4 ms·

Maybe because Google and it's products have little respect for user privacy? That's incorrect. Querying installed apps has been severely restricted (and thus m

Maybe because Google and it's products have little respect for user privacy? That's incorrect. Querying installed apps has been severely restricted (and thus mostly useless) and also requires a special nuclear-scale permission since Android 11. I am wondering what exploit HSBC is using because I really don't think they are using official APIs for this.

jqpabc123 10mo ago
I am wondering what exploit HSBC is using Why was querying installed apps ever allowed? Why is an exploit or permission available now? Answer --- see the original post above.
- SpicyLemonZest 10mo ago
  You don’t think your phone should let you run certain programs, even with elevated permissions?
  - jqpabc123 10mo ago
    Were elevated permissions granted by the user in this case? If so, then this entire discussion is baseless.
  - mindslight 9mo ago
    Sure, but framed that way you also need to be able to run programs that think they have higher permissions even though API calls are returning mocked/sanitized data. And more generally, the ability to run programs with high permissions that can completely modify the behavior of other lower-permissions programs (eg HSBC).
wolvoleo 10mo ago
Still, I have had issues with this too. My work uses an antimalware app when you use BYOD. Fine, but that app (lookout for work) installed in the work profile, and it complained that I had a tracking blocker (trackercontrol.org) installed in the MAIN profile :( This really pissed me off. Not only is an app in the work profile not supposed to even look at what I've got installed on the personal side, but it's actually a legit app. There's nothing wrong with tracker control. And it comes from a legit source, the Oxford university. The lookout guys are just being obstinate blocking it.
alex1115alex 10mo ago
The QUERY_ALL_PACKAGES permission (what an Android app needs to see all the packages installed on your phone) is a little weird. The user doesn’t get prompted and explicitly grant permission for it like they would for something like MICROPHONE- having it in the app’s manifest alone is sufficient to query packages. However, Google Play Console does make you submit a video of how the permission is used in your app in order to publish on Google Play if they detect it in your manifest. The acceptance criteria made sense for our app (it displays your phone’s notifications on your smart glasses HUD, and users need a way of selecting which apps can/can’t display notifications). I don’t know how HSBC justifies it though.
- jqpabc123 9mo ago
  The user doesn’t get prompted and explicitly grant permission for it like they would for something like MICROPHONE Why implement this in such an anti-privacy way that side steps the user? Answer - see the original post above.

jqpabc123 10mo ago

I am wondering what exploit HSBC is using Why was querying installed apps ever allowed? Why is an exploit or permission available now? Answer --- see the original post above.

SpicyLemonZest 10mo ago
You don’t think your phone should let you run certain programs, even with elevated permissions?
- jqpabc123 10mo ago
  Were elevated permissions granted by the user in this case? If so, then this entire discussion is baseless.
- mindslight 9mo ago
  Sure, but framed that way you also need to be able to run programs that think they have higher permissions even though API calls are returning mocked/sanitized data. And more generally, the ability to run programs with high permissions that can completely modify the behavior of other lower-permissions programs (eg HSBC).

wolvoleo 10mo ago

Still, I have had issues with this too. My work uses an antimalware app when you use BYOD. Fine, but that app (lookout for work) installed in the work profile, and it complained that I had a tracking blocker (trackercontrol.org) installed in the MAIN profile :( This really pissed me off. Not only is an app in the work profile not supposed to even look at what I've got installed on the personal side, but it's actually a legit app. There's nothing wrong with tracker control. And it comes from a legit source, the Oxford university. The lookout guys are just being obstinate blocking it.

alex1115alex 10mo ago

The QUERY_ALL_PACKAGES permission (what an Android app needs to see all the packages installed on your phone) is a little weird. The user doesn’t get prompted and explicitly grant permission for it like they would for something like MICROPHONE- having it in the app’s manifest alone is sufficient to query packages. However, Google Play Console does make you submit a video of how the permission is used in your app in order to publish on Google Play if they detect it in your manifest. The acceptance criteria made sense for our app (it displays your phone’s notifications on your smart glasses HUD, and users need a way of selecting which apps can/can’t display notifications). I don’t know how HSBC justifies it though.

jqpabc123 9mo ago
The user doesn’t get prompted and explicitly grant permission for it like they would for something like MICROPHONE Why implement this in such an anti-privacy way that side steps the user? Answer - see the original post above.