logoalt Hacker News

iancarroll • today at 4:48 PM • 3 replies • view on HN

A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article.

I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a commonly invoked function.

Replies

Groxx • today at 6:19 PM

The permissions snippet they show also doesn't include location, and you can't request location at runtime at all without declaring it there.

I'd verify all this stuff for myself, but Play won't install it in my phone so I can't really get the APK. Maybe because I use Graphene...? but I don't know all the ways they can restrict it, maybe it's something else (though for a pixel 9a it's rather strange if it's hardware based).

--- EDIT ---

To be specific / add what I can check, this is what my Play Store "about -> permissions" is showing:

    Version 47.0.1 may request access to
    Other: 
      run at startup
      Google Play license check
      view network connections
      prevent phone from sleeping
      show notifications
      com.google.android.c2dm.permission.RECEIVE
      control vibration
      have full network access
which appears fairly normal, and does not include location, and I think Play includes runtime location requests there. Maybe there's a version-rollout happening, or device-type targeting?
frizlab • today at 5:10 PM

> it doesn't request location permissions anywhere, despite the claims in the article

The article does not claim the app requests the location. It claims it can do it with a single JS call.

➕ show 2 replies
dijksterhuis • today at 5:06 PM

what version are you on?

from the iphone app store: version 47.0.1 - minor bug fixes - 34 minutes ago

while the parent posted 18 minutes ago

they may have patched the location stuff as part of the “minor bug fixes”?

➕ show 2 replies