(Rant)

At somepoint, HSBC decided KDE Connect installed via F-Droid is less secure.

Photo of the HSBC UK app urging I install KDE Connect via GPlay or Galaxy Store

Then it decide non-whitelisted keyborads are a security risk. Only Gboard and Samsung Keyboard is confirmed within the whitelist.

Photo of the HSBC UK app telling me to switch input method citing security risk

I understand the point that risk can be introduce at various points, yet this is simply too much. Yeah there are people phone infected by malware but from Play Store. Not a single time I heard one ever happened on F-Droid distributed apps, at least not from the official repo. Also, I will put more trust on an open source keyboard than any proprietary keyboard.

Furthermore, I’m shocked that an app can read my app list, and current keyboard (introduced in Android 14). This just make building a profile much easier as I belive everyone almost have an unique set of apps they like. I don’t think any apps need such functionality. Why the f it needs to care what input devices I uses? This make me worry more about untold (aka burried deep in Privacy Policy) data collection.

  • ReversalHatchery@beehaw.orgEnglish
    12·
    14 hours ago

    how the fuck do they see that you have these apps?? Wasn’t it google’s justification for destroying /proc and all resource monitor apps with it that they have put querying of installed apps behind a permission?

    • Moonrise2473English
      3·
      7 hours ago

      I saw a bank in my country requiring to have the permission for apps usage, the one that you have to go in settings and toggle it. Refuse and it closes the app

        • Moonrise2473English
          1·
          22 minutes ago

          Google enforces rules only against small devs. Big companies are allowed to do what the fuck they want.

          Example with one of those “ad viewing apps disguised as games”, every single screenshot is misleading, showing a different game to what actually will be downloaded. It’s clearly a violation of Google Play terms that read:

          Screenshots must demonstrate the actual in-app or in-game experience, focusing on the core features and content so users can anticipate what the app or game experience will be like. Use captured footage of the app or game itself.

          In the example not a single screenshot demonstrate the actual game experience.

          Google sees the big cash influx from ad impressions and IAP from whales and is closing all the eyes

          Tencent and Alibaba instead are still allowed to illegally fingerprint and track the user by placing tracking data in /Pictures/.gs_fs0 which for some reason they can access even without storage/photo permission

    • Possibly linux@lemmy.zipEnglish
      3·
      9 hours ago

      So /proc is virtual so it is only processes and not apps.

      The app probably requires a permission that grants it access to that information.