[xiaomai]

Native phone apps give me the creeps. I assume the developer's are able to track me in various ways even without my giving permissions. Is that an unfounded fear on my part?

Can an app uniquely identify me if I don't give it control over my phone number / nearby devices?

Can apps geo-locate me if the location permission has not been granted? (seems like they could just make a network request to their servers and use the IP address of the request for a rough idea).

I _really_ wish using the network was a permission (even if it was an "advanced mode" thing).

[Flere-Imsaho]

Android 15 supports Private Space [0] that is essentially a separate profile you can install apps into that you can put to sleep. Basically I put all low trust apps into it, but can still access easily enough.

[0] https://support.google.com/android/answer/15341885?hl=en

[bashkiddie]

The web page says Private Spaces can hide an app from the user.

What I want to do is hide my address book and gallery from the app.

[sadeshmukh]

To the best of my knowledge it acts as an isolated profile entirely.

[Flere-Imsaho]

Precisely, it creates a whole new Google account.

[throw4039]

Network is a permission on Android, it's just that phone manufacturers and likely Google don't want you to be able to control it. Most custom ROMs, including GrapheneOS expose it properly, often at the install dialog.

[lsaferite]

They really should just let me spoof all the permissions and associated data for apps if I don't want them to have the access.

[Zak]

Some time ago, I used a module for Xposed on Android called XPrivacy which did exactly that. Yes, creepy app, you can have my location. It's Antarctica.

It does look like Xposed has successors, but my current approach is to just be selective about installing apps.

[lsaferite]

I use netguard and forbid network access by default for all apps. Mildly annoying for apps that need network access as I have to approve, but it's worth it.

[ghtbircshotbe]

The vast majority of apps need to use the network, at least sometimes. Eg turning network on to download podcasts then off to listen to them is annoying.

[lsaferite]

Depends on what apps you are installing. I love denying access to the network for games. It removes almost all ads from them. Even beyond full deny access, NetGuard gives you a lot around the conditions in which an app can access the network. I'd prefer if I didn't have to do any of this and the OS was on my side though.

[whs]

On an unrooted Android you could use App Ops to do some of that with Shizuku.

I assume they don't expose it to users because once most people start to do that apps would start to implement detections, like if it spoof your location to a certain area then that area will get you "permission denied" error anyway, or I believe some apps do check that if your contact book is empty it assume you didn't give the permissions. It'd become a lot of work to implement a convincing spoof for most permissions to be blocked.

[TrianguloY]

On play store you can see the permissions that an app uses and they are grouped by category. Have full network access is set in the "others" category, same as notifications and vibration. This is a category where (supposedly) permissions are automatically granted.

But to be honest, other similar dangerous permissions like "view network connections" and "receive data from internet" are also there, categories are for "camera", "microphone" etc.

I suppose that the average user is more concerned about specific features, and since basically almost all apps require internet it may be there to avoid noise. Still, an "internet" category would have been nice...

[tavavex]

The reason why internet access/downloading from the internet isn't a "major" permission is that asking about it would let people conveniently disable it for any offline apps with ads in them to remove the ads. Google doesn't like that, obviously. Of course, you can still disable your wifi/mobile data connection entirely, but it has friction that most average consumers won't trouble themselves with. But if the app asked if you wanted to give it internet access on launch, Google's ad revenue would probably be visibly affected.

[Animats]

"Network" is too broad. What you really want for most apps is "can only talk to its home domain from which it was downloaded".

[velocity3230]

Then they'll just set up a proxy on their home domain.

[jampa]

In the beginning of Android / iOS, just installing an app and registering was enough for the company to get your device's MAC address and thus your indoor location with accurate precision.

They could access your Wi-Fi network's BSSID (whose location is often public due to wardriving databases), and in public places, they had partner companies (malls, airports, etc.) whose routers would triangulate your position based on Wi-Fi signal strength and share information like "John is in the food court near McDonald's."

All of this happened without you even needing to connect to their Wi-Fi, because your phone used to broadcast its MAC address if the Wi-Fi was simply on. But now your MAC is now randomized, but it took a lot of time for Google / Apple to this.

[fluoridation]

What do you mean? The MAC address is used to identify the device within the same network segment. A program running on the device cannot derive location information just from the MAC address. It's a meaningless number. What the MAC address can do is make you visible to other devices in the same network segment. So for example, a wireless router can know you're nearby because your known MAC address has joined the network, but this is a problem regardless of what apps your phone is running.

[sampullman]

That's what the GP was saying, I think. Once they get the MAC address, they can find you. Not via software on the phone, from exfiltrating and using shady third parties that collect data from access points, etc.

[fluoridation]

Okay, but if there's collusion between the app developers and external routers then it doesn't matter if the MAC is randomized. The app can still see the current MAC address and report it, and you can still be located, if nothing else, to within the range of a wireless router. Nothing is solved by randomizing the MAC address.

[antonvs]

They started randomizing MAC addresses for privacy reasons, particularly for mobile devices, to prevent tracking of devices across networks.

[fluoridation]

I understand that. I'm saying it has nothing to do with apps on the device itself using the MAC for location.

[m463]

> Is that an unfounded fear on my part?

no. especially with the value of data. Many apps just link into some advertising sdk that does anything it can get away with.

and it is unfortunate that people are shamed for being conservative (want a tinfoil hat?)

[disambiguation]

Netguard solves this, available on the play store and F droid

https://netguard.me/

[Flere-Imsaho]

Pro tip: use the fdroid version as it allows you to set a host file to also filter ads, etc.

https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md

[aceazzameen]

Netguard is fantastic. I even use it on my Sony android TV to block everything except for a few streaming apps.

[evilduck]

Netguard is amazing but I'm convinced the dev is mildly colorblind and unaware of it. The color choices and even optional themes are... something.

[lsaferite]

I love netguard. Some apps refuse to work without network access, but most work fine. The lack of ads is great.

[n4bz0r]

How does it work without root? Any app can just block other apps from connecting to the internet?

[jeroenhd]

An app can use the VPN API to intercept network traffic. This is all done with plenty of security popups (one to inform you an app is trying to register as a VPN, the another popup when it's first activated, and the while it's active there's a permanent notification that says "your connection may be monitored" with a quick button to kill the VPN).

The API is supposed to let apps do things like "route intranet/corporate app traffic over a VPN, let other traffic go through", but you can just as easily use it to drop traffic destined for certain addresses (such as ad servers), or to drop all traffic for specific apps. It's also possible to make decisions like "let this app connect to the internet on wifi but not on data".

It should be noted that system applications (phone OS, Google, sometimes carrier apps) can bind to specific network interfaces bypassing this API entirely. This means you can't use this API to 100% block internet access to preinstalled apps, even though apps will need to explicitly implement networking code to bypass such firewalls.

It should be noted that Google doesn't really like apps abusing the VPN API like this, in past because of the massive privacy risk. Google cut a bunch of these apps from Google Play, though there's not much they can do about APKs you download from F-Droid or github.

[ignoramous]

> should be noted that Google doesn't really like apps abusing the VPN API like this

Not really.

   Only apps that use the VpnService and have VPN as their core functionality can create a secure device-level tunnel to a remote server. Exceptions include apps that require a remote server for core functionality such as:

  - Parental control and enterprise management apps
  - App usage tracking
  - Device security apps (for example, anti-virus, mobile device management, firewall)
  - Network-related tools (for example, remote access)
  - Web browsing apps
  - Carrier apps that require the use of VPN functionality to provide telephony or connectivity services.

https://support.google.com/googleplay/android-developer/answ... / https://archive.vn/KY51z

> It should be noted that system applications (phone OS, Google, sometimes carrier apps) can bind to specific network interfaces bypassing this API entirely

Whilst this is true for Android (connectivity checks bypass VPNs, as do VoWiFi and Hotspot traffic) [0], other OSes are known to do the same thing: https://news.ycombinator.com/item?id=24838816

[0] https://github.com/celzero/rethink-app/issues/224

[jeroenhd]

Google will allow firewalls, but not selective firewalls: https://www.theregister.com/2022/08/30/google_play_vpn_rules...

Their official policy (can't find the up-to-date link because Google's documentation bitrots faster than any other website on the net) over at https://archive.is/OPg2g clearly stated:

    The VPNService cannot be used to:
    
        •Collect personal and sensitive user data without prominent disclosure and consent.
        •Redirect or manipulate user traffic from other apps on a device for monetization purposes (for example, redirecting ads traffic through a country different than that of the user).
        •Manipulate ads that can impact apps monetization.
    

Google has also removed/threatened to remove prominent firewall VPNs for bullshit reasons (claims that apps violate random policies), though that may just as easily be random Google bullshit fallout every Android developer needs to deal with.

> Whilst this is true for Android (connectivity checks bypass VPNs, as do VoWiFi and Hotspot traffic) [0], other OSes are known to do the same thing: https://news.ycombinator.com/item?id=24838816

You're right, of course. Unless you own the kernel on every SoC running on your system (including the modem), you should always assume there's a possibility of network traffic leaking through firewall APIs.

On Android specifically, though, there is a significant chunk of users that will want to restrict the built-in apps because carrier-installed apps or shady Chinaware that come with cheap phones cannot be disabled by default. Other platforms usually don't have this type of malware baked into the OS in a way that cannot be removed. Apple's questionable privacy decisions are a lot less worse than what some people try to block with these firewalls.

[ignoramous]

> Google will allow firewalls, but not selective firewalls: ...

These exceptions have been in place since before 2022. Discussion at the time: https://news.ycombinator.com/item?id=32637193

> Google has also removed/threatened to remove prominent firewall VPNs for bullshit reasons (claims that apps violate random policies) ...

I co-develop one such open source "firewall app" for Android, and you're right that apps like ours have been previously removed for blocking ads out-of-the-box. But, removals also happen due to stricter rules/policies that apply to apps using VPN APIs.

Note that, of late, many a popular apps ad-blocking out-of-the-box (like the DuckDuckGo browser with app tracking protection) haven't been removed.

> Unless you own the kernel on every SoC running on your system (including the modem)

I get your point but don't think even a rooted (supervisor) Kernel gets you much guarantee as there always could be a higher privileged hypervisor controlling it.

> Apple's questionable privacy decisions are a lot less worse

They've improved post Celebgate yeah, but the duality is such that... Apple is one of the largest buyers of user data aka "market intelligence" (per folks I know who work in this domain) that (presumably) these other shady apps collect.

[n4bz0r]

Neat, thanks for the explanation!

Given it's a "VPN", would it work alongside real VPN?

[rjdj377dhabsn]

The app takes up Android's only VPN slot, but some like RethinkDNS have VPN support built-in, so you can still connect to another actual VPN.

[jeroenhd]

No, not generally. A firewall app could include an OpenVPN/WireGuard/etc. client to serve both purposes, but by default you'll have a hard time getting more than one VPN app to work at the same time.

[ivanjermakov]

> Can an app uniquely identify me

Even browsers can identify* you, if they really want to.

*not as cleanly though, could be tricky for fingerprinting to track one user across different devices/browsers/netowrks.

Recent discussion on fingerprinting: https://news.ycombinator.com/item?id=46016249

[snthd]

Facebook & Yandex used apps to correlate browsing sessions to the app user.

https://localmess.github.io/

[noman-land]

Simply your IP address can be used to track you so any app or website you visit knows roughly where you are with every http request unless you use an always on VPN. It can also fingerprint you in various ways without the need for any special permissions.

[xiaomai]

Agree with you about fingerprinting (also a bummer). I guess the difference here though is that I must be actively engaging with a website in order for it to be tracking me, but an app (I assume) can be tracking me basically whenever it wants.

[raw_anon_1111]

An app on iOS doesn’t just run constantly in the background unless it’s playing sound or using the GPS. For almost everything else you can explicitly turn off “allow background refresh” on a per app basis

[bji9jhff]

Then the VPN provider does geolocation instead and get the list of hosts you accessed

[noman-land]

At the very least the VPN provider promises not to and their reputation depends on their not being caught doing this. Whereas your ISP and various sites you visit will already be collecting this data no matter what.

[ChrisMarshallNY]

iOS always asks for permissions. I suspect the same is true for unrooted Android.

But the general pattern is that you install some stupid vendor crapplet, and the first thing it does, is ask for every permission on your phone. Native apps can access a lot more stuff than ones restricted to a WebView sandbox. That's why they want you to use them.

No thankee.

[raw_anon_1111]

Exactly what do you think an app can get off of your device that a website can’t without your permission?

[ChrisMarshallNY]

I write native apps.

They can "fingerprint" devices more easily. They have access to all kinds of subsystems, like Bluetooth, NFC, gestures (at low level), etc. Many require the user to give permission, but the first thing the app does, is ask for permission. As long as the statement in the request passes Apple muster, the app won't fail review, I seriously doubt that Apple will test after the app has shipped, to make sure that they stick to their word.

Some of this can be caught by the App Review process, if they do things like access private APIs, but we keep reading about clever app developers (and there are a lot of really smart crooks out there) that can fool the App Review testers. I read about a dodgy app that detected when it was in review, and modified its behavior (ala Volkswagen).

Really, I am not sure if there's a way to ensure the app works the same after review, than during. I would probably put a 4-day timer on it, starting the day of submission. After the timer expires, the app starts accessing private APIs via a hand-coded assembly interface. I would hope that Apple has already thought about this (It wouldn't be too difficult to test -just run it on a device with an advanced clock).

[raw_anon_1111]

> They can "fingerprint" devices more easily. They have access to all kinds of subsystems, like Bluetooth, NFC, gestures (at low level), etc. Many require the user to give permission, but the first thing the app does, is ask for permission

Bluetooth

https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetoo...

Accelerometer

https://developer.mozilla.org/en-US/docs/Web/API/Acceleromet...

So it’s a great conspiracy that apps have permission to do things after you explicitly give it permission?

No one is claiming that the app review process helps protect your privacy. The challenge is find something a native app can do surreptitiously to track you more than a website without you giving it permission bypassing OS safeguards.

And on iOS an app can’t access your NFC chip without you giving it permission.

[ChrisMarshallNY]

Not just the NFC chip. Almost every I/O system requires explicit permission.

That’s where a “social engineering” approach can be helpful. The permission request can be quite bland, to a non-technical person.

And yes, a native app with the program counter can definitely do stuff a Web site can’t. Run machine code, for instance.

We would hope the app sandbox is good enough to catch it.

[raw_anon_1111]

Which permission is bland on iOS?

“Running machine code” is not a security vulnerability. If your browser isn’t secure all sorts of exploits can happen from a web browser. That’s how a lot of the early iOS jailbreaks worked.

[encom]

>Is that an unfounded fear on my part?

Given the security record of app stores, probably not.

[beAbU]

Are you not exposed to all these things via a webpage as well?

[frizlab]

They can track you on a website perhaps even more reliably than on an app, at least on iOS…

[galleywest200]

The difference is I am not carrying around my desktop computer, the location data stays static.

[raw_anon_1111]

You realize that if you are concerned about apps tracking you without you explicitly giving it your location, a website could do the same since there are browser APIs that can retrieve the same information only gated by the same OS controls?

When you go to a website, they have always known the originating IP address.

[rejhgadellaa]

Not entirely true. Browsers are paranoid by default (because visiting a website is as easy as clicking a link). Operating systems aren't (because the user explicitly installed an app, it's been "vetted" by app store experts, and because... well, the OS vendor wants you to build native apps and not a website, so they have to make it worth the extra trouble of building a separate app for each platform instead of one website that works everywhere).

Also, browsers tend to bring their own sandbox (on top of what the OS already does). For example, Chromium was able to mitigate Meltdown/Spectre before OS vendors shipped an update (except on iOS where browsers can't bring their own engines, so iPhone users had to wait for Apple to ship an OS update...)

[raw_anon_1111]

Again why would you think Apple the browser maker would be any more or less careful about Safari not allowing websites to access your camera, GPS, photos than Apple the operating system maker?

No one thinks that app review is what stops malicious apps from circumventing permissions. It’s the operating system itself.

And you really don’t want to compare the state of iOS updates to the state of Android updates do you?

[doctor_radium]

Better (?) browsers also have an internal switch to disable location.

[raw_anon_1111]

Controlled by the same company that wrote the OS in case of Chrome on Android and Safari on iOS. If you don’t trust the operating system to do the right thing on the OS level why do you trust the same company to do the right thing in the browser?