorer in europe.
  - cesarb 5y ago
    > Locking a machine to Windows is the manufacturer's choice, not Microsoft's. Microsoft has hardware certification requirements for machines that ship with Windows, and these certification requirements mandate whether or not a machine will be locked to Windows. On traditional x86, these requirements mandate that it must be possible to both disable SecureBoot and enroll the owner's keys; on ARM, Microsoft changed these requirements to forbid both options (https://softwarefreedom.org/blog/2012/jan/12/microsoft-confirms-UEFI-fears-locks-down-ARM/ https://softwarefreedom.org/blog/2012/jan/12/microsoft-confi...), so that these machines would be locked to operating systems signed by Microsoft. If manufacturers want to be able to ship machines with Windows, they have no choice but to follow these hardware certification requirements; and it's not hard to argue that Windows is a monopoly, such that manufacturers have no choice but to ship machines with Windows. > A better comparison is if MS banned installing apps not distributed by MS. Isn't that what "S mode" does?
kitsunesoba 5y ago
I think that sideloading represents a greater security threat in terms of what the sideloaded app can do, but it's counterbalanced by the number of users sideloading - especially if sideloading is designed to be a highly technical process, the number of users doing it is going to be quite small. Even now very few Android users sideload. By contrast, third party app stores could open an entire one-click universe of privacy abuse. Even if individual apps can't do as much damage, the overall footprint is much larger as the information that's accessible is scattered across a far wider spread of companies/developers by giving them access to users who don't possess the technical aptitude to get themselves in trouble with sideloading.
- webmobdev 5y ago
  > By contrast, third party app stores could open an entire one-click universe of privacy abuse. This is similar to the argument made for censorship - we should also censor newspapers, books, television, movies and the internet to ensure that people get the right information and values, and are not influenced by "harmful" content. At some point, you have to start treating adults like adults, rather than mollycoddle everyone as some immature and / or innocent being.
  - kitsunesoba 5y ago
    I think the key difference is that in the case of media, people aren't unknowingly signing up for anything – those partaking decide they like what they see and continue to partake. Media also has no element of lock-in… if one media source becomes untrustworthy in one's eyes, it's pretty easy to switch to some other outlet. With third-party app stores and even apps themselves, it's very easy for users to get more than they bargained for at mass scale. As I noted in my original comment, it's very likely that an app store run by the likes of Facebook would operate in such a way, and the worst part is that many users wouldn't have any choice but to go along with it — they're forced to install the Facebook Store and accept all that it and the apps on it (WhatsApp, Messenger, etc) entail in order to continue to connect with their friends and family. Malicious app stores can effectively hold parts of users' lives hostage to force access to data. Which is why I'm not against third party app stores, but rather third party app stores without regulation that makes foul play a costly mistake on the part of the developer.
jeroenhd 5y ago
> Allowing sideloading removes this protection, and apps installed that way could simply siphon all your data silently. I don't have any iDevices, but are you suggesting that any iOS app has access to all of your files if the code makes it through the app store review? Because that would be a major issue in Apple's sandboxing in my opinion. I don't think you're right about how the OS security policies work, at least I hope so.
- chj 5y ago
  You are right. Every app lives in its Sandbox, so it is really not an issue.
heavyset_go 5y ago
> Sideloading is a threat to privacy because it allows apps to ignore the consent requirements the App Store enforces. As it stands, if any app wants access to your contacts, your camera, your microphone, your photos, etc, it must ask first. Allowing sideloading removes this protection, and apps installed that way could simply siphon all your data silently. There's no reason that the OS can't implement sandboxes and enforce protections for such data. There's literally decades of research on operating system security. Besides, when we forgo system safety in favor of corporate gatekeeping, that isn't security. In fact, such a scheme is responsible for mass distribution of malware. Apple's App Store is responsible for distributing over half a billion copies of Xcodeghost to iPhone and iPad users[1], and that's just one piece of malware. [1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...
- nodamage 5y ago
  People always cite sandboxing as some kind of panacea but the problem is sandboxing is entirely incapable of preventing bad actors from abusing permissions that were originally granted for legitimate purposes. For example: I might be okay with granting a messaging app access to my contacts to make it easier for me to send messages to people, but that doesn't mean I'm okay with that app exfiltrating my contacts to build a shadow graph of my social network to sell to advertisers. Putting a permissions dialog in front of my contacts only solves the problem of whether an app is allowed to access my contacts in the first place, there are zero restrictions on what can be done with that data once access is granted.
  - heavyset_go 5y ago
    > For example: I might be okay with granting a messaging app access to my contacts to make it easier for me to send messages to people, but that doesn't mean I'm okay with that app exfiltrating my contacts to build a shadow graph of my social network to sell to advertisers. > Putting a permissions dialog in front of my contacts only solves the problem of whether an app is allowed to access my contacts in the first place, there are zero restrictions on what can be done with that data once access is granted. There's no reason that sandboxes have to be so lenient that this is possible. Permissions can be fine grained, and network connections can be filtered, restricted and denied. Contact access doesn't have to be black or white, either. On systems that work for the user, you can even feed dummy data to apps if you want to.

8note 5y ago

I would imagine that the OS's APIs should be the ones to enforce that, rather than the app store

interpol_p 5y ago
One of App Store review's uses is to block misuses of valid API Some good examples are: * Exorbitant subscription pricing (3-day free trial, then $20 per week) * Misusing in-app purchase dialogues. There are some apps that dim the screen down to zero brightness when the in-app payment prompt pops up, and tells the user to rest their finger on the home button * Ensuring data collection practices match the claimed data collection practices in the privacy policy / "nutrition label" I don't know whether Apple is any good at enforcing those. We can only see the ones that slip through the cracks, and there are many. But not enforcing them hurts trust in the App Store and decreases revenue for all legitimate developers. I know two people who refuse to accept any free trials due to being burnt by subscription scams on iOS. And I personally have an app in the App Store with a free trial (no subscription, just a once-off lifetime purchase!) and constantly get one-star reviews claiming I run a subscription scam Lack of enforcement of the above is directly hurting my revenue. So I worry that allowing side-loading opens up the above channels to all sorts of scammy behaviour, and that then reflects poorly on the official App Store (many users won't know the difference, doesn't matter how many dire warnings / official dialogs you pop up)

vanviegen 5y ago

Sideloaded apps on Android have needed to ask the user for permissions since day one. This is not (necessarily) a feature of the store.

shkkmo 5y ago

What about an EFF store that only allows strongly vetted open source apps? Wouldn't that allow users to have more security and more privacy?

adriancr 5y ago

sideloading also disallows stores like f-droid. The same argument could have been used by microsoft a long tjme ago to lock machines to windows and kill linux. It would not have worked then, it should not now. What apple does is basically avoiding competition. That's not fine when you have 50+% market share

srtjstjsj 5y ago
Huh? Locking a machine to Windows is the manufacturer's choice, not Microsoft's. A better comparison is if MS banned installing apps not distributed by MS.
- adriancr 5y ago
  > Huh? Locking a machine to Windows is the manufacturer's choice, not Microsoft's. Microsoft used to tax OEMs on all pcs with x86 sold as having windows pre-installed on them (otherwise OEMs wouldn't be allowed to sell windows at all). This got them into anti-trust issues. By the same mechanism they could have asked OEMs to lock machines to windows. Anti-trust lawsuit could have lead to Microsoft being broken up into separate companies. It would be funny if Microsoft avoided that only for Apple to be broken down into separate companies. (one for app store, one for iphone, etc) > A better comparison is if MS banned installing apps not distributed by MS. If they did this what would be the consequences?, are potential anti-trust lawsuits going to appear again? Also see what happened with bundling internet explorer in europe.
- cesarb 5y ago
  > Locking a machine to Windows is the manufacturer's choice, not Microsoft's. Microsoft has hardware certification requirements for machines that ship with Windows, and these certification requirements mandate whether or not a machine will be locked to Windows. On traditional x86, these requirements mandate that it must be possible to both disable SecureBoot and enroll the owner's keys; on ARM, Microsoft changed these requirements to forbid both options (https://softwarefreedom.org/blog/2012/jan/12/microsoft-confirms-UEFI-fears-locks-down-ARM/ https://softwarefreedom.org/blog/2012/jan/12/microsoft-confi...), so that these machines would be locked to operating systems signed by Microsoft. If manufacturers want to be able to ship machines with Windows, they have no choice but to follow these hardware certification requirements; and it's not hard to argue that Windows is a monopoly, such that manufacturers have no choice but to ship machines with Windows. > A better comparison is if MS banned installing apps not distributed by MS. Isn't that what "S mode" does?

kitsunesoba 5y ago

I think that sideloading represents a greater security threat in terms of what the sideloaded app can do, but it's counterbalanced by the number of users sideloading - especially if sideloading is designed to be a highly technical process, the number of users doing it is going to be quite small. Even now very few Android users sideload. By contrast, third party app stores could open an entire one-click universe of privacy abuse. Even if individual apps can't do as much damage, the overall footprint is much larger as the information that's accessible is scattered across a far wider spread of companies/developers by giving them access to users who don't possess the technical aptitude to get themselves in trouble with sideloading.

webmobdev 5y ago
> By contrast, third party app stores could open an entire one-click universe of privacy abuse. This is similar to the argument made for censorship - we should also censor newspapers, books, television, movies and the internet to ensure that people get the right information and values, and are not influenced by "harmful" content. At some point, you have to start treating adults like adults, rather than mollycoddle everyone as some immature and / or innocent being.
- kitsunesoba 5y ago
  I think the key difference is that in the case of media, people aren't unknowingly signing up for anything – those partaking decide they like what they see and continue to partake. Media also has no element of lock-in… if one media source becomes untrustworthy in one's eyes, it's pretty easy to switch to some other outlet. With third-party app stores and even apps themselves, it's very easy for users to get more than they bargained for at mass scale. As I noted in my original comment, it's very likely that an app store run by the likes of Facebook would operate in such a way, and the worst part is that many users wouldn't have any choice but to go along with it — they're forced to install the Facebook Store and accept all that it and the apps on it (WhatsApp, Messenger, etc) entail in order to continue to connect with their friends and family. Malicious app stores can effectively hold parts of users' lives hostage to force access to data. Which is why I'm not against third party app stores, but rather third party app stores without regulation that makes foul play a costly mistake on the part of the developer.

jeroenhd 5y ago

> Allowing sideloading removes this protection, and apps installed that way could simply siphon all your data silently. I don't have any iDevices, but are you suggesting that any iOS app has access to all of your files if the code makes it through the app store review? Because that would be a major issue in Apple's sandboxing in my opinion. I don't think you're right about how the OS security policies work, at least I hope so.

chj 5y ago
You are right. Every app lives in its Sandbox, so it is really not an issue.

heavyset_go 5y ago

> Sideloading is a threat to privacy because it allows apps to ignore the consent requirements the App Store enforces. As it stands, if any app wants access to your contacts, your camera, your microphone, your photos, etc, it must ask first. Allowing sideloading removes this protection, and apps installed that way could simply siphon all your data silently. There's no reason that the OS can't implement sandboxes and enforce protections for such data. There's literally decades of research on operating system security. Besides, when we forgo system safety in favor of corporate gatekeeping, that isn't security. In fact, such a scheme is responsible for mass distribution of malware. Apple's App Store is responsible for distributing over half a billion copies of Xcodeghost to iPhone and iPad users[1], and that's just one piece of malware. [1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

nodamage 5y ago
People always cite sandboxing as some kind of panacea but the problem is sandboxing is entirely incapable of preventing bad actors from abusing permissions that were originally granted for legitimate purposes. For example: I might be okay with granting a messaging app access to my contacts to make it easier for me to send messages to people, but that doesn't mean I'm okay with that app exfiltrating my contacts to build a shadow graph of my social network to sell to advertisers. Putting a permissions dialog in front of my contacts only solves the problem of whether an app is allowed to access my contacts in the first place, there are zero restrictions on what can be done with that data once access is granted.
- heavyset_go 5y ago
  > For example: I might be okay with granting a messaging app access to my contacts to make it easier for me to send messages to people, but that doesn't mean I'm okay with that app exfiltrating my contacts to build a shadow graph of my social network to sell to advertisers. > Putting a permissions dialog in front of my contacts only solves the problem of whether an app is allowed to access my contacts in the first place, there are zero restrictions on what can be done with that data once access is granted. There's no reason that sandboxes have to be so lenient that this is possible. Permissions can be fine grained, and network connections can be filtered, restricted and denied. Contact access doesn't have to be black or white, either. On systems that work for the user, you can even feed dummy data to apps if you want to.