Live data from Hacker News

Popular iPhone apps caught sending user location data to monetization firms

techcrunch.com

111–120 of 261 posts

Re: Popular iPhone apps caught sending user location data to monetization firms

#111

Earlier quoted context omitted.

There is no way to control the iOS firewall via extensions in iOS. Meaning, it's still not supported, and what you see as "essentially" the same misses the point. I want to block connections of specific apps. What iOS can do is reveal connections made by the network device to the outside. Duh. Set up Wireshark on some AP and get the same info.

Niche startup idea, VPN for your mobile device that can analyze and block traffic. Block entire countries, 3rd parties, etc. Give realtime feedback on their dashboard as applications are loaded. Could also be useful as a developer application profiling tool.

Facebook attempted such a thing already, and was caught exploiting it. VPN apps for the purpose of traffic control and monitoring are dangerous as they rely on some other party. I could do the same thing without ever needing a service for that. Setting up a monitored VPN gateway is no rocket science for me, I could do that, but the folks using crappy apps couldn't. And I would still need a way to map traffic to specific apps to identify unnecessary/malicious traffic. There is no other way as only via the internal iOS firewall. I wonder how the team behind that report managed to do that what they claim they did.

Re: Popular iPhone apps caught sending user location data to monetization firms

#112

I really wish there was a reliable way to just shitlist all of these affiliate/analytics/tracking/ad SDKs device-wide. Third party SDKs sending who-knows-what to who-knows-where is such a plague in the app ecosystem, and even the developers including them seem to have no idea what the implications are. I don’t want any of them, ever.

pihole is really easy to setup and the default block list gets a large chunk.

I've found that my pihole seems to slow down a non-trivial number of websites. It's as if the sites are waiting for a response to something before sending the next chunk of info, and so it has to wait 20-30 seconds for a timeout before the next chunk is sent.

Any suggestions on how to fix this? I do love how pihole blocks so many trackers on all my networked devices!

Re: Popular iPhone apps caught sending user location data to monetization firms

#113

Earlier quoted context omitted.

“Read the weather off Google” is weird advice in a thread about companies collecting user data, given that no one does more of that than Google.

my point is that i dont need to install an app to type "temp in sf" in google and see if a jacket is needed.

Do you live in SF? I honestly can't tell if that is porposedly facetious or simply ignorant of the vast divesity of weather and weather reporting needs outside of SF..

Re: Popular iPhone apps caught sending user location data to monetization firms

#115
post #6

Earlier quoted context omitted.

Lots of ways 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. 2. You can inspect the libraries provided by the owners of tracking endpoints to see what they collect and transfer. 3. Decompiling app bundles is usually pretty effective, and you can download them straight from iTunes.

You cannot decompile apps without a jailbroken device, as they're encrypted with FairPlay. And iTunes, at least with the latest version, no longer lets you download apps.

There are ways to download apps on a desktop without using iTunes.

Re: Popular iPhone apps caught sending user location data to monetization firms

#116

Does the App Store for either iOS or macOS give any indication whether or not an application is open source? I know that is not at all a guarantee that an app would be more respectful of the user's privacy, but I'd bet that it would save a chunk of guesswork.

No but open source apps will usually tell you in their description.

Re: Popular iPhone apps caught sending user location data to monetization firms

#117

Earlier quoted context omitted.

pihole is really easy to setup and the default block list gets a large chunk.

I've found that my pihole seems to slow down a non-trivial number of websites. It's as if the sites are waiting for a response to something before sending the next chunk of info, and so it has to wait 20-30 seconds for a timeout before the next chunk is sent. Any suggestions on how to fix this? I do love how pihole blocks so many trackers on all my networked devices!

I’d look at your browsers network tab to see what’s pending and check the domain using the pihole blocklist search. I’ve had some blocklists be a little too aggressive and block thinks that are not really trackers or anything bad.

But you’re probably right about the sites waiting for some lib to finish. I’ve only seen it happen on news sites where their video player stalls waiting for the ad to load.

Re: Popular iPhone apps caught sending user location data to monetization firms

#118

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

A lot of work went into rooting out these trackers, what data they sent, and what apps they were in. We used a combination of static code analysis for each, runtime analysis (eg. Corellium), and network packet capture/analysis. The good news is that only that last part is required if you would like to try this, now that the commonly used hostnames are published. Folks can add the full list to a system such as Pi-Hole…

Where can I look at the published list of hostnames?

Re: Popular iPhone apps caught sending user location data to monetization firms

#119
post #2

This is the report the article is based on https://guardianapp.com/ios-app-location-report-sep2018.html

Funny that HN mods always replace links to original sources except TechCrunch... TC can post all the blog-spam they want

Re: Popular iPhone apps caught sending user location data to monetization firms

#120

Earlier quoted context omitted.

A lot of work went into rooting out these trackers, what data they sent, and what apps they were in. We used a combination of static code analysis for each, runtime analysis (eg. Corellium), and network packet capture/analysis. The good news is that only that last part is required if you would like to try this, now that the commonly used hostnames are published. Folks can add the full list to a system such as Pi-Hole…

> We used a combination You were involved? Why am I not surprised! Thanks for doing your part my friend.

can you tell me a bit about him?
Post reply on HN