Live data from Hacker News

Popular iPhone apps caught sending user location data to monetization firms

techcrunch.com

81–90 of 261 posts

Re: Popular iPhone apps caught sending user location data to monetization firms

#81
Haha...

I have iPhone but don’t use any of those shitapps.

What people expect from “free” apps, I don’t know. Maybe they think it’s supposed to be some sort of government-coordinated social benefit arrangement. The moment those apps can’t collect and sell data, they’ll go away, become crappier or start charging.

Re: Popular iPhone apps caught sending user location data to monetization firms

#82
post #59

Why does it seem like browser extensions are ignored in all of these discussions? For example, right now the Honey Chrome extension has permission to "Read and change all your data on the websites you visit". They could be doing anything with that, I'm just crossing my fingers that they find me good deals and don't abuse my data. Chrome actually acknowledges this: "Warning: Google Chrome cannot prevent extensions fro…

That’s not an issue in iOS/Safari because extensions can’t do that kind of thing. I’ve seen other people complain about this for chrome. I saw people justifying it by saying that that permission is necessary if you want to interact with the page directly (hide/show content, etc.). Doesn’t mean the extensions are to be using it, but it may be necessary. Much like GPS data for a weather app.

GPS data for a weather app is not necessary, because it's way to precise for its purpose. Most of the time I need to know how the weather is elsewhere, or how the weather is going to be today. How does precise (to a meter) GPS data help me there exactly?

Re: Popular iPhone apps caught sending user location data to monetization firms

#83

I asked a network info app developer why it's not possible to at least track and control network connections on iOS, like Little Snitch does (or did) for MacOS. "iOS doesn't support that". Well, duh? I don't even know what to think. Knowing where the iOS device connects to will be a huge help "cracking down" on BS apps! And then I read in the comments that it might be virtually impossible for Apple to detect maliciou…

It's easy to figure out what an iOS device is connecting to: use a network extension that inspects network traffic. And given that Apple has none of the restrictions they impose on third party developers, they can essentially do what Little Snitch does on macOS.

Re: Popular iPhone apps caught sending user location data to monetization firms

#84
post #23

Sue Apple, because they own the "curated" distribution channel and they have too much money.

Why would you blame Apple instead of the people behind the offfending application?

Apple could implement iOS-wide measures to prevent unnecessary network connections or data streams from sensors. They failed to do that. "Offending applications" exploit that incompetence Apple displays in the recent years.

Re: Popular iPhone apps caught sending user location data to monetization firms

#85
post #6

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

Lots of ways 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. 2. You can inspect the libraries provided by the owners of tracking endpoints to see what they collect and transfer. 3. Decompiling app bundles is usually pretty effective, and you can download them straight from iTunes.

You cannot decompile apps without a jailbroken device, as they're encrypted with FairPlay. And iTunes, at least with the latest version, no longer lets you download apps.

Re: Popular iPhone apps caught sending user location data to monetization firms

#86
post #52

Earlier quoted context omitted.

>There are so many good apps on the store made by good developers. It’s amazing how much better your experience is if you just avoid free apps when possible. Yes. It cannot be emphasized enough. Go pay for apps that are good.

FDroid on Android has tons of FOSS apps that are quite good. Its a false dichotomy.

It's not a false dichotomy if you remember these arguments aren't generic, they're for the apple store.

Re: Popular iPhone apps caught sending user location data to monetization firms

#87

Earlier quoted context omitted.

Why would you blame Apple instead of the people behind the offfending application?

Apple could implement iOS-wide measures to prevent unnecessary network connections or data streams from sensors. They failed to do that. "Offending applications" exploit that incompetence Apple displays in the recent years.

> Apple could implement iOS-wide measures to prevent unnecessary network connections or data streams from sensors.

How?

Re: Popular iPhone apps caught sending user location data to monetization firms

#88

If an app is useful and not costing you any money, you have to assume it sharing private information with a third party. There is no business plan or strategy where giving something away keeps you business.

Most of the code I write for the App Store is free and open source, which I can do because I am financially supported through other means. So it's not impossible to do.

Re: Popular iPhone apps caught sending user location data to monetization firms

#90

I asked a network info app developer why it's not possible to at least track and control network connections on iOS, like Little Snitch does (or did) for MacOS. "iOS doesn't support that". Well, duh? I don't even know what to think. Knowing where the iOS device connects to will be a huge help "cracking down" on BS apps! And then I read in the comments that it might be virtually impossible for Apple to detect maliciou…

It's easy to figure out what an iOS device is connecting to: use a network extension that inspects network traffic. And given that Apple has none of the restrictions they impose on third party developers, they can essentially do what Little Snitch does on macOS.

There is no way to control the iOS firewall via extensions in iOS. Meaning, it's still not supported, and what you see as "essentially" the same misses the point. I want to block connections of specific apps. What iOS can do is reveal connections made by the network device to the outside. Duh. Set up Wireshark on some AP and get the same info.
Post reply on HN