10 ms·
Don't Download Apps
- jamesbelchamber 1y agoI've been dutifully following this approach for a little while now and it's had the nice side effect of pushing me to smaller and more local options. I think it's also saving me money!
- VerifiedReports 1y agoGiving your phone number is just as bad. I was buying stuff at World Market and they had big signs touting 20% off some things... but when you got the counter they told you didn't get that unless you coughed up your real working mobile number so you could receive some BS code. See ya, jerks.
- liamwire 1y agoYou can use my phone number, +61 400 000 000 :)
- sevenseacat 1y agoexcept it needs to receive a code that you give back to them?
- left-struck 1y agoThere are actually phone numbers that post all text messages they receive online automatically. Personally this has never worked for me though because all the services I tried to sign up for someone else had already used that number
- xiaomai 1y agoNative phone apps give me the creeps. I assume the developer's are able to track me in various ways even without my giving permissions. Is that an unfounded fear on my part? Can an app uniquely identify me if I don't give it control over my phone number / nearby devices? Can apps geo-locate me if the location permission has not been granted? (seems like they could just make a network request to their servers and use the IP address of the request for a rough idea). I _really_ wish using the network was a permission (even if it was an "advanced mode" thing).
- frizlab 1y agoThey can track you on a website perhaps even more reliably than on an app, at least on iOS…
- galleywest200 1y agoThe difference is I am not carrying around my desktop computer, the location data stays static.
- encom 1y ago>Is that an unfounded fear on my part? Given the security record of app stores, probably not.
- noman-land 1y agoSimply your IP address can be used to track you so any app or website you visit knows roughly where you are with every http request unless you use an always on VPN. It can also fingerprint you in various ways without the need for any special permissions.
- bji9jhff 1y agoThen the VPN provider does geolocation instead and get the list of hosts you accessed
- noman-land 1y agoAt the very least the VPN provider promises not to and their reputation depends on their not being caught doing this. Whereas your ISP and various sites you visit will already be collecting this data no matter what.
- xiaomai 1y agoAgree with you about fingerprinting (also a bummer). I guess the difference here though is that I must be actively engaging with a website in order for it to be tracking me, but an app (I assume) can be tracking me basically whenever it wants.
- encom 1y agoAn annoying trend I've noticed is being asked for phone number or email at checkout (IRL). I bought a blood pressure meter a few days ago, and the salesman asked "what phone number should I put on the order?" Zero. Fuck off. I guess most people just answer out of reflex, or believe it's required to complete the purchase. It's creepy and irritating.
- kirtakat 1y ago[Your Area Code]-867-5309 is what I always use - alas they are becoming wise to that
- dylan604 1y ago[areaCode]-555-1212 is one I use, but any 555 prefix will work as it is not meant for actual phone numbers. https://en.wikipedia.org/wiki/555_(telephone_number) https://en.wikipedia.org/wiki/555_(telephone_number)
- phyzome 1y agoI've used 213-456-7890 a few times on throwaway things.
- 867-5309 1y agocool example :)
- raw_anon_1111 1y agoThis has been a thing since the 1990s when I worked at Radio Shack.
- pessimizer 1y agoIt was only a thing at Radio Shack, and I would never give them my number.
- tomwheeler 1y agoAt least they gave me a free battery every month. I feel sorry for their database because I was a teenager with a bunch of guitar pedals and an ongoing need for 9V batteries. I made up a LOT of phone numbers.
- mmcclure 1y agoI switched to using PWAs for social media apps for similar reasons the author outlines. A pleasant, but somewhat unintended consequence is that I just use them a lot less because the experience is pretty bad. It makes me a little sad because I’ve always believed in the PWA dream, but the reality is that they’re bad because companies certainly don’t want to make an experience that rivals the app they really want you to download. Expected, but just leads to reinforcing the idea that PWAs won’t ever be as good when every one people try from someone with a popular app is so awful.
- georgefrowny 1y agoI'm convinced many companies purposely gimp their web sites to drive people to apps. Uber for example doesn't seem to work from my phone browser. What surprises me is how many engineers must be involved in this kind of scummy shit and keep it tightly under wraps.
- jsheard 1y ago> I'm convinced many companies purposely gimp their web sites to drive people to apps. And then their app is just a webview wrapper. But that still gives them more access to your device.
- raw_anon_1111 1y agoExactly what access do you think they have that you don’t specifically allow that they don’t have from a web browser - running on the same device?
- chasing0entropy 1y agoThat's an easy one, hold my beer: Pwa with permissions granted gives access to: Location, create notification, phone state, phone #, IMEI, motion data Mobile app with permissions gives access to EVERYTHING a pwa gets PLUS, Contacts, sms, notification content, biometrics data, web browsing data, phone activity history, location history, camera access, microphone access, NFC access, near device history, nearby wifi listing, saved wifi networks, Bluetooth device ID, Bluetooth beacons nearby, some device settings, personal data access(photos/music)
- jbombadil 1y ago100% agree. The level of tracking has gotten to absurd levels. I needed a couple of grocery items and happened to be next to an Amazon Fresh. Cool, let’s try it! Went in, found everything I needed and went to self checkout. When it was time to pay, the machine wouldn’t accept Apple Pay. I ask an employee who helpfully informs me that I can pay with physical cards or my Amazon account. I didn’t have my physical cards, nor wanted to do my Amazon account so I had to leave empty handed. Why don’t they accept Apple Pay? Because they can’t track you. If you use a physical card, they can likely link that card number to an Amazon account and thus attribute the purchase to a person. If you pay with contactless payment they get a one time token that they can’t tie to anyone.
- StilesCrisis 1y agoWalmart is the same. I believe it's very very slightly more expensive to process Apple Pay payments (Apple's getting a tiny fractional amount of the sale), and this was the actual sticking point.
- dylan604 1y agoWalmart rolled out their own QR code payment plan just so they didn't have to revshare anything. When you're the size of Walmart, you can get away with those types of decisions even though they are technically very much inferior
- cubefox 1y agoPayment services like credit cards demand a significant fee for a (nowadays) technically trivial service: instant cash-free payments. These could be replaced with modern instant bank transfer standards, like FedNow in the US: https://en.wikipedia.org/wiki/FedNow https://en.wikipedia.org/wiki/FedNow These don't require external middle men (like credit card companies) and are therefore almost free. Unfortunately the US is late to the party (in India and some other countries these are already widely used for years), so many banks don't support FedNow yet.
- jimmaswell 1y ago
- sholain 1y agoWe need strong regulation.
- raw_anon_1111 1y agoThis is dumb. Websites have many more ways to track you across websites than apps have to track you if you don’t explicitly give them unnecessary permissions.
- lanfeust6 1y agoNative apps have privileged access to far more personal data on your device. A website has, what, cookies and fingerprinting? You can already mitigate this on Firefox but even if not, it isn't in the same league
- raw_anon_1111 1y agoHave you looked at all of the APIs that are part of the standard? These are from the Firefox website Of course it also knows your device, operating system version, screen resolution, phone orientation, etc. Not to mention that websites can track you across other websites. What information do you think apps have without your permissions that websites don’t? https://developer.mozilla.org/en-US/docs/Web/API/Geolocation_API/Using_the_Geolocation_API https://developer.mozilla.org/en-US/docs/Web/API/Geolocation... https://developer.mozilla.org/en-US/docs/Web/API/Accelerometer https://developer.mozilla.org/en-US/docs/Web/API/Acceleromet... https://developer.mozilla.org/en-US/docs/Web/API/Navigator/getBattery https://developer.mozilla.org/en-US/docs/Web/API/Navigator/g... https://www.w3schools.com/tags/av_prop_volume.asp https://www.w3schools.com/tags/av_prop_volume.asp
- lanfeust6 1y agoGeolocation sharing can be disabled as reflected in your source. Everything else you linked to is trivial, but notwithstanding, it all relies on JS which, as I already said, can be disabled. Oh, and many aren't even available in Firefox: https://developer.mozilla.org/en-US/docs/Web/API/Battery_Status_API#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta... > What information do you think apps have without your permissions that websites don’t? Your actual personal information. Access to photos, messages, metadata (name, address, contacts, notes, metadata, habits).
- chitza 1y ago"never hand your phone over the counter" - do people actually hand over their phones to random strangers? I'd never do that unless I really know the person
- jasonjmcghee 1y agoOccasionally restaurants to pay for something if you don't have a credit card. But never had them go take it somewhere.
- hexbin010 1y agoYeah I've seen younger people hand it over to railway workers, airport gate agents, event employees etc whenever something does not immediately work or the worker has a query. Very reckless and pretty common Incredibly concerning, but it's just another outcome of anxiety disorders
- komali2 1y agoBlogger in question here, Taiwan is so utterly app dependent it's a pretty common thing at banks, hospitals etc. And the apps here have so atrocious UX that nobody bothers to teach you how to use them, staff are used to just doing things for e.g. old people that can't figure it out.
- jovial_cavalier 1y agoGenerally agree with the sentiment, I basically only have banking apps, messaging apps, and a browser on my phone. I am skeptical, though, of the price discrimination claims. If McDonald's decides that the right price of a Big Mac for me is $1 and for you $4, that creates an arbitrage opportunity. You can pay me $3, and I pocket $2. The result is that I buy more big macs, and they bump my price up. You buy less, and they take your price down. Now it just trades at the market rate it was before, but with more steps.
- Nextgrid 1y agoWhich is why there is such a big push against automated usage of apps/etc, so that nobody could implement such a system.
- sfRattan 1y agoThis assumes the information is clear and consistent enough across time and distance for arbitrage to happen. Pricing in-app, per customer, changing per day would introduce too much unpredictability for most customers to attempt arbitrage. If people in a group all check their apps, and the person with the best prices orders for everyone, it could work in the context of a shared meal. But imagine trying to sort out X number of people who each want a different basket of items from, say, the Walmart app. Each of those items fluctuating daily in price for each customer independently makes arbitrage almost prohibitively difficult to coordinate. The best case scenario is something like Steam sales, where a wishlist function notifies you when items you've "watched" are on sale. There are third parties like, for example, Deku Deals that track this pricing data across time for console games. But Amazon is already trying to banish external AI agents from any access to its data. And what does a price history graph even mean if prices are specific to each customer and stochastically varied each day to induce impulse purchases?
- jovial_cavalier 1y agowhat stops anyone from creating a third party order book that allows people to submit bids and offers on price discriminated items? It can match buyers and sellers just like a stock exchange.
- nerdponx 1y agoThis is all fine and valid but the real problem is that binding arbitration is legal.
- rolandog 1y agoIt's definitely dystopian: "we reserve the right to be judged by the judge we have been treating to yearly all-inclusive vacations and to whom we've been paying his grandchildren's college tuitions."
- spiritplumber 1y agoI think if someone yoinks your phone and installs stuff on it the basic options are "call the cops" or "make them call the cops".
- koakuma-chan 1y agoPeople who create download our app pop-ups need to go to jail.
- siliconc0w 1y agoOne possible future to look forward to is one where everyone is essentially forced to become a commodity player that exposes an API for your AI Agent to order food, book a rideshare, book a ticket, check flight status or whatever. I don't think they'll go willingly but the market may force their hand.
- pharrington 1y agoDownloading software? On MY handheld computer??
- BenFranklin100 1y agoJust another confirmation that the majority of the IT industry depends on spying in order to be profitable and for developers to make a good living. It’s a disgrace really.
- bouncycastle 1y agoWhy wouldn't this physical sign be the same? "If you step your foot over this stone, you agree to the following terms:"
- tomwheeler 1y agoFor all of these same reasons, I never signed up for the "member rewards" program at the local grocery store. I did read the terms and conditions once, when I needed a good laugh.
- Obscurity4340 1y agoFriendly Social Browser is a great alternative to having to download everyone and their kitchen sink's app but not sure if their privacy is great
- rav3ndust 1y agoindeed, been preaching this kind of thing for ages. the main apps i keep on my mobile are my web browser, my comms apps (element, telegram and signal), and some other stuff from f-droid like retro music, ffupdater, newpipe, termux and stuff like that. any social things i add as pwa through the browser. not interested in any of those fast food or store apps. never selling ad-space (and privacy) on my own device to save $2 on a hamburger and some fries, and even if i did want them, chances are high they wouldn't run on my device anyway (feature not bug) lol thankfully in my area, we have some good local places where you can order food just fine over their website. and if it didn't work over the website, i can simply do it the old-fashioned way, pick up the phone and say "i'd like to place an order for XYZ.."
- imgabe 1y ago> A company will know that you just got paid and so charge you just a bit more for your chicken nuggets than they do when you haven’t been paid in two weeks. I know there's various data apps can collect. On iOS at least it seems like you have to grant permission for the app to access most of it. But how on Earth is this supposed to work? How does the app on my phone know if I just got paid?
- SamuelAdams 1y agoFor me I have a recurring calendar appointment reminder for when I get paid. So anything that requests calendar access would know that.
- nerdponx 1y agoBecause another app knows you got paid, and that information was sold to some data broker, and now McDonald's knows.
- imgabe 1y agoBut then McDonald's could just buy the information. They don't need an app on my phone to get it.
- dylan604 1y agoBut if they can get it from an app on your phone, they don't need to buy it. That seems pretty obvious.
- ihsw 1y ago[dead]
- komali2 1y agoAuthor here - they can only do surveillance pricing on you if they know who you are when you're paying. They can't do that at a kiosk or counter because they would only know whose paying when you use your credit card and have already seen the bill. If you use an app they already know you who are and so the second you open the app it's showing you the surveillance prices.
- charcircuit 1y ago>Guess who hires them? Not you! McDonalds doesn't hire them either. But, they will pay a bigger share of the arbitration fees than you do. >they’d have to settle it out of court with a mediator that Disney hired It would be a mediator hired by JAMS, a neutral 3rd party.
- nerdponx 1y agoAnd surely a for-profit extrajudicial court system that holds a monopoly on extrajudicial courts is going to be a fair and impartial resolver of disputes, especially when the defendant is essentially a valued repeat customer and the plaintiff is some nobody and not a major revenue source. What could possibly go wrong? Arbitration between businesses acting in good faith makes perfect sense. Arbitration between an individual customer of a large corporation is nothing but a violation of that individual's basic rights.
- charcircuit 1y ago>Monopoly There are several organizations for arbitration. >valued repeat customer They are locked in by the arbitration agreement. No matter how many times they rule in the consumers favor, Disney would still have to pay filing fees every time a consumer filed. If the arbitor was actually biased you can challenge it in a real court.
- komali2 1y agoI'm interested in people that still have faith in the USA court system. I just checked, Disney's market cap seems to be around $140,000,000,000. If you were to be forced into arbitration, lose, and then attempt to demonstrate that the arbitor was biased and challenge such in court, do you really think that would work before you ran out of money? How many people in America do you think have enough money to bring that case to trial?
- nerdponx 1y ago> There are several organizations for arbitration. Fair, but you don't get to pick. > Disney would still have to pay filing fees every time a consumer filed. Valued repeat customer. > If the arbitor was actually biased you can challenge it in a real court. Good luck?
- nazcan 1y agoIs it somehow easier to have binding arbitration in an app vs. a website, assuming there is an account needed for both?
- dangoodmanUT 1y agoUsing the website doesn’t get you around these clauses either. It’s more like “don’t agree to terms you don’t read”. Chatgpt can help spot things like this without much effort now, but about every single business is going to have an arbitration clause.
- motbus3 1y agoThis is all true. But I work in a company where the folks are actually nice guys. Lately we wanted more people to use the apps so we could block bots more aggressively on web because it is getting annoyingly expensive
- crazygringo 1y agoThe author has this backwards: > but the new trend is surveillance pricing. A company will know that you just got paid and so charge you just a bit more for your chicken nuggets than they do when you haven’t been paid in two weeks. First of all, no, a company has no idea when you get paid. The reality of lots of apps (like McDonald's) is discount pricing. You pay full price at the store if you're a rich person who can't be bothered with apps. Downloading an app and creating an account is the modern equivalent of cutting out coupons or buy-10-get-one-free cards -- price-conscious consumers will go to the trouble and get cheaper prices. They're just loyalty programs. Price discrimination like this is nothing new, and it lets rich people subsidize the lower costs for people with less money. These apps run in sandboxes. There's not much to surveil. Obviously don't grant them permissions to see your contacts or track your location all the time. Will the app be able to tie all your purchases to a single identity? Of course. But the stores already do that anyways if you use the same credit card for each purchase. I don't mind downloading apps for the 5-10 stores/restaurants I go to most. Beyond that, I obviously won't because it's too much of a hassle. But the loyalty discounts I get save me real money. I have no problem with that.
- muppetman 1y agoMcDonalds has been shown multiple times to use their app to figure out how much someone is really willing to play for their slop: https://www.stuff.co.nz/money/350476761/mcdonald-s-under-fire-amid-accusations-of-price-gouging-meals-on-app https://www.stuff.co.nz/money/350476761/mcdonald-s-under-fir... To you and me, the consumer, the value of an app is "the same" as the old loyalty cards. But the value to the company is huge! How often you open the app (how often are you thinking about their food), how often you accept an offer, what the price of the offer is, what card you used to pay, where were you when you opened the app etc etc. Going to be fun times when in 10 years time they sell all that information to your health insurance provider for them to go "Holy hell" and jack your insurances prices up 5 times over. But sure, we got 20c off a burger.
- crazygringo 1y agoYou don't need to use words like "slop", it's pejorative and has nothing to do with the issue at hand. And the link you use is just different people getting different discount coupons in the app. Companies also mail different coupons to different people based on their purchase history. I can't really find myself getting worked up about different people getting different promotions. And it's illegal for health insurance to offer customized pricing like that. And the credit card companies already know I eat at McDonald's or wherever else. Using the app isn't adding any new data. And it's not $0.20 off. It's usually more like $5 off a $15 meal that brings it down to $10. And those numbers add up over the course of a year -- across a few apps, it adds up to hundreds of dollars of savings a year.
- hyttioaoa 1y agoVery much in line with Cory Doctorow's thoughts on enshittification: https://youtu.be/Eiu6FxigqrI?si=aT3vzWVSxV2pi_4U https://youtu.be/Eiu6FxigqrI?si=aT3vzWVSxV2pi_4U
- txrx0000 1y agoRight now, using web portals is indeed better than installing apps, but this does not have be the case. In fact, it should be the other way around. You only need to make two changes to make your native app a better choice than your web portal, even for privacy: 1) Make your app open-source, and remove all the tracking. 2) Don't make a web portal. Your website should just be a website that displays information, not 5 MB of JS+WASM with a load of security issues.
- wowamit 1y ago> I’ve had shop staff tell me about some discount if you download their app, and when I decline, say something like “It’s really easy! Here, just give me your phone and I’ll do it for you.” This behaviour is pretty prevalent worldwide, I believe. Especially the phone plan setup use case happened to me in Bangkok, too. This happens to me in India at gas stations, cafes and even local supermarkets. All want me to install their apps, and the first step is to log in with my mobile number. With auto-detection of mobile numbers/Google Accounts on Android, it's even easier to create an account in one click.
- draw_down 1y ago[dead]
- chasing0entropy 1y agoI'll do you one better, download a no root firewall that channels all of your traffic through a fake VPN which then drops it. You will be amazed at how many ads you don't see. Obviously if you're not competent or are lazy with whitelisting apps when you need them to use the internet and then disabling it again this will be unhelpful to you; continue to feed the machine.
- devmor 1y agoIf someone had an easy set up for this documented so the less technically-inclined could do so, it’d be a great public service.
- workfromspace 1y agoVery similarly, I use NextDNS, with all the filters enabled except few exceptions that I manually add. It's basically like a Raspberry Pi hole; but on cloud, very easy to configure and with so many options and ready-to-use blocklists. It's free up to 3 million queries a month.
- ProllyInfamous 1y agoI am not super technical (blue collar electrician) but I use a PiHole (/r/PiHole or Pi-Hole.net) to block the majority of online tracking/advertising. Extremely intuitive, relatively inexpensive... you can even force your entire network to obey ad-blocking lists (I tell my DHCP router to issue DNS lookups to PiHole; if individual machines need to be un-filtered they manually set DNS to 192.168.0.1 [router] instead of default PiHole) . I don't carry a cell phone / use apps, but I know there is a method to make your on-the-go queries also filter through your home network's PiHole .
- devmor 1y agoI also use a pi-hole, but I have had to mess with the configuration and troubleshoot things so often that I don’t feel comfortable recommending it to non-technical people. I also think the average person is more likely to need this on a cell phone almost exclusively.
- vismit2000 1y ago8 months ago on HN (~1200 upvotes, ~500 comments): Everyone knows all the apps on your phone - https://news.ycombinator.com/item?id=43518866 https://news.ycombinator.com/item?id=43518866
- 1vuio0pswjnm7 1y agoAndroid has some viable non-root "application firewalls" or other apps that use Android's VPN functionality to filter traffic. These can prevent apps, including system apps, from accessing remote servers, e.g., DNS resolvers, ad/tracking servers, etc. There are also Android apps that can automate killing apps that try to run in the background Not sure iOS has anything equivalent The problem with "apps" isn't the surreptitious attempts to access remote servers for data collection, surveillance and tracking/ads. Websites do more or less the same thing. The problem is that the corporate mobile OS sucks, it's user-hostile and exceedingly difficult to try to control The advantage of websites is they do not require using a computer running a corporate mobile OS
- 1vuio0pswjnm7 1y agoThe corporate OS may also include terms requiring arbitration to resolve disuptes At least in the case of Android, an advertising services company OS, those terms may be on a remote server (owned by the company), not on the computer owned by the "user".^1 As such, the user may block access to them along with all the other advertising-related garbage 1. It's necessary to "download" the terms
- RajBhai 1y agoAll the banks I have an account with here in India require SMS permission to use their apps, along with . The last straw was HDFC with their latest app revamp. I've resorted to using the online web app.
- sometimes_all 1y agoLOL in the name of security, HDFC is trying to move their OTP verification to be almost entirely app-only, (not open-source TOTP which can be generated by authenticator/any other auth app; you can only use HDFC's app for that even if you want to log in via desktop). Regulators sleeping at the wheel on this one.
- left-struck 1y agoI think that’s pretty common worldwide. In Australia I’ve never encountered a bank or government service that allows any widely accepted secure 2FA. It’s always SMS or their own app. There used to be physical hardware tokens as well but they are going away.
- RajBhai 1y agoI don't even care that much if they want to handle the 2FA with their proprietary methods. There are Android APIs that broker the OTP SMS delivery to the app without the app needing full access to the phone's messages. If they can't do it on iPhone, they don't need to do it on Android.
- aitchnyu 1y agoI put non-messaging apps into deep sleep (no background services). My mobile provider app prevents users from making a phone wifi hotspot. Wonder what the others do.
- BrenBarn 1y agoIt's good advice, but I don't think it's sufficient anymore. I'm quickly losing faith in any kind of "vote with your dollars" argument that by not using the app you can pressure the company to provide a functional website. The big players are too big now and they are close to being able to create and control their own customer base rather than having to woo them. I don't see a positive future without radically stricter laws and enforcement (as in, if a company is conditioning any service on tracking, they're fined in the double-digit percentages of gross annual revenue). These bad actors will not change unless they're bludgeoned into doing so.
- fmajid 1y agoA corollary is, don't buy "smart" devices that only work using an app. The app will eventually be discontinued and you will have a doorstop.
- ishanmahapatra 1y agoMy major pain point is that Google requires me to use the YouTube app to authenticate when I sign. If it wasn’t for that, I wouldn’t have it on my phone at all.
- wkrsz 1y agoI'm using a separate app for 2FA with both Google. What forces you to use YouTube app?
- CRSilkworth 1y agoSeems like that Disney + example can’t be allowed right? Those are two completely different products (theme park/streaming service). Is the law really that f’ed up?
- kmfrk 1y agoAre there any desktop browsers out there that are actually great for making apps for websites, so we don't have to rely on React slop? I've always found it an unelegant, unsandboxed experience to use conventional browsers, but it'd be nice to migrate to something that takes the best of webdev and removes the worst of desktop Windows.
- dwedge 1y ago> Sometime in the next 5 years, someone will be forced into arbitration with Uber after being hit by one of their self driving cars I got hit by an Uber when crossing the road last year. I reported it to Uber who said publicly "oh that's terrible and not ok, DM us" and then completely ignored me.
- bbbobbb 1y agoIs there no police where you're from? Why are you reporting supposed hit and run to tech support of an app?
- dwedge 1y agoWhat I want is a setting on my phone (and in my browser) that just says yeah, give them everything they wants. Cookies, nearby devices, photos, bluetooth, you want it take it. But every time the app/website tries to read from there it just says oh, sorry, no photos
- nachox999 1y ago1) download app 2) get free chicken nuggets 3) uninstall app 4) ??? 5) profit