Be Careful Which Mobile Apps You Install

[Mpamaegbu]

Consider all the permissions you give the apps you install. Many ask to view your messages, check your contacts, manage audio/video on your phone, and much more.

It amuses me, really, whenever I'm downloading apps and I get that prompt to grant permission to them in strangely unrelated ways. For instance, I'm installing a car race app and it's asking permission to my messages or downloading a mining app for airdrop hunting and it's seeking permission to my photos. I'm like "what the fcuk"? I usually end the whole thing there and exit. I don't like experimenting when it comes to granting access.

Another problem we have is the number of closed source softwares out there far more than the number of open source software out there. As a result it can be quite difficult to know what is going on back end.

Is there a way of knowing where a software is open source or closed source? I guess if there are ways to find that out for non-tech savvy guys it will be a lot easier to guard against installing such.

[Reynaldo]

Be super careful with this stuff because I've seen too many horror stories. Before I interact with anything crypto related Triple check URLs, Never save seeds digitally, Verify contracts on blockchain explorers Use hardware wallets for any serious holdings and Keep sensitive stuff offline completely,  Always assume everything's trying to steal your crypto until proven otherwise. Paranoid? Maybe. But rather be paranoid than rekt.

[Pmalek]

Is there an Electrum wallet app for iOS mobile devices?
The one I did see looked like a clone wallet...

No there isn't. If you found one somewhere or someone tried to trick you into installing one, it's a scam and you are dealing with a scammer. This isn't the place to talk about Electrum but since you brought it up you must download it from the official website only. As you can see there, the software is available for Windows, Linux, macOS, and Android. Not for iOS.

Generally, a person shouldn't use a device for financial data or apps, which they use to download all sorts of stuff, play games, use apps, and do everything that they do on a daily basis, either for work, entertainment or any other purpose.

Ideally, they shouldn't. But everyone knows that many people aren't security conscious and doing everything from the same device is easier. That's also how you get burned.

Is there a way of knowing where a software is open source or closed source? I guess if there are ways to find that out for non-tech savvy guys it will be a lot easier to guard against installing such.

If you can compile the software yourself using publicly available code and it works exactly as it should, it's open-source or source verifiable. That still doesn't make it safe, though. Vulnerabilities and bugs can exist in both open and closed-source software.

But on a general note, do you think if you asked 10 random people on the street if they use open or closed-source software on their phones that they would have a clue what you are asking them? Maybe 1 person would. 

[justinlamode]

Please confirm if downloading applications from Google playstore also have some risk attached to them. I use Android phone and most of my applications were downloaded from Google playstore and there is something called Playconnect which I see as security stuff that protects users from downloading corrupted softwares and applications. If this does not offer proper security, it will be a huge problem because I already have so many apps downloaded from that source.

[Pmalek]

Please confirm if downloading applications from Google playstore also have some risk attached to them.

Of course it has. Infected apps and fake software appear on such play stores. That's one of the points of this thread.

I use Android phone and most of my applications were downloaded from Google playstore and there is something called Playconnect which I see as security stuff that protects users from downloading corrupted softwares and applications. If this does not offer proper security, it will be a huge problem because I already have so many apps downloaded from that source.

I think you meant to say Play Protect and not 'Playconnect.' Play Protect carries out certain safety checks on your apps but it's not a miracle worker. Nasty stuff can still pass by it and often does. If it didn't, there would never be issues with phishing apps and infected files on Google's Play Store. Yet, there is. A helmet or seatbelt is also not a guarantee that you can't be killed in a traffic accident, but it's better to use them than not to. 

[hd49728]

I think you meant to say Play Protect and not 'Playconnect.' Play Protect carries out certain safety checks on your apps but it's not a miracle worker. Nasty stuff can still pass by it and often does. If it didn't, there would never be issues with phishing apps and infected files on Google's Play Store. Yet, there is. A helmet or seatbelt is also not a guarantee that you can't be killed in a traffic accident, but it's better to use them than not to. 

It's not miracle and with history of Google Play by allowing many fake apps listed on their store, I can not trust any protection from Google. Search results from Google search engine can not be trusted too and if you need information about websites, applications of cryptocurrency companies/ projects, find them on Coinmarketcap.com or Coingecko.com that are more reliable sources than Google.

Google or not, make sure to double check information.

[btcltcdigger]

As long as you use common sence, you should be fine.
If a game asks for file permissions, deny them. If a seamless fun app requires any permissions, other than the use of your wifi, deny them.
Food delivery apps have no place asking for any permissions except your location

[Pmalek]

As long as you use common sence, you should be fine.
If a game asks for file permissions, deny them.

It's not that simple. Someone might say, why would a game need access to my storage and files and deny it. But they need it to save your progress and download essential files you need to advance in the game, for example.

Food delivery apps have no place asking for any permissions except your location

They may require camera/gallery access. For instance, if something is wrong with your order, you might have to provide photo proof from within the app.

[jcojci]

I am not install a new applications in my cellphone because I feel my phone is enough with the applications that I have now. So I don't think I need to install the other applications because I know the risk behind of installing a new applications that I don't know for sure. So far I can use my phone without a trouble and I hope that will be like that. I don't have to worry with a new applications because I can take care my phone and I don't keep my phrases in my phone. I keep it in a safe place in offline so I think that is still safe in there.

[Patikno]

Maybe for beginners some precautions like what you said are very important and need to be done, because many newbies usually install applications on their mobile phones without rechecking the "permissions" they will give, so they don't know what risks might occur. Application permissions are something that needs to be considered when using applications on mobile phones, and for me personally I am always vigilant about every permission I give to an application on a mobile, even I often install applications that are outside the playstore (I am an android user). And my advice is to try to "allow when using the application only" when using any application, to avoid misuse by irresponsible application parties.

Here's an explanation of how, and it's similar to other permissions: Manage location permissions for apps

[Nothingtodo]

It may be possible for some experienced mobile users to avoid it, but for new users who are not aware of harmful apps, it will be very difficult to avoid using all these risky applications. It is especially difficult for those new to Bitcoin to avoid downloading harmful wallets. Fraudsters use similar applications that are not easily recognizable to new users, and in most cases, new users are being deceived by these malicious applications.

[Yucky]

It's so crazy that scammers can work this hard with these malicious apps, just to steal someone's hard earned money. If they put their energy into looking for their own money legally, they will make it. Most times I am so reluctant in installing an app, aside from the fact that I don't like seeing plenty of apps in my phone  taking space, I want to know if they have a website where I can check them out.

Because from the UX of the website, the URL link, if they have a secure connection, pop-up ads and everything, you can pick out information to know if they are legit. So even if I install an app, let's say I want to check out their trading options, I see no business in wanting to access my photos or contacts or location. I decline access fast

[Pmalek]

So even if I install an app, let's say I want to check out their trading options, I see no business in wanting to access my photos or contacts or location. I decline access fast.

It all depends on the type of permissions that an app requests. Since you mentioned a trading app, it might need to know your location to allow or disallow access to certain or all trading features. For instance, my banking app requires location data. If I didn't grant it, I wouldn't be able to use my bank's mobile banking option. It could be similar with trading apps and them wanting to know from where their clients log in and if they are were they claim to be.

[dkbit98]

I would keep only minimal number of apps installed, and I prefer most of them to be open source.
Even apps that are not malicious are also tracking what you are doing, and we recently saw stupid Tangem app leaking seed words.
GrapheneOS has a nice feature with multiple profiles for your smartphone, than you can create separate profile dedicated only for installing cryptocurrency apps.

[albon]

I would keep only minimal number of apps installed, and I prefer most of them to be open source.
Even apps that are not malicious are also tracking what you are doing, and we recently saw stupid Tangem app leaking seed words.
GrapheneOS has a nice feature with multiple profiles for your smartphone, than you can create separate profile dedicated only for installing cryptocurrency apps.

Installing only important apps would be a good precaution away from downloading random apps that collect data for ads and marketing.

I agree with you about even regular apps that are free of malicious, for example, I have attached a screenshot of some regular apps installed on my mobile phone that were detected by Norton 360 app as data harvesting apps, even among them are popular exchange platform apps like Binance, This serves as a reminder for everyone to be cautious that anything connected to the internet and not open-source can be potential risks and invasion of privacy.

[Z_MBFM]

Nice tooic op .It will not happen if someone downloads real and authorized applications. But downloading a cracked or fake application and giving different access permissions to the device for that application is definitely harmful for us. Because hackers then get access to many things on our devices. And because of this they will be able to hack our important files images and various things. So it is natural that we must be careful in downloading any application.

Currently there are various types of Airdrops that require downloading different types of applications.  They are very dangerous for us. so op can alert everyone to this new topic of yours.

[Crypto Library]

Always writing phrases on a piece of paper for security purposes, I also know that downloading & installing APKs from external sources is dangerous, but what is different about this case is the applications come from the trusted Playstore. In fact, my main reference when installing an APK on my smartphone is trusted stores like Playstore. Hearing this news made me a little worried.

- Ammar M. A.

To be honest I like what you say about your recovery process but what you will do if any natural disaster destroy the piece of paper ? So I think we should have multiple back-up channel physical and virtual both and obviously should use the best and trusted method.

Now what you say about the playstore apps, to be honest I couldn't agree on this regards because not all the apps on the playstore were always safe. And to understand this you might just check some old apps or games what is just not available on the playstore and this is just because fo the security violation and sometimes google took much time to identify it and in the mean time the hackers and the scammers do their job well. So even then you are downloading from the playstore don't believe all of them.

[jstyler]

totally agree with you ammar, even if apps come from playstore, we should still be cautious, many old apps got past google's checks and caused issues, so it's not just about where you download from, but also the type of permissions they ask for and the reviews they have.

[boyptc]

I agree about if there is an app but it also has a website, it's best to just go into their website and use it. And don't always use the same credentials that you use in all platforms that you do.

Many of these mobile apps contains malicious software because they are not filtered by the platform that they are downloadable.

This has been a long going issue with platforms like App store and Playstore. They always have these issues and only the reviews that are genuine could save people from avoiding them.

But even so, that can be manipulated by these bad actors. And for sure many will be guilty about screenshotting their mobile wallet recovery phrases.

[Alphakilo]

They found several genuine Android and iOS apps that contained the trojan stealer SparkCat that stole seeds saved as photos. The infected apps include food delivery services and AI apps. The apps passed initial security checks and were downloaded over 250,000 times before SparkCat was discovered.

-   Don’t install apps you don’t need and just for fun.
-   Stay away from brand-new apps.
-   If you can use a service from its website, do that. An app isn’t always necessary.

I had to go through my app list to look for old apps that I no longer use that are just idle.

We are in a constant battle against these malicious actors that come at us in different ways - via mobile apps, unkonwn links that look innocent. They do it directly and indirectly.

Even when you opt to use the website and not the app, you gotta be double sure that it is the right website and not a clone made for phising.