4 ms·

You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser

by NavinF 2y ago

immibis 2y ago
Maybe you are using a fully open phone, but mine has an OS made by Google and almost every app tracks my location without my consent.
- nahikoa 2y ago
  For the past 9 years, Android has allowed users to disable location permission per app. More recently, you can choose to share "noisy" location, which just provides an approximation of your location.
  - pompino 2y ago
    Google will never stop spying themselves but will give you the ability to stop their competitors from spying on you. Heh..
- NavinF 2y ago
  I'm an app dev. How exactly would I track your location without your consent?
  - immibis 2y ago
    For example, based on my IP address, nearby wifi networks, and camera footage.
    - ssl-3 2y ago
      > IP address Great. So an app can plug my IP address into a geolocation query, and might ultimately determine that I'm somewhere in $city. Or maybe the next city over. Or maybe half a continent away. But sure, this "works" without consent, since there is no extra step to enable networking for an app. > nearby wifi networks This doesn't work without consent. > camera footage This doesn't work without consent.
    - NavinF 2y ago
      Web apps also get your IP. Why aren't you using a VPN if you care about that? Web apps can also get the rest if you click accept when it asks for camera access. What exactly do you lose by installing an app?
dylan604 2y ago
From the AppStore: Data Linked To You: Purchases, Location, Search History, Usage Data, Financial Info, Contact Info, Identifiers, Sensitive Info. Nope Nope Nope.
- NavinF 2y ago
  That explains nothing. I'm pretty sure it's talking about info that you type into form fields in the app. Same reason FB "links" your health info even though it has no access to the health info stored by your OS. The same applies if you use their website. It'll still ask for that info with a web form.
  - dylan604 2y ago
    > Same reason FB ...is not installed on any of my devices
jimbobthrowawy 2y ago
If anyone is in the situation that they need to put an untrustworthy app on their android device, the "work profile" feature can segment it off further. Insular is an app that lets you create and manage one of these profiles on the device itself: https://gitlab.com/secure-system/Insular https://gitlab.com/secure-system/Insular
- notpushkin 2y ago
  Work profile is really neat, yeah. I'm using Shelter for this, it's quite nice: https://f-droid.org/en/packages/net.typeblog.shelter/ https://f-droid.org/en/packages/net.typeblog.shelter/
_puk 2y ago
I mean, that horse has already bolted.. https://www.nytimes.com/2024/05/31/business/ticketmaster-hack-data-breach.html https://www.nytimes.com/2024/05/31/business/ticketmaster-hac...
- NavinF 2y ago
  Yeah that has literally nothing to do with their app. If you submitted your data on their website, it'd be leaked just the same
  - dylan604 2y ago
    You're implying that the data from the app is stored in a different more secure manner than the data from the website? That makes zero sense. The fact that they got hacked and is the only thing that matters, not which mode of input you provided the data they did not protect.
    - NavinF 2y ago
      No, I'm asserting that the app acquires as much data as the website (ie. whatever you typed into their forms) and it gets leaked all the same. Refusing to install the app makes no sense if you still use the website
      - sbarre 2y ago
        An app absolutely can track more data than a website. You don't have the website open/active on your phone at all times, but you have the app installed at all times, even when it's not running. You do know that apps can record data in the background, right? A website is also sandboxed by your browser in a much stricter manner than an app is on your phone, at least by default. I don't have specific information on the Ticketmaster app here, but to say that an app is the same as website from a tracking perspective on a phone is absurd.
        NavinF 2y ago

You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser

by NavinF 2y ago

You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser

Maybe you are using a fully open phone, but mine has an OS made by Google and almost every app tracks my location without my consent.

nahikoa 2y ago
For the past 9 years, Android has allowed users to disable location permission per app. More recently, you can choose to share "noisy" location, which just provides an approximation of your location.
- pompino 2y ago
  Google will never stop spying themselves but will give you the ability to stop their competitors from spying on you. Heh..
NavinF 2y ago
I'm an app dev. How exactly would I track your location without your consent?
- immibis 2y ago
  For example, based on my IP address, nearby wifi networks, and camera footage.
  - ssl-3 2y ago
    > IP address Great. So an app can plug my IP address into a geolocation query, and might ultimately determine that I'm somewhere in $city. Or maybe the next city over. Or maybe half a continent away. But sure, this "works" without consent, since there is no extra step to enable networking for an app. > nearby wifi networks This doesn't work without consent. > camera footage This doesn't work without consent.
  - NavinF 2y ago
    Web apps also get your IP. Why aren't you using a VPN if you care about that? Web apps can also get the rest if you click accept when it asks for camera access. What exactly do you lose by installing an app?

dylan604 2y ago

From the AppStore: Data Linked To You: Purchases, Location, Search History, Usage Data, Financial Info, Contact Info, Identifiers, Sensitive Info. Nope Nope Nope.

NavinF 2y ago
That explains nothing. I'm pretty sure it's talking about info that you type into form fields in the app. Same reason FB "links" your health info even though it has no access to the health info stored by your OS. The same applies if you use their website. It'll still ask for that info with a web form.
- dylan604 2y ago
  > Same reason FB ...is not installed on any of my devices

jimbobthrowawy 2y ago

If anyone is in the situation that they need to put an untrustworthy app on their android device, the "work profile" feature can segment it off further. Insular is an app that lets you create and manage one of these profiles on the device itself: https://gitlab.com/secure-system/Insular https://gitlab.com/secure-system/Insular

notpushkin 2y ago
Work profile is really neat, yeah. I'm using Shelter for this, it's quite nice: https://f-droid.org/en/packages/net.typeblog.shelter/ https://f-droid.org/en/packages/net.typeblog.shelter/

_puk 2y ago

I mean, that horse has already bolted.. https://www.nytimes.com/2024/05/31/business/ticketmaster-hack-data-breach.html https://www.nytimes.com/2024/05/31/business/ticketmaster-hac...

NavinF 2y ago
Yeah that has literally nothing to do with their app. If you submitted your data on their website, it'd be leaked just the same
- dylan604 2y ago
  You're implying that the data from the app is stored in a different more secure manner than the data from the website? That makes zero sense. The fact that they got hacked and is the only thing that matters, not which mode of input you provided the data they did not protect.
  - NavinF 2y ago
    No, I'm asserting that the app acquires as much data as the website (ie. whatever you typed into their forms) and it gets leaked all the same. Refusing to install the app makes no sense if you still use the website
    - sbarre 2y ago
      An app absolutely can track more data than a website. You don't have the website open/active on your phone at all times, but you have the app installed at all times, even when it's not running. You do know that apps can record data in the background, right? A website is also sandboxed by your browser in a much stricter manner than an app is on your phone, at least by default. I don't have specific information on the Ticketmaster app here, but to say that an app is the same as website from a tracking perspective on a phone is absurd.
      - NavinF 2y ago