this post was submitted on 29 Mar 2025
71 points (96.1% liked)

Privacy

1809 readers
105 users here now

Welcome! This is a community for all those who are interested in protecting their privacy.

Rules

PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!

  1. Be civil and no prejudice
  2. Don't promote big-tech software
  3. No reposting of news that was already posted
  4. No crypto, blockchain, NFTs
  5. No Xitter links (if absolutely necessary, use xcancel)

Related communities:

Some of these are only vaguely related, but great communities.

founded 4 months ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
71
Everyone knows all the apps on your phone (peabee.substack.com)
submitted 1 week ago by [email protected] to c/[email protected]
24 comments fedilink hide all child comments
 

Since 2022, with Android 11, Google removed this access from app developers. Under their new package visibility policy, apps should only see other installed apps if it’s essential to their core functionality. Developers must also explicitly declare these apps in the AndroidManifest.xml file - a required configuration file for all Android apps.

For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps.

I don’t use Android as my primary phone, but I have a spare one and I was really curious to find out which apps from Indian companies had checks to see what other apps I had installed.

So I downloaded a few dozen Indian apps I could think of on top of my head and started reading their manifest files. Surely they will be respectful of my privacy and will only query apps essential to their app's core functionality? πŸ™ƒ

top 24 comments
sorted by: hot top controversial new old
[–] [email protected] 6 points 6 days ago (2 children)

Privacy Breacher hasn't been updated in four years and is still able to list all the apps on an Android device without any permissions.

PrivacyBreacher is an Android app built as a proof of concept for a research article describing the privacy issues in Android. This app can access the following information from your phone without requesting any permissions: Figure out at what time your phone screen turned on/off. Figure out at what time you plugged in or removed your phone charger and wired headphones. Figure out at what time you switched on/off your phone (i.e., it captures the device uptime and ACTION_SHUTDOWN broadcasts). Access most of your device related information like your phone model, manufacturer etc. Keep track of your WiFi/Mobile data usage. Get a list of all the apps installed on your phone. Construct a 3D visualization of your body movements.

[–] WhyJiffie 4 points 6 days ago (1 children)

checked the code and it just queries the package manager as usual.

it works because the system tries to maintain compatibility with apps made for older android versions (targetsdk). this app was built for api 29 (android 10), and the query apps permission gating was introduced in api 30 (android 11)

https://web.archive.org/web/20250331021341/https://support.google.com/googleplay/android-developer/answer/10158779?hl=en

the play store is strict about the min targetsdk allowed for new apps and updates, and while that is also a negative thing, api 29 cannot be targeted anymore for apps: https://web.archive.org/web/20250331021653/https://developer.android.com/google/play/requirements/target-sdk

[–] [email protected] 1 points 6 days ago

Good to know! I did see the "built for an older version of Android" warning in F-Droid. Thanks for your research!

[–] [email protected] 3 points 6 days ago

Yikes. This seems such a big privacy concern, what an embarrassment from google.

[–] [email protected] 2 points 5 days ago

This is why we Foss

[–] [email protected] 3 points 6 days ago

Android and privacy are incongruent.

The reasons the article gives are because android chooses not to be an intermediate.

[–] [email protected] 2 points 6 days ago

Everyone except me of course.

[–] [email protected] 22 points 1 week ago (2 children)

GrapheneOS will fix this with App Communication Scopes

https://grapheneos.social/@GrapheneOS/111359936037411368

Once it's ready and deployed, it will not only restrict IPC, but also app visibility

[–] [email protected] 6 points 1 week ago (1 children)

I guess profiles also help?

[–] [email protected] 2 points 1 week ago

Yeah. You can use the Private Space or a work profile as well.

[–] [email protected] 3 points 1 week ago (2 children)

Is there an update since that post in 2023?

[–] [email protected] 1 points 6 days ago

They're basically not working on it anymore it seems https://grapheneos.social/@GrapheneOS/113973056128380064

[–] [email protected] 2 points 1 week ago (1 children)

There have been multiple updates, but I can’t find them because the search feature on Mastodon sucks. I also picked this post, because it includes a screenshot.

[–] [email protected] 2 points 1 week ago (1 children)

What's the summary. Is it likely to come any time soon or is it pretty tricky to implement?

[–] [email protected] 3 points 1 week ago (1 children)

It's definitely tricky to implement, which is why they don't provide a time estimate. But they're working on it.

[–] [email protected] 2 points 6 days ago* (last edited 6 days ago)

The last I saw they basically canceled because its too hard to implement. They may look at another way to implement it through profiles similar to the the work profile.

Edit: https://grapheneos.social/@GrapheneOS/113973056128380064

[–] [email protected] 12 points 1 week ago (1 children)

Fuck Substack and their Nazi enabling

[–] [email protected] 9 points 1 week ago (1 children)

I didn't know this ☹ A shame, this is a good article. Would mirroring the text off substack help? (with credit to the original writer of course)

[–] [email protected] 5 points 1 week ago (1 children)

idk what that person imagines you can do. HN is also uber right wing run but has awesome posts.

[–] [email protected] 1 points 6 days ago (1 children)

HN? Hacker news?

[–] [email protected] 3 points 6 days ago (1 children)

yes, my point is the medium doesn't make the content bad.

[–] [email protected] 2 points 6 days ago (1 children)

I agree. I just wasn't sure what HN was. I didn't realize that it's usually right wing.

[–] [email protected] 3 points 6 days ago

The head of the company certainly is alt right, I think it’s more subtle with the common users. I was unaware until recently too

[–] [email protected] 10 points 1 week ago

I just had a look through my apps, surprisingly all of my apps are well behaved minus the banking apps