Hacker News Reader

Comment by aorth | Hacker News Reader

Remember in 2014 when the Android Twitter app started sending a list of all your installed applications back to Twitter? https://news.bloomberglaw.com/privacy-and-data-security/twit...

Ever since then I refused to install native versions of apps that could be used in a browser. I don't use Facebook or Instagram so I don't know if that works anymore, and I recall testing that they were intentionally crippling Facebook Messenger at one point.

Then the past decade of native apps requesting tons of permissions and users just clicking agree. Why should Facebook be able to read my Wi-Fi network or Bluetooth? Of course there is something shady going on. Beacons tracking people walking around brick and mortar stores. https://en.wikipedia.org/wiki/Facebook_Bluetooth_Beacon

Such a shame because native apps are so much more pleasant and performant to use than web apps.

View on HN

> they were intentionally crippling Facebook Messenger at one point [in a browser]

They were/did. I was using Messenger Lite for a bit which was ok, but they killed that and the mobile browser mode.

I still need FB for some events and contacts, but I refuse to have the fat messenger app installed so now I end up using the damn thing in desktop mode which is ... painful.

All I seem to see in my feed these days is "suggested for you" so it's a lot less addictive than it was back in the day. Not sure why they're so determined to drive the user base away, but that does seem to be the plan.

Web apps have been sabotaged so severely for years now, and it really peeves me. Half the time they bombard the UI with "use the app!!1" popups and the other half of the time they just don't work.

The worst part is that a lot of native apps these days are just web views. You can't even be bother to use the native UI toolkit and you expect me to download your app? If this is just safari with extra steps then let me use safari!

I like using ublock origin since I can create filters for those popups.

It stuns me that eBay is so determined to get you to use the app that they will divert someone who has landed on the site and started typing a search term presumably with the explicit intention of buying something in order to sell them on the idea of installing an app instead!

Just ... let me give you money without interrupting me ... please?

Yes, it's the same thing I see with logins. How many more sales could we be making if we didn't require a user account? A lot, I would imagine. Most people are going to be seeing your site for 5 minutes, buy what they need, and then get a confirmation email. That process should be something you're optimizing for - but evidently, the promise of juicy data is more important than actual sales. Hopefully that user account is worth more than a few cents!

Exhibit A: parking apps. Why do I need an app? And why do I need an account? What if I just... don't pay? How many people are doing that? Probably a lot.

So let's spin up a contract with a local towing company and burn all this money for non-compliant customers instead of just getting our heads out of our asses and streamlining the process. I bet you if you just put a tap-to-pay meter then 99% of the non-compliance will just - poof - disappear.

I felt a prude at the time but eschewed native apps for browser versions and haven't regretted. Didn't benefit from notification distraction anyway. Apple and Google just didn't get their houses in order to be taken seriously.

If it ain't on F-Droid, I'll wait.

There is another can of worms hidden in plain sight right here, I feel like.

From the article:

  You’re not affected if (and only if)
  You access Facebook and Instagram via the web, without having the apps installed on your phone

This is only what's observably true of a particular app under the hood from straightforwardly jacking into it with Frida or performing any other deeper analysis.

What's to say Meta/Google/OtherAnalyticsCorp/OtherMegaCorp hasn't already, on a large scale, colluded with[bought out] app developers to simply share session data out-of-band as another tentacle?

Rather, is it even reasonable to assume they all haven't been doing this all this time? (Maybe these also fall squarely under what GDPR, DSA, and DMA were supposed to mitigate? I'm not an expert here.. just my cynicism kicking in.)

I too go through fairly great pains to try to minimize unneeded apps on my device.

Indeed. I read elsewhere that some Android manufacturers even ship with Facebook bits that don't show up in the app listing and cannot be removed.

We desperately need a viable open hardware / open source OS competitor in the phone space.

> We desperately need a viable open hardware / open source OS competitor in the phone space.

It already exists. Sent from my Librem 5.

>I refused to install native versions of apps that could be used in a browser.

Same. After AT&T force obsolesced my perfectly working phone back in February 2022 (it had the bands but they simply didn't want to support it!) I kept it as a dedicated app phone. No web browsing, no stored credentials or cookies, just an app sandbox. Sending a ray of diarrhea to companies who force us to use apps instead of web. I'm looking at you, Chipotle.

this is still perfectly legal and allowed.

every app can scan your apps and recently opened ones "for security".

same for your contacts.

whatsapp (only meta product i need to touch in our fleet) will do both at very fast intervals, and upload a contact list diff if it detect changes.

the whole issue here was that meta bypassed the user matching on the web without paying google "cookie matching" price

"Legal" is missing the point by a mile and is irrelevant.

ok, get the point of being enraged by the one thing while ignoring the same other 4 things that are above board and do the same thing

It is just that I expect applications to behave well. I am not a fan of mobile OS because they have a bad security model in my opinion. It sets wrong incentives with trying to mitigate badly behaving apps. That other forms of software environments are possible is empirically proved but another topic.

If an app does everything it "legally" could, it would have become malware long before. The principle of that argument is quite similar to that of poor mobile ecosystems we sadly are subjected to. Of course other factors were as important to create these "security" models.

I also think that this plainly isn't or wasn't legal in any jurisdiction because Twitter lacked informed consent if this particular case ever got in front of a judge.

That Twitter isn't the only guilty party is true, like we know from the article.

It's so obnoxious that whatsapp refuses to function if you don't let it scan your contacts.

I genuinely think that should be illegal.

I‘m using it without sharing my contacts on iOS

I wonder if it’s improved recently. I’ve been cursing at Facebook for years for holding hostage the ability to create WhatsApp group chats when I’ve declined to expose all of my contacts to it, but I just checked again and there’s a “Skip” button now that proceeds to the phone number UI.

That's purely down to iOS's contacts API not telling apps if they have full access to contacts if you refuse or supply a subset. Genuinely wish android's APIs worked the same way.

I currently store all my contacts in an app that doesn't expose them through the contacts API for this reason.

Same on Android.

WhatsApp doesn't entirely brick itself. You can send and receive messages, but can't assign names to anyone or start group chats.

I agree it should be prevented. It seems so absurd and is clearly not necessary. Android should have an option to let it see an empty/phony address book, so it can't tell that you've blocked it.

Reply on news.ycombinator.com