11–20 of 21 posts
The point isn’t how it gets the coordinates. It’s that the User disabled Location Services, which means that the User’s expectation (on Apple’s platform) is that the app will not locate the User, regardless of whether it theoretically can do so with GPS, WiFi, or a stellar sextant.
Bringing up compensation, even in a round about way like that "pro bono" qualifier, sounds like a great way of getting chased for extortion.
This is not possible if you have not granted Location Services access, due to the nature of how iOS works. This only shows that a coordinate pair is being sent to the Uber API, which may have been cached from a time in the past, such as last time a ride was requested. The author counters this only by driving away in attempt to “reset” it, but instead of sniffing the traffic to see that the headers changed to reflect…
He hasn't really done much to prove conclusively that it's not just coordinates associated with his wifi SSID. > there is a red push pin right on top of literally the room I am sitting in in the house using Google Maps Satellite View. why not step outside and try again, see if it moves. or is that room just where he spends most of his time with the phone location services turned on connected to wifi...?
It seems he's pointing out that, even if you turn off location services, any app can just get around that by locating you via wifi. Isn't that worrisome, even if not unique to Uber?
The point isn’t how it gets the coordinates. It’s that the User disabled Location Services, which means that the User’s expectation (on Apple’s platform) is that the app will not locate the User, regardless of whether it theoretically can do so with GPS, WiFi, or a stellar sextant.
Assuming the app is sending an old, cached location, why would they want to do that?
Earlier quoted context omitted.
He hasn't really done much to prove conclusively that it's not just coordinates associated with his wifi SSID. > there is a red push pin right on top of literally the room I am sitting in in the house using Google Maps Satellite View. why not step outside and try again, see if it moves. or is that room just where he spends most of his time with the phone location services turned on connected to wifi...?
You're both technically right, but you're writing in a way that suggests his article is somehow without basis or not something to worry about; but it's just the opposite. It seems he's pointing out that, even if you turn off location services, any app can just get around that by locating you via wifi. Isn't that worrisome, even if not unique to Uber?
Thing is, possibly as a result, Apple blocked ARP access in iOS 11. You can no longer get the BSSID and use that to get user location. Because the post indicates he used an iOS 11 device, this leads me to believe the coordinates were also not obtained with Wi-Fi information.
Earlier quoted context omitted.
He hasn't really done much to prove conclusively that it's not just coordinates associated with his wifi SSID. > there is a red push pin right on top of literally the room I am sitting in in the house using Google Maps Satellite View. why not step outside and try again, see if it moves. or is that room just where he spends most of his time with the phone location services turned on connected to wifi...?
>coordinates associated with his wifi SSID. I don't believe there's a public API for this on iOS. In order to use wifi hotspots to assist with GPS on iOS, you'd have to have location services enabled for the app. That being said, it's very possible the app is just holding onto the last coordinates it was able to receive when location services was enabled for the app. This may be the default sane behavior to allow it…
There actually was a way to do this. It no longer works as of iOS 11 though.
>How am I intercepting certificate-pinned Uber app traffic on un-Jailbroken 11.2.1 iOS? Answer: I don’t think I am interested in any further pro bono security consulting for Uber at this point. Bringing up compensation, even in a round about way like that "pro bono" qualifier, sounds like a great way of getting chased for extortion.
The submitter mentioned something along these lines, if I understand correctly, in his only other HN submission.
Earlier quoted context omitted.
He hasn't really done much to prove conclusively that it's not just coordinates associated with his wifi SSID. > there is a red push pin right on top of literally the room I am sitting in in the house using Google Maps Satellite View. why not step outside and try again, see if it moves. or is that room just where he spends most of his time with the phone location services turned on connected to wifi...?
You're both technically right, but you're writing in a way that suggests his article is somehow without basis or not something to worry about; but it's just the opposite. It seems he's pointing out that, even if you turn off location services, any app can just get around that by locating you via wifi. Isn't that worrisome, even if not unique to Uber?
https://news.ycombinator.com/item?id=16000550 https://hackerone.com/reports/293359
This is the same guy that got shut down for being a dick 4 days ago, seems like he's really trying to "get back" at Uber. https://news.ycombinator.com/item?id=16000550 https://hackerone.com/reports/293359
Let's see how long it takes OP to realize he opened the app and it persisted a location Thu Nov 30 2017 20:04:08 ("gps_time_ms":1512072248998) when location service were turned on.