Posted by emctech 11 hours ago
most of the prices change during checkout in the most frustrating ways. one u ready to check out, and provide ur payment into, and click to pay... they interrupt this fake checkout with a popover, inform u the price is actually much higher, and dangle a button which is one click to accept the new higher price.
this is total scam behaviour and probably illegal in most US states.
Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.
But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.
How can they tell? For the permissions I can think of: location, filesystem, etc. it should be easy to lie/spoof.
By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission.
In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.
Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop?
No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.
No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero.
> local storage
Give the app a temporary, space-constrained store that isn’t shared with other apps.
> bluetooth
Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc.
> screen dimensions
Not personal data.
> input latency
Fudge the numbers even when the user grants permission.
This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.
Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win.
> Not personal data.
LOL
Thanks for investigating! Makes sense it’s also in the taobao app on ios too.
Thank you very much.
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user
My local 'newspaper' website is chock full of scam adverts. The print version is dignified. The website people, somehow, turn a blind eye.
And I got an advert on Youtube this week using sexually explicit language to sell pills.
Feels like standards, and expectations, have really slipped.
https://chrisburnell.com/html-can-do-that/
[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.