10 ms·
Loupe – A iOS app that raises awareness about what native apps can see
- paulirish 4mo agoWould love this for MacOS as well.
- bethekidyouwant 4mo agoWhat “apps” do you use on a mac?
- VertanaNinjai 4mo agoProbably a ton since macOS apps are literally distributed as .app bundles.
- winstonwinston 4mo agoThough there is a difference what store apps and non-store apps can do. I think is about store apps which are “sandboxed” and have to use public api to request then access information which non-store apps can access without.
- internet2000 4mo agoGoogle Chrome, VS Code, among others
- bethekidyouwant 4mo agoWell “they” can technically “read” anything your user can.
- iancarroll 4mo agoApps installed via the MAS have sandboxing applied to them, so this isn't really true.
- winstonwinston 4mo agoYes but chrome is not from MAS. I have none MAS apps installed because they are simply not available via MAS.
- bethekidyouwant 4mo agoGreat back to my original question which (mas)“apps” do people actually have installed on their MacBook.
- weikju 4mo agoFortunately, if you read the README (and decide to go past the “this was mostly built by AI” part, > Loupe also builds for macOS. The Mac version is mostly complete, but a few things still need work before it's polished.
- heavensteeth 4mo ago> and decide to go past the “this was mostly built by AI” part I got that feeling just seeing the title use "native" as a synonym of "not a website".
- regecks 4mo agoDamn. The "iPhone last setup or erased on ..." is really nasty. What can a user really do about that? I feel like this should be fudged somehow by the OS.
- matthewfcarlson 4mo agoIs the threat model tracking across multiple apps to correlate what you're doing? In that case, a single app wouldn't show you the fudging.
- ramses0 4mo ago```Based on a binomial/Poisson distribution and a baseline of 21 million U.S. device sales per release, a fingerprint relying on "seconds since setup" fails to uniquely identify individuals. In the high-density Early Adopter phase, you will share your exact setup second with an average of 1.01 other people (a total matching pool of ~2 people). Six months into the cycle, you will still share that second with an average of 0.68 other people.``` In the U.S., device setup time (to the second) very conservatively gets you clubbed into a single group of 100 individuals as an "advanced persistent threat" tracker. Even compressing activations to "80/20 during business hours" the math kindof maxes out at a pool of ~5 people, and assuming worst case "20x" of that still means you're still pretty darned identifiable. If you get ~6-8 more bits of entropy (eg: Device Type + Capacity is easily 2-3 bits, and Time Zone is probably another 2-3 bits) you're cooked!
- cute_boi 4mo agoJust using IP address, device storage, device name, and similar signals, we can identify a user. It isn’t difficult to correlate these data points. Apps like Facebook also force developers to use their SDKs for even small features.
- ramses0 4mo agoYeah, but IP address is "obviously" correlated with a distinct/persistent tranche of users. It's surprising that volume c_time is both more persistent as well as more unique than IP.
- ChrisMarshallNY 4mo agoIt's likely to be trolled by the WPA folks, who will insist that WPAs are just as insecure as native apps, so there's no difference ... But very cool.
- njsubedi 4mo agoYou mean PWA?
- ChrisMarshallNY 4mo agoYes. Got my ps and ws mixed up. I was just reading about the Mt. Rushmore project (I was curious whether or not it was a WPA project -it wasn’t, officially).
- RedComet 4mo agoVolume creation date is pretty egregious. I don't see any reason that and Pasteboard changeCount should be so granular. The "Installed Apps Probe" leak also surprised me. It is better than the current state of Android, though.
- xenator 4mo agoPasteboard counter exists to help apps to not ask again about the same item in the buffer. And nothing stops from using reset it every day.
- Barbing 4mo agoWould you elaborate on both points? Any way to reset it as an end user? (Not enough awareness of the issue for search engines to find much.)
- RedComet 4mo agoI think something like a per boot delta added to a (per app?) random base would preserve such functionality.
- echoangle 4mo agoJust generate a new random value instead of incrementing
- api 4mo agoThis is why I avoid installing apps and don’t have a lot of them.
- iririririr 4mo ago...wouldn't it be better to have a pocket computer you own?
- normie3000 4mo agoPhones are quite useful.
- iririririr 4mo agoyour point?
- dylan604 4mo agoIt would be even better if app devs weren't pieces of shit making apps whose sole purpose is to gather all of this data to sell to other pieces of shits while skinning their app as a game or other app to trick users into thinking it's worth installing. Fighting devs being able to make money in this manner is not dissimilar to getting made a drug dealers. As long as users want their product, they will sell the product.
- downrightmike 4mo agoMost people don't know and we are seeing that things get slipped in at a later date
- inigyou 4mo agoOr if every time someone wrote an app that did this, we arrested them.
- throawayonthe 4mo agoif you think "desktop" operating systems aren't even worse on this, you're very mistaken
- Barbing 4mo agoSweet, been wanting this a while. Just mentioned last month and here it is! https://news.ycombinator.com/item?id=48187972 https://news.ycombinator.com/item?id=48187972
- cute_boi 4mo agoApps like TikTok can know which username we logged in with, even if we uninstall and reinstall the app. This is egregious, as many companies like Facebook have SDKs embedded in many apps, allowing them to accurately interconnect user activity. Apple should be ashamed that they aren't putting effort to randomize these fingerprints....
- diebeforei485 4mo agoThis is probably Keychain, right?
- gene91 4mo agoThat’s just keychain. It’s not even fingerprinting.
- OffBeatDev 4mo ago[flagged]
- socalgal2 4mo agoYea, it's infuriating that most of the HN crowd thinks the apps are better then web. Apps can spy on you way more than web. It's the reason every website says "please download the app". If it was better for them to spy on you via the website they wouldn't ask you to download the app.
- yreg 4mo agoThere are plenty of other (better?) reasons why developers might want to push apps. More APIs, less friction selling stuff, business presence right on the homescreen.
- Gander5739 4mo agoAnd people want apps, believe it or not.
- inigyou 4mo agoThey are technically better. They can do more stuff and integrate with the OS better in general. That includes fingerprinting stuff and fingerprinting integration.
- coffeecoders 4mo agoThis is excellent. Seeing this makes me appreciate how much visual awareness tools like this are needed. I built something similar, for the web. https://neberej.github.io/exposedbydefault/ https://neberej.github.io/exposedbydefault/ Github: https://github.com/neberej/exposedbydefault https://github.com/neberej/exposedbydefault
- lencastre 4mo agothis is fantastic, just great really, and honestly makes one stick out so easily, reminfs me a lot of that license plate xkcd
- fragmede 4mo agohttps://xkcd.com/1105/ https://xkcd.com/1105/
- deleted 4mo ago[deleted]
- Cider9986 4mo agoFor anyone without an iPhone or doesn't want to install the app you can see a demo here (same video different platforms): https://odysee.com/@techlore:3/permission-not-required-the-open-source:3 https://odysee.com/@techlore:3/permission-not-required-the-o... https://www.youtube.com/watch?v=_n_SpEWtqog https://www.youtube.com/watch?v=_n_SpEWtqog https://inv.nadeko.net/watch?v=_n_SpEWtqog https://inv.nadeko.net/watch?v=_n_SpEWtqog https://techlore.tv/w/d7dh4P7y4dVngNoL7u7s3B https://techlore.tv/w/d7dh4P7y4dVngNoL7u7s3B
- lencastre 4mo ago/me wonders of the privacy label should actually mention that it reads everything and the kitchen sink!!!
- Forgeties79 4mo agoThis is neat and interesting, truly, but the classic “what now?” emerges. I guess the only answer is “throw out my iPhone”? Otherwise this kind of seems like a circuitous ad to make people get worried and download Psylo, which I see has in-app purchases. I’m not trying to come at you here, but it’s just hard not to feel suspicious online these days.
- Cider9986 4mo agoThe only way to prevent this right now is to avoid installing apps that are doing this.
- Forgeties79 4mo ago“Just don’t use it” only gets you so far and isn’t always an option. Also, as some have mentioned in this thread, many sites now make the mobile experience so painful (or remove key features) so as to force you onto the app. I am against cars for the most part, but I can’t just get rid of my car. In this case, I can’t get rid of Slack (and other apps) because of work and unfortunately I do not work at a company that will buy me a work phone for work things. Ultimately this has to start at a more root level. We need to claw back privacy.
- Cider9986 4mo agoI'm not saying it's not a problem and I understand you have to use some apps. I'm just saying that currently the only way to effectively prevent apps gathering and selling this info is to never install the app in the first place.
- Forgeties79 4mo agoFair enough
- microtonal 4mo agoDon't install apps outside trustable apps that don't embed tracking. Even if you cannot uninstall every app, the fewer you have, the less cross-app tracking. Also donate to and consider installing privacy-conscious alternative phone OSes. They may not have closed all holes (yet), but at least their incentives are aligned with yours.
- nomilk 4mo agoWhy does a random app (with no special permissions given to it) get access to so much info, and why doesn't Apple tell users this (important) info? Why can't Apple make a long list of check boxes so users can dis/allow on a per-category and per-app basis? E.g. I had no idea a random app you install (and give no permissions to) instantly has a list of every app installed on the device (e.g. can infer whether you're dating [or cheating!] from presence of tinder/bumble/hinge). That alone seems instantly monetizable by unscrupulous actors via 'is-my-partner-cheating' as a service: charge $10 to give a probable answer.
- idiotsecant 4mo agoOf all things, this is where you went?
- nomilk 4mo agoOkay it's weird but the first thing that came to mind. Logic: if I can think of a monetisable, nefarious application in 10 seconds, then it stands to reason that very many nefarious applications would be possible with more time/effort.
- backscratches 4mo agoNot just possible, currently being implemented. People are murdered every year using this information. Last year a US politician was assassinated by someone who tracked them by buying this information from aggregator. You thought of a tame use case!
- inigyou 4mo agoWhich politician? I want to read more
- backscratches 4mo agohttps://en.wikipedia.org/wiki/2025_shootings_of_Minnesota_legislators https://en.wikipedia.org/wiki/2025_shootings_of_Minnesota_le... search for 'data broker' in page. Nightmare world we live in.
- VaradD09 4mo agoPrivacy is a real issue! Does the iOS allow an ext dev app to read its system info? If yes, does it easily comply?
- throwaway27448 4mo agoI don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior
- hellcow 4mo agoGrapheneOS lets you restrict the internet access of any app on install. But yes, agreed it should be everywhere.
- Cider9986 4mo agoYeah it asks on app install if you want to grant network permissions. It's just a little checkbox. You can of course manage it afterwards in app settings or permissions manager. They also added the sensors permission.
- backscratches 4mo agoAnd you can limit which contacts you share with nosy app like WhatsApp, and give access to only specific scope of file folders. Horrifying to think all the years every app got everything it wanted and did not have to ask and couldn't be stopped (I had a rooted phone for firewall capability for a while )
- microtonal 4mo agoSee my comment upthread, it helps a bit, but does not close this hole since apps within the same profile can communicate through IPC, so other apps could provide network access on their behalf. I think the best example is probably Play Services, which provides functionality for a lot of apps and will communicate with Google, etc. (Yes, you can disable network access to Play Services, but it sometimes breaks things and the general point of IPC as a hole still stands.)
- deanishe 4mo ago
- deleted 4mo ago[deleted]
- aggregator-ios 4mo agoOne correction to some comments here: an iOS app cannot list all apps that are installed. You can only check for specific apps/schemes (LSApplicationQueriesSchemes) by specifying apps you are looking to query for installation status or open. You cannot provide a large list of unrelated applications since Apple rejects that during app review. Apple added these restrictions because installed app lists can be used for fingerprinting and privacy invasive profiling.
- NietTim 4mo ago> Apple added these restrictions because installed app lists can be used for fingerprinting and privacy invasive profiling. And this was heavily exploited by Facebook before Apple patched it
- nomilk 4mo agoBut a single app can request to know the presence of up to 50 apps, right? And a data broker/aggregator can purchase such data from many (e.g. thousands) of apps and aggregate it, then sell it.
- isodev 4mo agoYes indeed, the limit is 50 which is of course enough to fully profile "regular people" who only have a handful of apps. Also don't forget, Meta/Google/TikTok/WhateverPalantir are updated weekly which means they can tweak their LSApplicationQueriesSchemes list and cover even more apps if they want to.
- ksec 4mo agoAre there legitimate reasons why an App should know I have installed?
- developerDan 4mo agoBack before Apple allowed users to set the default browser I had a feature in my app that presented a list of installed browsers when a user opens an external link, giving them the option to choose where it opened.
- momoraul 4mo ago[flagged]
- jiri 4mo agoIs something similar already available for Android phones?
- nobody42 4mo agoOutdated, but gives the general idea: https://github.com/nandan-desai-extras/PrivacyBreacher https://github.com/nandan-desai-extras/PrivacyBreacher
- 5701652400 4mo ago[flagged]
- cocoto 4mo agoToday I have simply given up trying not to share my personal information. What I do instead is simply blocking all ads and don’t use apps/websites that can’t be used without ad blocking. They may have many personal details like my favorite ice cream flavor but I get zero ads so I don’t care that much (I would prefer no one having this information but I’m pragmatic in such terrible society).
- Cider9986 4mo agoUnfortunately ad blocking is not effective against current cross-site and anonymous user tracking. Fingerprinting is extensively used and can't be defeated without a decent hit to browsing experience. Mullvad and Tor browser are likely the best at anti-fingerprinting. The only completely reliable way to avoid this tracking is by not visiting websites with fingerprinting. A tool that can help with this is LibRedirect which redirects you from sites like Twitter to privacy front ends like xcancel. The extensive web tracking is detrimental to privacy, but it doesn't compel you to add additional PII like phone numbers, which is much worse than cross-site tracking for a surveillance capitalism threat model.
- ChrisMarshallNY 4mo agoI must say, I like the Mysk team, and wish them well; AI or not. It seems a bit quixotic, but anything that goes against $_BIGCORP is tilting at windmills, anyway. Of course, the one narrative I almost never hear, no matter who it is, is "Simply don't collect any extra data." It's that simple. If you don't have the data, your app could be Swiss cheese, and no one can get anything dangerous. But, in today's tech world, data is money, so every app and Web site out there, goes to any length, to hoover up as much data as possible. I regularly get prompted to join "teams," and "leaderboards," or do "challenges," on my solitaire games.
- nekusar 4mo agoYeah what's worse... I have a LG modern TV. Smart shit. I also use a Linux install on a NUC. HDMI. For some godsdamned reason, the TV was able to initiate an IP bridge with the Linux NUC and get an IP address on my network. Nobody typed it in the TV. And I'm unsure how it did so itself. What I do know is that Mikrotik allows DHCP-server blocks of wildcard MAC addresses. Blocked the whole fucking 24 bits of their allocation. AND if it does get back online, I also shitcanned its routing on the IP side based on hostname.
- rationalist 4mo agoThis would be quite the scandal if you can substantiate/document it. People always say, "jUsT dO nOt CoNnEcT your TV to you WiFi" which is asinine. People say that theoretically TVs can get an internet connection through HDMI, but apparently none are actually doing so. The only solution I suggest is physically removing WiFi cards from the guts before turning on.
- chatmasta 4mo ago> theoretically TVs can get an internet connection through HDMI What?! How on earth would this work?
- rationalist 4mo agoIt was introduced in the HDMI 1.4 specification. https://en.wikipedia.org/wiki/HDMI#Version_1.4 https://en.wikipedia.org/wiki/HDMI#Version_1.4
- mastercheif 4mo agoHDMI Ethernet was never adopted or implemented on consumer devices.
- deleted 4mo ago[deleted]
- yashthakker 4mo ago[dead]
- kamyarg 4mo agoHoly cow, did not know ios lets apps access so many finger printable information such as apps installed, last wipe and number of copy actions. Installed the browser as I am confident it will be good also. Thank you!
- ololobus 4mo agoIdk, I actually got the opposite impression. Most of the info is just what I would expect everyone to see: date formats, languages, various webview kind of stuff, network info. This is already more than enough for fingerprinting > information such as apps installed This is what surprised me too, but if you read their hint, it’s not like list API. They probe various ‘open URL in app’ to see what apps registered them, so are installed. I guess this i) won’t allow you to track apps that don’t have ‘open in app’ urls, and ii) probably hard to limit without affecting UX > number of copy actions This is odd, yeah, not sure why is it exposed > last wipe They deduce this from the volume creation date. Probably possible to hide, but also not really that important, at least to me. Fingerprinting will work with way fewer info anyway To summarize, I think iOS is still very solid in terms of involuntary info exposure (if you trust Apple itself). Most of really sensitive info requires separate permissions. Yes, you can harden it further, but that will be more like a paranoid mode
- hrideshmg 4mo agoWonder if there's anything like this for Android? If not, it might make for a pretty fun/interesting side project
- amelius 4mo agoHuh, I was under the impression that Apple protected us against all this through the app store review process.
- feelamee 4mo agoI'm under the impression that Apple abusing this by itself
- phmx 4mo agoOn a tangential point, one thing that should definitely not be possible for apps these days is determining whether you enabled a VPN. AFAIK, it’s possible indirectly in iOS by enumerating network interfaces with specific/telling names.