Beware, iPhone Users: Fake Retail Apps Are Surging Before Holidays | Hacker News Reader

Beware, iPhone Users: Fake Retail Apps Are Surging Before Holidays

nytimes.com

78 pointsgnicholas50 comments

Funny, Apple made a fuss earlier this year that they were cracking down on "My First App" type applications, but they let shoddy, fraudulent, poorly translated applications through no problem...

Money talks. It's evident at this point that Apple doesn't really care about the end-user experience anymore.

Can you firm this up a bit? If money talks, why would Apple want to keep crappy apps in the App Store? These apps aren't going to make much at all in the short run for Apple, and in the long run will turn off users. Do you think Apple isn't going to do something about these? Or is it more that they haven't been proactive enough? Something else?

Vetting apps costs money. Why bother? The end-user app rating system will sort it out eventually.

Alternate explaination: verifying this many apps and all their updates/changes is really hard to keep up with.

How is it an alternate explanation? If you hire only one janitor it takes longer to clean the premises. Its not really an explanation when you're sitting on piles of cash.

Assuming hiring and training janitors is instant, and buying them up on a massive scale does nothing to the cost of each janitor, and there is no pressure to accept apps quickly, sure, but that's not the scale world Apple lives in.

I think that's a false equivalence. The devil is in the details with large projects like this.

There will be absolutely no change to the cost of each janitor because the scale is not massive at all. Apple is most certainly not hiring thousands of full time employees for app reviews. In 2009 they had 40 employees spending 6 minutes (at most) on each app.

http://fortune.com/2009/08/22/40-staffers-2-reviews-8500-iph...

There is supposed to be a review process that Apple started on Septemnber 7th which was supposed to clean up the store removing outdated and unsupported apps. Haven't seen any results from this yet. Downloaded apps yesterday that haven't been recompiled for 64-bit and show the popup on startup.

Apps that show the popup aren't planned to be removed - at least not yet. Only apps that crash on launch are being removed outright for now.

FYI - I have had a bunch of apps on the App Store from way back in 2012 that I never updated because I lost interest, or the apps just aren't relevant any more.

Been receiving a steady stream of notification emails from Apple about them, and some have already been taken off the store as a result of my inaction. Not all at the same time mind you - about a week or so between apps.

They are serious about the cleanup, but I expect it will take time to go through the millions of apps on the store.

Interesting. I have an app that most likely needs updating, but I just haven't got round to it. It does provide me with some pocket money so I wouldn't like it to be removed. Did you get some warnings from Apple before they were withdrawn? If so, how much notice time did you get?

I think all up I got the first email from them about a month before they removed it. They explained why they were going to remove the app(s) and the reasons why they did not conform.

For most of them, it was because I had never updated the screen sizes or anything to suit the newer iOS devices, plus used old SDK calls or Ad plugins etc.

Then I got another email about two weeks before. At the same time, the app were flagged on my iTunes Account, and I received 2 notifications (2 weeks before, and on the day of removal) via the iTunes Connect app that I have on my phone.

There was also an email a few months back explaining that they would be conducting this clean up in Sep/Oct.

All up, I believe it was plenty of warning. I just couldn't be bothered to make the changes as the apps were pretty much dead anyway, and there were too many competitive ones that were far better, so I let them kill them off.

There are entire classes of applications that solve real problems that people have. They are aimed at adults, which means they might show a bit of nudity. Those applications are absolutely disallowed by the Apple nanny.

It pisses me off to no end that you can't build those applications, but this stuff isn't caught by their filter.

Facebook and Oculus are together bringing the same misfeature to Android via GearVR.

Please, how much legit productivity software comes bundled with "a bit of nudity"

There are a whole class of applications that solve REAL problems that require "a bit of nudity" that Apple disallows.

Mind giving us examples?

Medical related apps for one.

Thought they existed in the App Store. Either way, I'm still perplexed at what "real problems" would be solved.

Anatomy-learning apps. Medical diagnosis apps. Just because you can't think of a legit reason to use something doesn't mean it doesn't exist.

My point is these apps exist already, in the App Store...

Do they? Apparently I need iTunes to browse the app-store, so I can't check. If so, then how do they get around the ban?

Loneliness and basic human desires are a need. Porn solves a real need in the right situation.

Finding sexual partners springs to mind. Particularly in the poly/swinger communities.

This is my personal problem with the walled-garden approach. If you aren't 100% consistent, you start to lose credibility fast. Everyone knows Android apps are shit, so people are typically wary about what they download. Apple gives the impression that they filter out all the bad stuff, but they don't actually. This, IMO, makes their rules look hypocritical and arbitrarily enforced.

Having dealt with the iOS approval process several times, it is interesting to see that the system has this weak spot. The approval process is known for its stringency (especially compared to the Play Store), but clearly there are some vulnerabilities lurking.

Well, there is an element of confirmation bias. We don't know whether the successful apps represent one-hundredth or two-thirds of the submitted apps. But earlier this year Apple did say it was trying to decrease approval times,[1] maybe quality control took a hit.

[1] https://www.bloomberg.com/news/articles/2016-05-12/apple-sho...

Pretty extraordinary that Apple is letting these through.

And some are blatantly flouting the rules e.g. putting Nike.com as their support website.

Common situation for any closed app store — Google Play has the same fraud apps and most of Chrome App Store extensions are malware.

Neither of those has a review process, though. You just pay a few dollars and can upload whatever you want. Apple's stores do, which is why seeing this many fraud apps is surprising.

Not true, every app on Google Play goes through review. I'm not sure about Chrome store, but I presume it may also likely see review for every app.

Google play does not review each app unless it's done after the fact. You pay a fee and upload your binary and then it's available. My understanding is that they have a permissive model that relies on users flagging the bad stuff and then they pull it from the store after the fact.

You're most likely right. I was under the impression that they just did a basic anti-malware scan on your app, but that seems to have changed back in 2015.

Oddly enough, this doesn't seem to be mentioned anywhere in the Google help pages or Android docs. This blog post [1] is the closest thing to an official confirmation I managed to find.

[1]: https://android-developers.blogspot.com/2015/03/creating-bet...

What possible utility do people get by using a "retail app" rather than the web? Wouldn't the store's website and/or normal shopping websites (Amazon, etc.) have everything that the Foot Locker app has?

Have people been trained or deluded to "always get the app" when it's not necessary?

Depends on the app. For some sellers I prefer apps on mobile because their mobile web experience is shitty or inexistent. An app with good caching is preferable to a web app that spends half of the time re-fetching assets.

My biggest problem with web-apps is that you can select parts of the chrome half of the time.

I mean the successful branded apps provide better convienence than a mobile site, makes transactions faster or provide functionality (loyalty program) over the mobile site. Like the you can argue there is no need for a Domino's or Amazon app because you can do almost all the functionality via their mobile site but their apps have millions of downloads. Brands can just leverage every inch of performance and convince via native apps. Also at the end of the day the end users are the ones that decide how beneficial these apps for them and if they keep them installed on their phone.

When I'm around my house rather than at my desk and I realise I need to buy something I get my phone out and order it using the Amazon app.

For example I could be in the garage, out of engine oil, phone out, scan the barcode on the old one using the camera, oil turns up on my doorstep first thing the next morning, sometimes only ten hours later if I do it in time. Takes literally ten seconds tops.

Not so strange is it? See how it saves time and hassle compared to the laptop?

Also some people use phones and iPads as their primary or only computer. I would guess especially less wealthy or technically literate people. And the apps are often much more accessible than the websites on those devices.

I noticed in your example about engine oil that you didn't download and install the Pennzoil app or the Castrol app :-).

I get your point about the Amazon app if you use it all the time, you're signed up for it, and the workflow in the app is seamless. But the Foot Locker app? For a once a year purchase of tennis shoes?

I'm still thinking that people install these niche apps because they've been indoctrinated into it. Like the way people type "ebay.com" into Google rather than typing ebay.com into the address bar.

An app stays logged in. Typing a long password on mobile is horrible.

In the screenshots, they lead with a huge "40 - 55% off retail prices" which is a very effective way to trick someone into downloading a retail app.

For example do a search for 1010!, generally you will find dozens of identical (maybe a slight different icon) apps all with a person's name as the company. I think they are all the same codebase and run by some kind of white label company. I have no idea how anyone makes money off of so many dupes.

Link only shows "Log in - New York Times" and a login form, flagged.

shows up fine for me.

I use ublock origin and privacy badger, which is probably why

> or even lock the phone until the user pays a ransom

How is it possible?

Yeah, I'm disappointed that they dropped that line in there with zero explanation.

My understanding is that this should be impossible, as it could likely only be accomplished by calling private APIs. Calling a private API gets an app submission rejected automatically (it's caught by a computer, not a human).

>Calling a private API gets an app submission rejected automatically (it's caught by a computer, not a human).

Its rather arbitrary. In a lot of cases it doesn't because the checker is poorly coded. For e.g. if a selector name inside your OWN code clashes with that of a private API (which is not published or even something you should know) it causes the submission to fail. And then people just resubmit and it gets magically approved. People have also reported that it is possible to bypass the checker either using some dynamic runtime trick or figuring out a way to silence private API calls when the app detects its being looked at. (Usual cat and mouse game)

http://openradar.appspot.com/28252227

Thanks, I didn't realize that it was relatively easy to bypass. I did know it primarily relied on string matching, but always thought the solution was to rename your methods when you hit a conflict with Apple's private APIs

Wouldn't this be incredibly easy to discover? If number of published apps divided by account age is greater than threshold, raise review red flag when user attempts to publish new app.

Well you could just cheaply purchase tiny companies who wrote like one app in 2010 and never made any money on it.

Reply on news.ycombinator.com