Earlier quoted context omitted.
FDroid on Android has tons of FOSS apps that are quite good. Its a false dichotomy.
How do I get FDroid on my iPhone?
You dont have to restrict yourself to using an Iphone. Embrace choice.
Popular iPhone apps caught sending user location data to monetization firms
131–140 of 261 posts
Re: Popular iPhone apps caught sending user location data to monetization firms
#132Why does it seem like browser extensions are ignored in all of these discussions? For example, right now the Honey Chrome extension has permission to "Read and change all your data on the websites you visit". They could be doing anything with that, I'm just crossing my fingers that they find me good deals and don't abuse my data. Chrome actually acknowledges this: "Warning: Google Chrome cannot prevent extensions fro…
>Related question: why can't we restrict the domains that Chrome extensions can read data from?
The extensions can do this. E.g. a Strava extension would on install say it has access to *.strava.com (and possibly other domains).
Re: Popular iPhone apps caught sending user location data to monetization firms
#133Earlier quoted context omitted.
> We used a combination You were involved? Why am I not surprised! Thanks for doing your part my friend.
can you tell me a bit about him?
He tells enough in his HN profile;
information security research. ceo @ sudo security group (https://verify.ly).
previously: founder of "Chronic Dev Team" responsible for many years of iOS jailbreaking solutions (24kPwn, absinthe, corona, greenpois0n, etc).
Re: Popular iPhone apps caught sending user location data to monetization firms
#134Earlier quoted context omitted.
Why would you blame Apple instead of the people behind the offfending application?
Anecdotal evidence I’ve heard from developers is that there are a HUGE number of people who think that Apple makes all the software for the iPhone. It’s an Apple phone, you go to Apple’s App Store, so whatever you buy is Apple software. It’s blatantly false, but it’s out there. Just like people thinking of Google as “the Internet“ because it’s the thing they see when they open their web browser. Someone recently said…
>Chances are Apple giving you $10,000 to go away would be far more than you could ever get out of the individual developer even with a full trial.
Chances are Apple is going to ignore you unless 'you' are big enough to induce bad PR.
Re: Popular iPhone apps caught sending user location data to monetization firms
#135No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…
> Of course some of these apps, like the ones that you NEED to use for certain parking meters, are especially evil because there is an any choice. If you need that service, you’re giving up your privacy.
Which of course makes it a direct violation of GDPR. I hope a group of European citizens take some action
Re: Popular iPhone apps caught sending user location data to monetization firms
#136Earlier quoted context omitted.
pihole is really easy to setup and the default block list gets a large chunk.
I've found that my pihole seems to slow down a non-trivial number of websites. It's as if the sites are waiting for a response to something before sending the next chunk of info, and so it has to wait 20-30 seconds for a timeout before the next chunk is sent. Any suggestions on how to fix this? I do love how pihole blocks so many trackers on all my networked devices!
Its probably because the site is trying to make a https connection and your pihole server must not have explicitly closed that port. You can resolve this by either closing that port so that a RST sent back to the client straight away when the https attempt is made OR install a HTTPS cert and open up that port so that pihole can serve you its page.
See here https://pi-hole.net/2018/02/02/why-some-pages-load-slow-when...
Re: Popular iPhone apps caught sending user location data to monetization firms
#137Why does it seem like browser extensions are ignored in all of these discussions? For example, right now the Honey Chrome extension has permission to "Read and change all your data on the websites you visit". They could be doing anything with that, I'm just crossing my fingers that they find me good deals and don't abuse my data. Chrome actually acknowledges this: "Warning: Google Chrome cannot prevent extensions fro…
I've always thought the permissions model of Chrome/Firefox/Edge extensions is a bit upside-down: extensions need permissions to access data, perform actions in the browser, and modify/contact specific or arbitrary URLs, but there are no permissions to prevent them from being abused in combination. A data-flow permissions model would go a long way to improving privacy when using extensions.
For example, Vimium (which I've worked on in the past) needs access to every page so it can add its key bindings, most browser functionality so it can trigger it when the appropriate key is pressed, and history, tabs, etc. so that commands for opening these work correctly. This combination gives Vimium full permission to harvest data and send it to arbitrary URLs, open tabs to random spammy URLs, and generally invade the user's privacy in any way that an extension possibly could, if it so desired.
As an alternative, it would be nice to have some kind of data source marker (user-provided to extension, user-provided to webpage, webpage data, browser data, hardcoded data) and then flow permissions around these, so you can have permissions like: - open tabs/make requests/load images/etc. with user-provided URLs - open tabs/make requests/load images/etc. with URLs found in/derived from webpage URLs (in the same origin) - open tabs/make requests/load images/etc. to URLs with a hardcoded origin - include some kind of browser information in a request to one of the above types - include data a user has provided to a webpage in a request to one of the above types - include webpage data in a request to one of the above types - inject browser data into a webpage with a specific/arbitrary URL - etc.
By separating permissions for what requests extensions can make, what data can be included in requests, what webpages they can affect, and what behaviours they can trigger, it should be very easy to see what an extension is/could be doing. Sadly, this would be very technically challenging to implement, there doesn't seem to be much appetite for it, and there's a real danger of overcomplicating the permissions model so that it becomes unusable.
Just my €0.02.
Re: Popular iPhone apps caught sending user location data to monetization firms
#138Earlier quoted context omitted.
Having an OS and apps I can trust to not send location data solves that problem. The kill switches ensures no roving bugs, modem AT commands, and passive tower triangulation when I'm not using the radio. Pretty simple really.
Do you trust the compiler/VM? How about the hardware? Maybe the fab too? http://wiki.c2.com/?TheKenThompsonHack At some level, you have to trust or decide what is tolerable for you.
That argument is so tired. Just because there's no perfect privacy, doesn't mean you can't significantly increase it. At some point you also have to trust that the chair you're sitting on will hold you and the one that isn't visibly weak has the best chance of doing that.
Re: Popular iPhone apps caught sending user location data to monetization firms
#139Sue Apple, because they own the "curated" distribution channel and they have too much money.
Why would you blame Apple instead of the people behind the offfending application?
Because there's no way to get apps any other way, there's no "open-source" app store for example. Therefore they hold more responsibility in what they let in.
Re: Popular iPhone apps caught sending user location data to monetization firms
#140Earlier quoted context omitted.
The firms would then have a much harder time knowing if the information is genuinely from end users, if they no longer collect directly from user devices.
Basically, the scoundrels don't trust other scoundrels. That's what's saving us from getting server-rendered first-party ads on most websites, that would make adblocking much more difficult.
Actually server side rendered ads would be a whole lot more acceptable to me compared to what we have today: less bloat, less risk of malware injection.
Personally, I could live with a some advertising if that is how it was served and it was slightly relevant.
When they want to try to track me around the web to see what technical and news sites I visit and then serve me ads for dating sites then I'll just turn on ny adblock again ;-)