> everyone knows all the alls on your phone
On Android phones. iPhone doesn’t have this privacy deficiency.
replies(10):
On iOS an app developer will need to register in advance which external applications their app intends to query, and the list needs to be very short and motivated. [1]
Incidentally, “I have a friend who says...” isn’t really a good citation anywhere outside Reddit - which HN resembles more and more each day.
[1] https://www.hackingwithswift.com/example-code/system/how-to-...
Just a different business model, not a display of moral values.
Sure, Pegasus exists but I don’t think it is commodified yet.
Also the bots have not invaded HN, which is a truly massive distinction.
I snorted when I got to the self-important haughtiness about reddit.
Why?
- You immediately recognized what they meant.
- They weren't advancing a claim, they were indicating a basis for their interrogative, likely to avoid seeming naive when claiming it out of nowhere.
- The article we're commenting on describes the same mechanism you claim differentiates iOS. ("register in advance...which applications...intends to query, and the list needs to be very short and motivated.")
- I've worked heavily on iOS and Android since 2009. As close to a graybeard as you can get in mobile. I'm searching, reaching, grasping for any sign you've done anything other than Google and link the first article you saw, and I can't find _any_. At all. But I don't think that's wrong. You're trying. Why is it wrong for the person you asked to try too?
- There's strong signs you didn't read the article we're commenting on.
- If you had, it is unlikely you would have said iOS was differentiated, then laid out the exact same mechanism described in the article.
- There's strong signs you didn't read the article you linked.
- On iOS you can register URL schemes in a plist, these aren't "external applications you intend to query" and the list does not have to be "very short and motivated"
I get cranky too, but, I am grateful I recognize it is very reddit to cry Reddit and edit it out, or delete.
They were using this trick to detect unauthorized apps on the phone.
https://blog.verichains.io/p/technical-analysis-improper-use...
[0] - https://gist.github.com/wh1te4ever/c7909dcb5b66c13a217b49ea3...
What could possibly indicate I didn’t read the article? Of course I read it. Isn’t your assumption of my bad faith also explicitly against HN’s guidelines?
> On iOS you can register URL schemes in a plist, these aren't "external applications you intend to query" and the list does not have to be "very short and motivated"
I’m also an iOS developer- and yes it does.
On Android if they use the work profile (which is the standard method these days) they can only see the apps inside there.
What I laid out, namely, that you described iOS the same as the article, while simultaneously claiming iOS differs significantly.
> On iOS you can register URL schemes in a plist, these aren't "external applications you intend to query" and the list does not have to be "very short and motivated"
> I’m also an iOS developer- and yes it does.
Which part is "yes it does"?
We both can agree quite quickly that URL schemes in a plist aren't "registering apps." You can drag this out a couple turns by playing shell games first by ignoring the URL schemes difference, then by making me do the leg work to show it's trivial to find apps with dozens of apps in that list.
Either which way, I continue to be taken aback by your snarkiness towards the original post and cries of Reddit given you know you were 100% wrong on this.
You're in a really bizarre situation where too much territory was staked out and you're defending it all: you can't claim this was a remotely accurate description and you read the article about Android and iOS is different. It's already a farce, then throw in scolding about how HN is Reddit because of low quality posts...my goodness, my friend.
> Of course I read it. Isn’t your assumption of my bad faith also explicitly against HN’s guidelines?
No, because I said "There are strong signs", I didn't say "You didn't read it."
Also, why would not reading be "bad faith"?
You are extremely focused on making attacks and perceiving them in others, please take a step back and note: "But I don't think that's wrong. You're trying. Why is it wrong for the person you asked to try too?" - you shouldn't have to make up an interpretation where gently chiding you for being rude turns into invoking rules and accusing you of bad faith
A simple thought exercise for me is "Which of these two comments is more Reddit?" - I'd say the one that came with curiosity is HN, the one that bats around half truths combatively and invoking Reddit isn't.
Recently, they released a major update to their LLM feature and I installed the app to check it out. While I had the app installed, every time I checked the mobile website there was a large banner directing me to go to the app. Ad blockers and distraction blockers would not get rid of it. When I deleted the app again, it was gone. What gives? Why does the mobile website know whether I have the app installed? How come content+distraction blockers are enough to block all reminders to use the app when it's not installed, but are irrevocable if I have the app installed?
https://developer.apple.com/documentation/webkit/promoting-a...
You can get rid of them with the Unsmartifier extension.
https://old.reddit.com/r/apple/comments/q55753/unsmartifier_...
The StopTheMadness extension can also remove them (among many other things... this extension is a must have for me):
What evidence is there/can you present that Apple is making use of this information in a negative way?
How can Apple not have a list of installed apps on your phone while maintaining basic functionality (automatic updates, reinstalling apps from backup, etc)?
You could try to communicate with an app via the custom URI scheme and if it succeeded, it would know you have the app installed. Twitter used this for finger printing.
An app has to get a special intent and has to list the apps it wants to use it for.
Regardless, MDM installed app visibility is limited to those users who opt-in to an organization managing their personal device, and isn't an effective way to broadly gather what apps a given person has installed. What's described in this post would work on any user/device, and there's no way to deny/opt-out of specific permissions.
[1] https://developer.apple.com/videos/play/wwdc2021/10136/ [2] https://support.apple.com/guide/apple-business-manager/use-m...
To clarify - the mobile website doesn’t. It has meta tags that tell safari what app it’s tied to, and safari displays associated the app banner.
One of the biggest incentives for creating apps is to scrape all kind of data from the users. Look at how many apps require permission to see you contacts. And how many actually need your contacts to function. That's why I'm still a bit surprised that many seem to be surprised by findings like this one here.
I read a fiction book years ago where there were cameras everywhere. To get privacy, instead of hiding their identities the protagonist paid companies to insert bogus information into the information brokers’ network. So if they tried to figure out where they were on a certain day, 20 records would match. I think this is a much more likely vision of the future.
I think this is probably true of any online community. I’d wager that an online community needs more users to grow and be sustainable, and more users inevitably means more content, and more content means less _high-quality_ content overall.
That is, again, not require but ask for on iphone. I have zero non-functioning apps on my iphone due to denied access to contacts. Even a chinese bluetooth light controller doesn't dare (while refusing to work on android for the same reason).
You can hate apple/iphone ecosystem all you want, but let's not sneak false claims into how they actually work.
If they went beyond that, or disclosed that knowledge, or allowed an app to get that manifest without your permission, it would destroy their brand image built around privacy, in a way that would cause long-term irreparable damage.
They decided to not comply with laws compelling them to add back doors to optional encryption on iCloud storage, rather than tarnish that image, because they know how valuable that trust is.
You can dump on Apple all you want, but compared to Google who plead with people to use their browser and phones to improve adtech surveillance they can monetize, I think they're doing OK and are a lot more trustworthy.
It is so annoying that it’s either "give access to ALL my contacts and ALL their information (yes, even the notes I took on their favorite things for next Christmas)" or "don’t give access". I wish we could limit the number of contacts and the level of information we give.
https://blog.verichains.io/p/technical-analysis-improper-use...
Fun fact from the MDM implementation - the most private way (at least to the company policies) to have a company-connected device is to buy a separate phone and install company's MDM on it. On company provided devices, the company may locate company's assets at any time but doing so on a personal device is a privacy breach.
The reason is that Apple demands that the UPN (the account ID) and the email address are the same. For us this is not the case (our UPN is our employee number as an email address, whereas our email address is just our name). And obviously we're not going to change this for ten thousand users because Apple wants to (most of which don't have Apple devices because we're a European company). Also, you have to manually decide what happens to each user that has already created an account with their corporate email address and what to do with the content they purchased on it. This is not feasible for a large corp. We have commented this to our Apple account manager for years and years but they simply don't care. If you work in this realm you probably know that Apple doesn't really care about things that matter for their corporate customers anyway. The consumer is their main client and it shows (unlike with Microsoft where it's the opposite).
So the whole account-driven enrolment (User Enrolment) as well as everything else depending on managed Apple IDs like DEP for Macs is completely out of the window.
The problem in my opinion is that I as an admin can simply query for example all the employees that have something like Grindr installed. Considering the current political climate in the US (or worse, the middle east where this can lead to a death sentence in some cases) it's obvious why this is super bad. And really, why should we be able to do this at all?
The bad part of this is that apps have to specifically support the multiple profiles option, otherwise they can't be used for this.
And yes, I agree, that is the best way. We have the same restrictions for personal devices. Though I as an admin know we never use the locate functionality (and I know every person who has access to it).
Android has this really well worked out with their work profile. It's like having a company VM on your phone. Really great separation.
But on Apple we can't use a similar option which I admit does exist, but there's too many strings attached (see the discussion above).
Same with storage scopes: one directory and that's it.
iOS added fine-grained (at the contact level) access to contacts data last year.
https://lifehacker.com/tech/you-can-control-which-contacts-a...
Account driven MDM enrolment pushes the Pareto front when it comes to privacy/conveniency compromises from my point of view. I will ask my IT if they have already looked at it.
For example I know Slack still doesn’t use the single picture picker. They still want access to everything.
So iOS lets me limit what they can see, but it’s still a pain compared to just letting me pick the one picture I want.
If you have the self control to refuse to ever check Slack and disable all notifications/etc on your personal phone when not on call, this doesn’t apply as much. But for me I default to trying to stay on things and forcing myself to disconnect is a net good, even if it does mean I carry two phones at times. My pockets are large.