3 ms·

>I would love to use this, but I don't want to allow a third party app with closed source to read all my notifications. This can read OTP passwords, full messag

by gruez 10mo ago

>I would love to use this, but I don't want to allow a third party app with closed source to read all my notifications. This can read OTP passwords, full messages, etc. so it must be open source for me to consider it. The app lacks the INTERNET permission so it can't really exfiltrate data even if it wanted to.

nelblu 10mo ago
This is correct, but it is still a slippery slope. At some point the dev ends up adding internet permission (might be for legit reasons too), and lo and behold you are sharing your data. For something as sensitive as notifications, I really can't trust anything but open-source app which is vetted by a few seasoned people and hosted on F-droid.
- gassi 10mo ago
  Related, GrapheneOS has a handy feature to disable network access for individual apps.
  - yonatan8070 10mo ago
    Also non-GrapheneOS Android. I'm on CrDroid (Android 16), ans if I go into "Settings -> Apps -> Some App -> Mobile data usage", there's a toggle for "Allow internet access", and a few more to control network access on Wi-Fi, cellular, background, and VPN.
- sallveburrpi 10mo ago
  If the permission is added in retrospect wouldn’t you still need to opt in? fwiw i completely agree that oss is the way to go here
  - shakna 10mo ago
    The "Internet" permission on Android is one of the no-approval ones. If it gets added, you won't notice.
- hsbauauvhabzb 10mo ago
  I’m interested in what you’re suggesting. Who are those auditors you trust? Does f-droid imply things have been audited?
  - ElectricalUnion 10mo ago
    f-droid implies * that the application is source-available; * toolchain used to build the app is FOSS - application does not use Play Services, or proprietary tracking/analytics, or proprietary ad libraries. * application toolchain doesn't depend on "binary blobs"; Not even passing the sniff test on those easy to meet requirements is suspicious.
- hunter2_ 10mo ago
  Would a safe alternative (albeit annoying to update) be to side load the apk for the purpose of eliminating the possibility of auto updates brought on by an app store?
malfist 10mo ago
Is that actually required? I thought that was implicit
- hn8726 10mo ago
  It's automatically granted but the app needs to declare it in order to access internet. Because of that it's not enough that the app _currently_ doesn't request internet permissions, because if it ever starts, it would be mostly transparent to a user
- wiseowise 10mo ago
  Yes. Without the permission all network requests will just fail.
  - IshKebab 10mo ago
    You can silently add the permission in an update though. It's safe if you don't auto-update it I guess.
blauditore 10mo ago
That's another pet peeve of mine: Why the hell can't we block internet access for apps in (native) Android? Everything else is a permission, but this is not, somehow.
- hexyl_C_gut 10mo ago
  Maybe Google doesn't want users blocking ads from getting loaded.
  - ashtadmir 10mo ago
    ADs work via play services so even if you block internet for the app the ADs will continue to work. The reason many apps stop showing ADs when their internet is blocked is because they need to make an API call to their own servers before running the AD. That is the common behavior but not mandatory
- pava0 10mo ago
  Wait, we can in Android. In my OnePlus 12 in the app settings under "data usage" there are two toggles for "disable mobile data" / "disable wifi"
  - wafflemaker 10mo ago
    Wow, thought it was GrapheneOS only, but no. Confirmed these settings on One+15 on OOS16 (based on Android 16). Is it also the case for other Android brands? P.S. I did use it before to turn off ads.
    - blauditore 10mo ago
      Google's Pixel phones (near stock Android) famously do NOT have the option.
      - wltr 10mo ago
        Google is invested into you having WiFi all the time. Weirdly, my very old Nexus 6P with the WiFi off, could lie untouched for weeks, with almost no battery depletion. Yet if I turn the WiFi on with near stock Android (meaning no messengers, tens of email accounts, etc, to constantly ping _something_), it just eats the battery within 24 hours tops. Perhaps that’s just the module itself, but I remember flashing LineageOS and having better savings. I have no real numbers to support that right now, although I still have the phone lying around somewhere and could test this some day.
indolering 10mo ago
It's hard to rule out intentional side channels without access to source.
- hunter2_ 10mo ago
  Do you mean a no-internet app (like this) could write data locally in a way that another internet-enabled app (in cahoots) could locally receive? Like a non-sandboxed storage area? Seems plausible.
  - _puk 10mo ago
    Meta literally got caught doing this. Writing to a local server, and then uploading from the browser to bypass consent mechanisms. https://wire.com/en/blog/metas-stealth-tracking-another-eu-wake-up-call https://wire.com/en/blog/metas-stealth-tracking-another-eu-w...
  - ashtadmir 10mo ago
    yes that and internet permission can be added later and pushed with an update. Unless you are checking permissions after every update you will not know.
DANmode 10mo ago
Not alone, but it could prepare a tidy little package for something else to grab later.
ashtadmir 10mo ago
Lacking INTERNET permission today does not guarantee that the app will never have that permission. The internet permission is considered a "normal" permission by android so it will be auto granted without even a notification to the user. Moreover an app without internet permission can still send data out using "INTENTS" for other apps in Android. This can make an app dangerous even without internet permission. I was excited about the application and was dissapointed to see that it was closed source. I will absolutely not trust anyone that I cannot sue with this data. Big companies at least follow some standards that are enforced by multiple governments here we know nothing.

by gruez 10mo ago

nelblu 10mo ago

This is correct, but it is still a slippery slope. At some point the dev ends up adding internet permission (might be for legit reasons too), and lo and behold you are sharing your data. For something as sensitive as notifications, I really can't trust anything but open-source app which is vetted by a few seasoned people and hosted on F-droid.

gassi 10mo ago
Related, GrapheneOS has a handy feature to disable network access for individual apps.
- yonatan8070 10mo ago
  Also non-GrapheneOS Android. I'm on CrDroid (Android 16), ans if I go into "Settings -> Apps -> Some App -> Mobile data usage", there's a toggle for "Allow internet access", and a few more to control network access on Wi-Fi, cellular, background, and VPN.
sallveburrpi 10mo ago
If the permission is added in retrospect wouldn’t you still need to opt in? fwiw i completely agree that oss is the way to go here
- shakna 10mo ago
  The "Internet" permission on Android is one of the no-approval ones. If it gets added, you won't notice.
hsbauauvhabzb 10mo ago
I’m interested in what you’re suggesting. Who are those auditors you trust? Does f-droid imply things have been audited?
- ElectricalUnion 10mo ago
  f-droid implies * that the application is source-available; * toolchain used to build the app is FOSS - application does not use Play Services, or proprietary tracking/analytics, or proprietary ad libraries. * application toolchain doesn't depend on "binary blobs"; Not even passing the sniff test on those easy to meet requirements is suspicious.
hunter2_ 10mo ago
Would a safe alternative (albeit annoying to update) be to side load the apk for the purpose of eliminating the possibility of auto updates brought on by an app store?

malfist 10mo ago

Is that actually required? I thought that was implicit

hn8726 10mo ago
It's automatically granted but the app needs to declare it in order to access internet. Because of that it's not enough that the app _currently_ doesn't request internet permissions, because if it ever starts, it would be mostly transparent to a user
wiseowise 10mo ago
Yes. Without the permission all network requests will just fail.
- IshKebab 10mo ago
  You can silently add the permission in an update though. It's safe if you don't auto-update it I guess.

blauditore 10mo ago

That's another pet peeve of mine: Why the hell can't we block internet access for apps in (native) Android? Everything else is a permission, but this is not, somehow.

hexyl_C_gut 10mo ago
Maybe Google doesn't want users blocking ads from getting loaded.
- ashtadmir 10mo ago
  ADs work via play services so even if you block internet for the app the ADs will continue to work. The reason many apps stop showing ADs when their internet is blocked is because they need to make an API call to their own servers before running the AD. That is the common behavior but not mandatory
pava0 10mo ago
Wait, we can in Android. In my OnePlus 12 in the app settings under "data usage" there are two toggles for "disable mobile data" / "disable wifi"
- wafflemaker 10mo ago
  Wow, thought it was GrapheneOS only, but no. Confirmed these settings on One+15 on OOS16 (based on Android 16). Is it also the case for other Android brands? P.S. I did use it before to turn off ads.
  - blauditore 10mo ago
    Google's Pixel phones (near stock Android) famously do NOT have the option.
    - wltr 10mo ago
      Google is invested into you having WiFi all the time. Weirdly, my very old Nexus 6P with the WiFi off, could lie untouched for weeks, with almost no battery depletion. Yet if I turn the WiFi on with near stock Android (meaning no messengers, tens of email accounts, etc, to constantly ping _something_), it just eats the battery within 24 hours tops. Perhaps that’s just the module itself, but I remember flashing LineageOS and having better savings. I have no real numbers to support that right now, although I still have the phone lying around somewhere and could test this some day.

indolering 10mo ago

It's hard to rule out intentional side channels without access to source.

hunter2_ 10mo ago
Do you mean a no-internet app (like this) could write data locally in a way that another internet-enabled app (in cahoots) could locally receive? Like a non-sandboxed storage area? Seems plausible.
- _puk 10mo ago
  Meta literally got caught doing this. Writing to a local server, and then uploading from the browser to bypass consent mechanisms. https://wire.com/en/blog/metas-stealth-tracking-another-eu-wake-up-call https://wire.com/en/blog/metas-stealth-tracking-another-eu-w...
- ashtadmir 10mo ago
  yes that and internet permission can be added later and pushed with an update. Unless you are checking permissions after every update you will not know.

DANmode 10mo ago

Not alone, but it could prepare a tidy little package for something else to grab later.

ashtadmir 10mo ago

Lacking INTERNET permission today does not guarantee that the app will never have that permission. The internet permission is considered a "normal" permission by android so it will be auto granted without even a notification to the user. Moreover an app without internet permission can still send data out using "INTENTS" for other apps in Android. This can make an app dangerous even without internet permission. I was excited about the application and was dissapointed to see that it was closed source. I will absolutely not trust anyone that I cannot sue with this data. Big companies at least follow some standards that are enforced by multiple governments here we know nothing.