Apparently Android apps (even in current Android versions) can check for the presence of other Android apps by listing the apps they want to check for in their manifest file. Nothing stops them from listing dozens or hundreds of other apps, and some do exactly that. Up til Android 11 they didn't even have to list the other apps in the manifest. Then Google "tightened" things to be almost as bad. Dumb move, Android.
I have a bank app that doesn't allow other keyboards than GBoard.
Meanwhile my bank app bitches at my every time I login because I use GBoard (with network disabled), the app wants me that the keyboard could be a keylogger.
Wait, the bank app doesn't allow other keyboard apps to be installed?
I can maaaybe see them forcing a specific keyboard app to be used on their app, but everything else is just infuriating.
no, the bank apps won't let you use a keyboard app that they haven't whitelisted to type information within their app, such as entering your PIN etc. It's a security "feature" to keep you from getting phished or whatever its called if your keyboard assists someone from accessing your bank account
sure. I was able to use kika keyboard to interface with my bank app then i switch back to the keyboard I actually use.
Pretty stupid since if you use the bank's regular voice-menu phone service, chances are it asks you to enter your PIN on the touch tone keypad. It has no way to know what dialer app you are using.
I know that some banks used to give out hardware 2FA tokens and if done right, that's way more secure than any phone app, but obvs has convenience issues.
It's how @JudahBenHur@lemm.ee says. The app won't function with a non-whitelisted keyboard. It also can detect of accessibility on. I don't have any disability to require that on, but do have some apps that use it. I rated the app 1 star saying they are ableist and they still double down on their stupidity.
i also just use the website instead of their super restrictive "for security" apps that add no value. It is none of their business what is going on on my rooted phone. but i'm also a fossil cause i'm using a computer
Lol, right?
How often do I need to interact with my bank anyway?
Good thing this is at least very easy to block per-app with a Xposed module.
Although it is quite concerning indeed that there isn't an easy and explicit way for you to be notified when an app tried to do this on its own, it would be nice to have a tool that can automatically scan an app to see if it does that
Privacy Breacher hasn't been updated in four years and still seems to be able to list all the apps on an Android device without any permissions.
PrivacyBreacher is an Android app built as a proof of concept for a research article describing the privacy issues in Android. This app can access the following information from your phone without requesting any permissions: Figure out at what time your phone screen turned on/off. Figure out at what time you plugged in or removed your phone charger and wired headphones. Figure out at what time you switched on/off your phone (i.e., it captures the device uptime and ACTION_SHUTDOWN broadcasts). Access most of your device related information like your phone model, manufacturer etc. Keep track of your WiFi/Mobile data usage. Get a list of all the apps installed on your phone. Construct a 3D visualization of your body movements.
Edit: A knowledgable user says this app can still do this because it's built for pre-Android 11 (when the privacy fix was implemented).
https://sh.itjust.works/comment/17677309
checked the code and it just queries the package manager as usual. it works because the system tries to maintain compatibility with apps made for older android versions (targetsdk). this app was built for api 29 (android 10), and the query apps permission gating was introduced in api 30 (android 11) https://web.archive.org/... the play store is strict about the min targetsdk allowed for new apps and updates, and while that is also a negative thing, api 29 cannot be targeted anymore for apps: https://web.archive.org/...
I've been wondering for a while, has anyone tried make something to confine every app in a virtual machine? Like I after I install some shady fast food app that requires access to my contacts and phone history it "sees" its self in a empty Android install. If the app actually needs data from the real phone you could just mirror that data into the virtual machine.
Ah, thanks! I figured that somebody else must have thought of it, since it's a pretty obvious idea.
@lemmy.world
DROID DOES
Welcome to the Android community on Lemmy. Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
go to feed...
@lemmy.world
DROID DOES
Welcome to the Android community on Lemmy. Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
go to feed...
It is a dumb move. I have a bank app that doesn't want to function allow if I set other keyboards than GBoard. It came out of nowhere
I'm already in the process of settling my loan and credit card debt with them and closing the account. If they ask why I'll make sure to highlight that's the biggest reason.
The other reason is I got better rates though so suck it
save