Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular iPhone apps caught sending user location data to monetization firms

techcrunch.com

Post reply on HN
Print view View original

61–70 of 261 posts

Re: Popular iPhone apps caught sending user location data to monetization firms

#61

Post by MBCook »

ChuckMcM wrote: post #54

If an app is useful and not costing you any money, you have to assume it sharing private information with a third party. There is no business plan or strategy where giving something away keeps you business.

There are plenty of counterexamples to that. People making small games they want to give away for free, utilities that are too small to be able to charge for, free apps that have additional features behind an IAP or subscription.

Just because an app it’s free doesn’t mean it has to be something incredibly scummy.

Re: Popular iPhone apps caught sending user location data to monetization firms

#62

Post by MBCook »

kevingrahl wrote: post #43
trumped wrote: post #23

Sue Apple, because they own the "curated" distribution channel and they have too much money.

Why would you blame Apple instead of the people behind the offfending application?

Anecdotal evidence I’ve heard from developers is that there are a HUGE number of people who think that Apple makes all the software for the iPhone. It’s an Apple phone, you go to Apple’s App Store, so whatever you buy is Apple software.

It’s blatantly false, but it’s out there. Just like people thinking of Google as “the Internet“ because it’s the thing they see when they open their web browser. Someone recently said to me “did you know you they added image search to the Internet?“ because they noticed the tab in Google.

The other side of course would be the lawyers. If someone came to you and wanted to sue and you thought you had any chance in hell… would you sue the little one man operation that doesn’t have a lot of money? Or would you try and wrangle $1.07 trillion Apple into it? “They should have protected me.” Chances are Apple giving you $10,000 to go away would be far more than you could ever get out of the individual developer even with a full trial.

Re: Popular iPhone apps caught sending user location data to monetization firms

#63

Post by yjftsjthsd-h »

MBCook wrote: post #61
ChuckMcM wrote: post #54

If an app is useful and not costing you any money, you have to assume it sharing private information with a third party. There is no business plan or strategy where giving something away keeps you business.

There are plenty of counterexamples to that. People making small games they want to give away for free, utilities that are too small to be able to charge for, free apps that have additional features behind an IAP or subscription. Just because an app it’s free doesn’t mean it has to be something incredibly scummy.

On the other end, paying no longer seems to ensure that the app/service won't be scummy anyways.

Re: Popular iPhone apps caught sending user location data to monetization firms

#64

Post by O_H_E »

trevor-e wrote: post #34

Why does it seem like browser extensions are ignored in all of these discussions? For example, right now the Honey Chrome extension has permission to "Read and change all your data on the websites you visit". They could be doing anything with that, I'm just crossing my fingers that they find me good deals and don't abuse my data. Chrome actually acknowledges this: "Warning: Google Chrome cannot prevent extensions fro…

Developers could specify that their extensions work on certain domains only, but apparently the user can't

Re: Popular iPhone apps caught sending user location data to monetization firms

#65

Post by danjoc »

MBCook wrote: post #30
danjoc wrote: post #12

Earlier quoted context omitted.

The EFF is just astroturfing, https://thebaffler.com/salvos/all-effd-up-levine >A solution for a few outliers doesn’t really influence the big picture. There's nothing stopping anyone from buying a Purism 5. If someone doesn't care about their privacy, they don't deserve it. Freedom isn't free, and all that.

If I buy that phone, and I get a weather app… it’s going to need to know where I am to provide me the forecast. And once I give it that permission, how does the phone/OS prevent them from selling the data that I gave them permission to have? It doesn’t.

> it’s going to need to know where I am to provide me the forecast

Why would you think that? I don't need to give a weather app my location. It only needs to have one or more locations of interest to me. My weather widget pulls multiple locations for me, and has no access to my location data.

Re: Popular iPhone apps caught sending user location data to monetization firms

#66

Post by ChuckMcM »

MBCook wrote: post #61
ChuckMcM wrote: post #54

If an app is useful and not costing you any money, you have to assume it sharing private information with a third party. There is no business plan or strategy where giving something away keeps you business.

There are plenty of counterexamples to that. People making small games they want to give away for free, utilities that are too small to be able to charge for, free apps that have additional features behind an IAP or subscription. Just because an app it’s free doesn’t mean it has to be something incredibly scummy.

#1 source of malware on the Android ecosystem was flashlight apps. I don't disagree that there are examples of apps or code that people have written and given away for free just because, my comment was more along the lines of "companies" giving away a free app.

Re: Popular iPhone apps caught sending user location data to monetization firms

#67

Post by kbenson »

modzu wrote: post #55
kbenson wrote: post #47

Earlier quoted context omitted.

The problem is when not being complicated means they are aren't truthful. Do you track crashes? Do you have any logging that tracks an IP address? I view my dedicated home IP as personal, if not all that private, information. Does minimal logging actually require storing personal information? Is there a common, or legal definition of what personal information is? I'm all for simple policies, but I would also rather t…

the app collects no data whatsoever. i have no idea what your IP address is (the app connects directly to environment canada to retrieve the raw radar data). no crash data/telemetry is collected automatically, but bug reports are welcome on the github repo. so please don't insinuate that this policy is not true. and yes, there is a legal definition of personal information. since im based in canada, that would be as d…

I'm not trying to insinuate your policy isn't true, but to note that a simple policy isn't always applicable, and it might be a little complicated. All the "you"'s in my original comment can be taken as the "general you", not you specifically.

I wasn't trying to insinuate your policy was wrong (I actually assumed it was likely correct, a weather app doesn't generally require much in the way of server support from anything except the weather service), but that "Privacy policies don't need to be complicated" might be a bit optimistic for a lot of apps.

Re: Popular iPhone apps caught sending user location data to monetization firms

#68

Post by danjoc »

alphabettsy wrote: post #25
danjoc wrote: post #3

Stories like this, the Uber story, and the recent one about Google tracking location even when you opt out, are why I'm looking forward to Purism 5 with PureOS and kill switches.

How does having some kill switch solve the issue of an app that needs geolocation selling the data or otherwise using it in a way other than you intended?

Having an OS and apps I can trust to not send location data solves that problem. The kill switches ensures no roving bugs, modem AT commands, and passive tower triangulation when I'm not using the radio. Pretty simple really.

Re: Popular iPhone apps caught sending user location data to monetization firms

#69

Post by jsjohnst »

willstrafach wrote: post #18
walterbell wrote: post #4

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

A lot of work went into rooting out these trackers, what data they sent, and what apps they were in. We used a combination of static code analysis for each, runtime analysis (eg. Corellium), and network packet capture/analysis. The good news is that only that last part is required if you would like to try this, now that the commonly used hostnames are published. Folks can add the full list to a system such as Pi-Hole…

> We used a combination

You were involved? Why am I not surprised! Thanks for doing your part my friend.

Re: Popular iPhone apps caught sending user location data to monetization firms

#70

Post by jsjohnst »

walterbell wrote: post #4

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

Check out CharlesProxy in the iOS App Store. You can intercept and inspect the SSL traffic without needing another device or external service.
Post reply on HN