Hacker News Reader

Comment by tommymachine | Hacker News Reader

And arguably far more necessary. We have our phones turned on and with us almost 100% of the time we are alive. They can track our locations and hear everything we say. It's more important to control what apps can have access to with smartphones than it was on any prior platform.

View on HN

Yeah, a difference between my phone and my laptop is that my phone needs to basically be an appliance: it needs to work consistently in all sorts of situations so I don’t get stranded somewhere in an emergency. For this purpose, having a really strict gatekeeper that limits what apps can do is a feature, not a bug.

  control what apps can have access to with smartphones

But the Play store doesn't do that. It just documents what permissions are sought by the app, not whether this privileges are appropriate... hence flashlight apps seeking Contacts and Location.

Play Store is at the other end of the spectrum where you can literally upload massive amounts of malware and no one bats an eye.

The issue is not that a manual review process should catch bugs. The issue is that Android’s permission system allows it.

It's great that it allows it.

The problem is that a lot of users don't want to admit that they are not competent to decide whether the app truly needs those permissions or not.

If there would be a power user subscription for Android, it'd be great. It'd pay for itself, etc. (Of course purists still could just root the device and so on.)

Who said anything about bugs? The point is to do something proactive to stop apps that don't conform to your policies (whichever they may be - maybe you don't allow collection of data, or using a specific interface, definitely not malware, etc.) instead of just reacting, and even that too late.

Apple is at one extreme blocking even legitimate things for obscure and esoteric reasons. Google is at the other, letting all kinds of crap in the store only to review it later, maybe. [1]

I'm sure my remark ruffled feathers on some Android fans but it doesn't make it less true.

[1] https://venturebeat.com/2018/01/30/google-play-removed-70000...

The point is to do something proactive to stop apps that don't conform to your policies (whichever they may be - maybe you don't allow collection of data, or using a specific interface, definitely not malware, etc.) instead of just reacting, and even that too late.

I’m saying that with millions of apps in the store and seeing that all app testing is black box testing, the reviewers are not going to catch most things. The operating system itself should not allow certain things. There is no reason that most of the permissions that SpyPhone needs should be allowed by Android.

Then to what would you attribute the fact that the AppStore is much better curated than the Play Store? Fewer application submissions? More honest coders?

It's a two part answer probably: Apple's store policies are discouraging some of the unwanted behavior, and the actual enforcement of those policies is stricter. Not just a second though.

Most of the “honesty” comes from iOS and it’s just a better thought out model than Android when they introduce new features.

Ad Blockers - the framework is built in a way that third party ad blockers can be installed but they don’t have access to your browsing history. They basically just submit a JSON file that is integrated into Safari and some types of web views

Third party keyboards - because of the opportunity of keyloggers, you have to explicitly go into settings to install one, then you have to give it permission to access the network as a separate step after a huge warning, and even then when you enter a password, iOS switches back to the default keyboard.

SafariViewController - with traditional embedded webviews, the hosting app has complete access to everything you are doing. The SafariViewController runs as a separate process.

The only way that an app on Android can (could?) know if it should stop playing sound was to ask for full permissions to access your phone state.

Why does any app need full access to my storage like Android allows? With iOS, an app has full access to its own file store in iCloud, you can grant it access to your photo library or music library (read only) but it’s very explicit. Any other document outside of those, the user explicitly tells it what file to open.

Why would I ever give a third party app access to my SMS messages? Why is that even an option on Android?

I download stuff without regard on my iPhone because I know that it can’t do anything crazy.

Even if SpyPhone didn’t go through any review process, it’s a track surface is limited on non jailbroken iOS devices.

> Most of the “honesty” comes from iOS and it’s just a better thought out model than Android

That's essentially what I had to say. Apple enforces these policies - and sometimes will go overboard. I still very much prefer it to what Google does where as a user I feel they are completely neglecting to "take my side". I am not their valued customer, I am just a source of personal data.

And yet open source solutions seem way less popular on mobile than their desktop equivalents.

Seems more like a justification for passive acceptance to me.

Since PRISM, we know the players you really don't want to be able to track your location have a backdoor in those systems anyway, and the manufacturers are forbidden by law to talk about it.

It's annoying that candy crush get a piece of your private life.

But it's nowhere close to the problem of big entities that already have a huge control on your life to be able to know everything about you while you can't know anything about them.

The app store is just a symptom of it though, and a small one.

My phone is on and with me for less than 50% of the time.

Just saying; phones are not as important to everyone as you think.

(yes, I am over 40)

Good for you. Unfortunately, your personal habits aren't really relevant to the global impact of these policies.

I'm sure you probably "haven't owned a TV in 10 years" and wonder "do people still watch TV".

Yes that was a popular post on Slashdot years ago.

Why would you be sure of that? As it happens, I have a TV and watch it every day.

In fact, research (in the UK) suggests that people who use phones less are more likely to watch TV than people who use them a lot.

It wasn't my intention to "boast" that I don't use a phone much. The post I responded to was making a point based on the assumption that "we" have our phones on 100% of the time. I was just trying to point out that there are people in that "we" for which that is not true.

Reply on news.ycombinator.com