News for hackers. Stuff that matters.

A comment on Don't Download Apps. Parent comment

Re:Don't Download Apps by doctor_radium on Thursday November 27, 2025 @04:09AM (#46067327)
With a browser, you have the ability to block cookies, block whole hosts/domains, alter DOM content, alter tracking URL's, and (often) disable low level features you don't like. With apps, not so much.
[ Parent | on HN ]
Re:Don't Download Apps by raw_anon_1111 on Thursday November 27, 2025 @08:19AM (#46068979)
And still waiting for examples of how apps can track you better. If the server wants to track you by your originating IP, all of the client side blocking will do nothing
[ Parent | on HN ]
Re:Don't Download Apps by LargoLasskhyfv on Thursday November 27, 2025 @10:36AM (#46070199)
VPN, TOR...
[ Parent | on HN ]
Re:Don't Download Apps by raw_anon_1111 on Thursday November 27, 2025 @11:30AM (#46070795)
And once you install a VPN on your phone it also keeps apps from revealing your IP address.
[ Parent | on HN ]
Re:Don't Download Apps by ranger_danger on Thursday November 27, 2025 @09:01PM (#46074902)
Some apps can/will detect that an OS-level VPN has been activated though, and refuse to work at all. Spectrum TV does this for example, as well as some banking and other types of apps.
[ Parent | on HN ]
Re:Don't Download Apps by raw_anon_1111 on Saturday November 29, 2025 @01:08AM (#46085493)
Yes and sites can also fairly reliably detect when a user is coming from a well known IP address block belonging to a VPN or VPS provider. It’s a built in feature of I know at least AWS

https://aws.amazon.com/about-aws/whats-new/2020/03/aws-waf-a...

[ Parent | on HN ]
Re:Don't Download Apps by ranger_danger on Saturday November 29, 2025 @11:03AM (#46088539)
Assuming you are using a "well known IP address block belonging to a VPN or VPS provider", yes, but it is also possible to setup VPNs/proxies outside of well-known IP blocks.
[ Parent | on HN ]
Re:Don't Download Apps by ranger_danger on Thursday November 27, 2025 @08:57PM (#46074886)
What is your definition of "track you" in this context?

If it's to pinpoint a unique device accessing a website even through VPNs and/or other IP changes, there are an untold number of ways that apps can track you better than a website.

Apps have access to many device-specific APIs in addition to all the web ones, and every additional bit of information used can be added to the mix to create an even more unique fingerprint of the specific device accessing a website.

For example with phones, an app (even if it's mostly just a webview) may now also have access to your phone model, phone number, maybe your contacts or GPS location, and many other things.

[ Parent | on HN ]
Re:Don't Download Apps by raw_anon_1111 on Saturday November 29, 2025 @01:03AM (#46085476)
A website Can easily deduce your phone model based on the browser agent attribute which tells the operating system and the screen resolution with a fair degree of certainty, an app can’t get your phone number, it can get your GPS with your permission. But so can a web page with your permission. There is a standard JavaScript API for it. Contacts are also gated by permissions.

And there is a Contact Picker API for browsers

https://developer.mozilla.org/en-US/docs/Web/API/Contact_Pic...

[ Parent | on HN ]
Re:Don't Download Apps by ranger_danger on Saturday November 29, 2025 @11:02AM (#46088532)
> an app can’t get your phone number

Apps can absolutely get your phone number:

https://stackoverflow.com/questions/2480288/programmatically...

[ Parent | on HN ]