Hacker News Reader

Comment by TekMol | Hacker News Reader

My takeaway:

Do not install apps. Use websites.

Apps have way too much permissions, even when they have "no permissions".

No OS vendor wants you to do that, unless you're using a desktop, and then Google wants you to use Chrome. They all want a 30% cut of revenue and/or platform lock-in. They'll rely on dark patterns and nerfing features to push you to their app stores.

Similarly, software vendors want you to use apps for the same reason you don't want to use them. They'll rely on dark patterns to herd you to their native apps.

These two desires influence whether it's viable to use the web instead of apps. I think we need legislation in this area, apps should be secondary to the web services they rely on, and companies should not be allowed to purposely make their websites worse in order to get you on their apps.

The unfortunate truth is that so many things require a dedicated mobile app these days to use.

I don't own or carry a smart phone. I'm still able to get by without one, but just barely.

I wish Uber or Lyft allowed me to use a website. I hate having to find a regular taxi or rely on the kindness of others to use their app.

surprisingly, Uber does! m.uber.com is a mobile website for Uber.

I only used once, in February, so hopefully they didn't break it since then.

Thanks. Will try it!

I am not familiar to this type of side-channel attacks but the article says they use GPU.zip which is exploitable through Chrome:

https://www.hertzbleed.com/gpu.zip/

Looks to me that the browser version requires the targeted website to be iframed into the malicious site for this to work, which is mitigated significantly by the fact that many sites today—and certainly the most security-sensitive ones—restrict where they can be iframed via security headers. Allowing your site to be loaded in an iframe elsewhere is already a security risk, and even the most basic scans will tell you you're vulnerable to clickjacking if you do not set those headers.

With JS disabled!

Reply on news.ycombinator.com