QUERY_ALL_PACKAGES permission in GrapheneOS?

Matthai

So in Slovenia we now have some cases, when banking apps are refusing to work for users, that have AnyDesk (and similar apps for remote access) installed on the phone.

It seems that an app can see all installed applications if it has granted QUERY_ALL_PACKAGES permission.

While I certainly understand the motivation for this and why this would be good to protect users from malware and scammers, I feel that this is some kind of a privacy violation. I mean, why a banking app needs to see what applications I am using?? And also - there are some users, that legitimately use and need AnyDesk (and similar apps).

What is the GrapheneOS approach to this? I understand that user can have a different profile for banking app, however I would like to see a feature similar to "contact scopes", so an option that user can set which apps are visible through QUERY_ALL_PACKAGES permission and which not.

matchboxbananasynergy

Apps can see what other apps you have installed in the same profile via indirect ways that don't require QUERY_ALL_PACKAGES. That permission isn't really what gates app from being or not being able to do this.

If you want apps to not know about each other, put them in separate profiles.

This might be tackled when the app communication scopes feature is done, but it's too early to say at this time.

Matthai

New development... I have NLB banking app (NLB is biggest Slovenian bank). This morning, I tried to pay a bill, but the NLB Klik app wouldn't work. The error message was quite generic - stating that my phone was "unlocked" (rooted/jailbroken) or that I had an app installed that allows remote access. So I called my bank...

What happened next is still quite a shock for me. They informed me that they had recently added Jitsi Meet to their list of prohibited applications - it is classified as enabling remote access.

Jitsi Meet is an open-source application that serves as an alternative to Zoom, Google Meet, and MS Teams. I am using it, because I need it and it is working well.

Yes, it could be abused by scammers, but Zoom, Google Meet, and MS Teams could also be abused by scammers. But NLB hasn't blocked those other applications! I guess that techno-fascists get along quite well and know exactly how to protect each other's interests...

SplatterGames

Matthai you, my friend, need to find a different bank. The only language they understand is losing money - by losing customers. This bs is unacceptable. Maybe I'm spoiled because my bank doesn't hire clowns to do their security, but this is so far one of the most ridiculous explanations I have heard why they block an app from running.

userofgos

Matthai That's unfortunate. If you can't switch banks, you could either put Jitsi Meet or NLB in Private Space or secondary user profile to resolve the issue.

Matthai

Well, I can not change the bank and there is another problem - all banks in Slovenia are the same when we are talking about supporting GOS. OK, NLB is really "special" regarding security, but all banks are the same.

I just hope that Walt will be working well, so I will be able to pay with my phone on GOS.

starglider

A private profile, work profile, or additional user should address the OP's problem. If it's using Play Integrity, though, that's a different issue.