Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.

Apparently Android apps (even in current Android versions) can check for the presence of other Android apps by listing the apps they want to check for in their manifest file. Nothing stops them from listing dozens or hundreds of other apps, and some do exactly that. Up til Android 11 they didn’t even have to list the other apps in the manifest. Then Google “tightened” things to be almost as bad. Dumb move, Android.

  • f4f4f4f4f4f4f4f4@sopuli.xyzEnglish
    4·
    23 days ago

    Privacy Breacher hasn’t been updated in four years and still seems to be able to list all the apps on an Android device without any permissions.

    PrivacyBreacher is an Android app built as a proof of concept for a research article describing the privacy issues in Android. This app can access the following information from your phone without requesting any permissions: Figure out at what time your phone screen turned on/off. Figure out at what time you plugged in or removed your phone charger and wired headphones. Figure out at what time you switched on/off your phone (i.e., it captures the device uptime and ACTION_SHUTDOWN broadcasts). Access most of your device related information like your phone model, manufacturer etc. Keep track of your WiFi/Mobile data usage. Get a list of all the apps installed on your phone. Construct a 3D visualization of your body movements.

    Edit: A knowledgable user says this app can still do this because it’s built for pre-Android 11 (when the privacy fix was implemented).

    https://sh.itjust.works/comment/17677309

    checked the code and it just queries the package manager as usual. it works because the system tries to maintain compatibility with apps made for older android versions (targetsdk). this app was built for api 29 (android 10), and the query apps permission gating was introduced in api 30 (android 11) https://web.archive.org/web/20250331021341/https://support.google.com/googleplay/android-developer/answer/10158779?hl=en the play store is strict about the min targetsdk allowed for new apps and updates, and while that is also a negative thing, api 29 cannot be targeted anymore for apps: https://web.archive.org/web/20250331021653/https://developer.android.com/google/play/requirements/target-sdk

  • JayGray91@lemmy.zipEnglish
    1·
    24 days ago

    It is a dumb move. I have a bank app that doesn’t want to function allow if I set other keyboards than GBoard. It came out of nowhere

    I’m already in the process of settling my loan and credit card debt with them and closing the account. If they ask why I’ll make sure to highlight that’s the biggest reason.

    The other reason is I got better rates though so suck it

    • vfsh@lemmy.blahaj.zoneEnglish
      1·
      24 days ago

      I have a bank app that doesn’t allow other keyboards than GBoard.

      Meanwhile my bank app bitches at my every time I login because I use GBoard (with network disabled), the app wants me that the keyboard could be a keylogger.

  • passenger@lemm.eeEnglish
    0·
    24 days ago

    Very scary stuff.

    Wondering how the android alternatives deal with this, does it work on grapheneos, e os, calyxos?

    • superglue@lemmy.dbzer0.comEnglish
      1·
      24 days ago

      I’m on Graphene and Aurora store can see all installed apps without me giving it any additonal permissions. I know because apps I installed outside of Aurora appear on the app list in Aurora.