←back to thread

Everyone knows all the apps on your phone

(peabee.substack.com)
1192 points gniting | 1 comments | 29 Mar 25 21:26 UTC | HN request time: 0s | source
Show context
captn3m0 ◴[30 Mar 25 02:37 UTC] No.43520750[source]▶
The ACTION_MAIN loophole has been written about before: https://commonsware.com/blog/2020/04/05/android-r-package-vi...

Google refuses to patch this. I wonder what would happen if you submit it to the Android VDP as a permission bypass.

There’s also this SO question by the author about the bypass: https://stackoverflow.com/q/79527331

replies(5): >>43520922 #>>43521144 #>>43521275 #>>43522877 #>>43525081 #
3abiton ◴[30 Mar 25 04:13 UTC] No.43521275[source]▶
> Google refuses to patch this.

That's why projects like XPL-Extended (and previously XPrivacyLua), are an absolute need. I never run an android phone without these.

replies(2): >>43522389 #>>43524918 #
ignoramous ◴[30 Mar 25 08:21 UTC] No.43522389[source]▶
XPrivactLua and other XposedMod/Magisk extensions break open the app sandbox. It is better to restrict running those on usereng/eng builds (test devices). For prod builds (user devices), I'd recommend using Work Profiles (GrapheneOS supports upto 31 in parallel) or Private Spaces (on Android 15+) to truly isolate apps from one another.
replies(4): >>43522525 #>>43523196 #>>43523377 #>>43523961 #
v1ne ◴[30 Mar 25 11:06 UTC] No.43523196{3}[source]▶
The question is: Who is the beneficiary of the app sandbox? Is it you, the user, because no malicious processes can taper with your apps? Or is it the corporations, because they prevent you from modifying their apps – which makes you a pure consumer?

I think, for the tech-savvy, the latter is more accurate and I think it is very important to be able to crack open these sandboxes and tinker with processes. Be it to inject ad blockers, automate them, modify their appearance, etc. It should be a right of a user to be able to do these things.

replies(2): >>43523395 #>>43524349 #
ignoramous ◴[30 Mar 25 14:10 UTC] No.43524349{4}[source]▶
> I think, for the tech-savvy, the latter is more accurate and I think it is very important to be able to crack open these sandboxes and tinker with processes

Anyone tech-savvy that wants to mod their Android (like they'd mod Linux distros), should consider purchasing Android devices (like Pixel) that support ownership transfer (that is, unlocking then relocking the bootloader), and flash CalyxOS/GrapheneOS usereng/eng builds.

replies(1): >>43552383 #
1. 3abiton ◴[01 Apr 25 23:30 UTC] No.43552383{5}[source]▶
Undortunately the trend set by google is becoming extremely antagonistisc for modders. It's becoming a tradeoff between security and convenience, arguably that was not the case back in early android version, actually it was nearly the opposite. i remember hiw CyanogenMod features were surpassing the state of Pure Android at the time, it was fun to see the innovation happening in that space. Then came the ostracization of modders, from GApps restrictions to Play Integrity, all of those made it nearly impossible to have an android OS built to your taste, while able to run useful apps like banking and payments. It's sad that I have to carry 2 devices with me because Google took the greedy way.