Hacker News Reader

Comment by aggregator-ios | Hacker News Reader

One correction to some comments here: an iOS app cannot list all apps that are installed. You can only check for specific apps/schemes (LSApplicationQueriesSchemes) by specifying apps you are looking to query for installation status or open. You cannot provide a large list of unrelated applications since Apple rejects that during app review.

Apple added these restrictions because installed app lists can be used for fingerprinting and privacy invasive profiling.

View on HN

But a single app can request to know the presence of up to 50 apps, right?

And a data broker/aggregator can purchase such data from many (e.g. thousands) of apps and aggregate it, then sell it.

Yes indeed, the limit is 50 which is of course enough to fully profile "regular people" who only have a handful of apps. Also don't forget, Meta/Google/TikTok/WhateverPalantir are updated weekly which means they can tweak their LSApplicationQueriesSchemes list and cover even more apps if they want to.

Are there legitimate reasons why an App should know I have installed?

Back before Apple allowed users to set the default browser I had a feature in my app that presented a list of installed browsers when a user opens an external link, giving them the option to choose where it opened.

Android gives me that option at the OS level.

E.g if gmail knows that you have maps or chrome it can deep link you into a particular view instead of opening safari.

At the OS level, Android gives me the option to open links in the corresponding app.

So does iOS, but this is a different feature than what we’re discussing here.

Since Android 11, Google copied the iOS model except Android is a bit more permissive and so you get a bit less privacy out of the box.

Surely there should be a way to enable deep links with a fallback to Safari without needing Gmail to know what apps I’ve got installed

Interoperability mainly - if you want to deep link into a specific app or show a list of apps to open.

These days we have more modern and privacy protecting APIs for making content available to the system or other apps… but that doesn’t stop the profilers.

People think LinkedIn is scummy (they are) for scanning for browser extensions, but what Apple is allowing is even worse.

You cannot provide a large list of unrelated applications since Apple rejects that during app review.

Thank you for the clarification!

You cannot provide a large list of unrelated applications since Apple rejects that during app review.

It does not need to be a large list though I think? You just need a small list that is very discriminative and adds enough additional entropy to uniquely identify you in combination with the other data leaked.

> Apple added these restrictions because installed app lists can be used for fingerprinting and privacy invasive profiling.

And this was heavily exploited by Facebook before Apple patched it

It is terrifying to learn that apps are allowed knowledge about any other app being installed on my phone. Where can I see that list?

Info.plist

Reply on news.ycombinator.com