Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular iPhone apps caught sending user location data to monetization firms

techcrunch.com

Post reply on HN
Print view View original

141–150 of 261 posts

Re: Popular iPhone apps caught sending user location data to monetization firms

#141

Post by vultour »

fooker wrote: post #128
danjoc wrote: post #65

Earlier quoted context omitted.

> it’s going to need to know where I am to provide me the forecast Why would you think that? I don't need to give a weather app my location. It only needs to have one or more locations of interest to me. My weather widget pulls multiple locations for me, and has no access to my location data.

By that logic, nothing needs your location.

Not sure what kind of strawman you're building here but there's quite a big difference between giving location to a map app that will help you if you're lost, and a weather app. Having to use location data to get weather seems like the pinnacle of laziness to me, if you don't know where you are than you have bigger problems than the weather.

Re: Popular iPhone apps caught sending user location data to monetization firms

#142

Post by the8472 »

paxys wrote: post #6
walterbell wrote: post #4

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

Lots of ways 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. 2. You can inspect the libraries provided by the owners of tracking endpoints to see what they collect and transfer. 3. Decompiling app bundles is usually pretty effective, and you can download them straight from iTunes.

> 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary.

Then they'll just move to pinned certs in the apps?

Re: Popular iPhone apps caught sending user location data to monetization firms

#143

Post by user5994461 »

the8472 wrote: post #142
paxys wrote: post #6

Earlier quoted context omitted.

Lots of ways 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. 2. You can inspect the libraries provided by the owners of tracking endpoints to see what they collect and transfer. 3. Decompiling app bundles is usually pretty effective, and you can download them straight from iTunes.

> 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. Then they'll just move to pinned certs in the apps?

It's hardly doable in practice. For example, certificates have to be updated at least yearly, leaving your app completely broken unless updated.

Re: Popular iPhone apps caught sending user location data to monetization firms

#144

Post by snaky »

mycoborea wrote: post #27

Does the App Store for either iOS or macOS give any indication whether or not an application is open source? I know that is not at all a guarantee that an app would be more respectful of the user's privacy, but I'd bet that it would save a chunk of guesswork.

Apple has removed GPL-licensed apps from their store.

Re: Popular iPhone apps caught sending user location data to monetization firms

#145

Post by tialaramex »

user5994461 wrote: post #143
the8472 wrote: post #142

Earlier quoted context omitted.

> 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. Then they'll just move to pinned certs in the apps?

It's hardly doable in practice. For example, certificates have to be updated at least yearly, leaving your app completely broken unless updated.

1a. You don't have to pin the leaf. You can pin an intermediate

1b. Or you can pin the public key and ignore the certificate altogether, new certificates for the same key can be obtained as necessary.

2. The maximum certificate lifetime is currently 825 days, which, unless you're on another planet, is not "yearly".

3. If you're pinning for an application (not a generic website accessible in browsers) you don't need a certificate from the Web PKI at all, you can mint your own, ignore the lifetime rules, write Emoji in the Common Name field, use a different RSA exponent, the world is your oyster.

Re: Popular iPhone apps caught sending user location data to monetization firms

#146

Post by acdha »

awiesenhofer wrote: post #122
MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

I never understood why one needs seperate apps for all these basic informations. I just use homescreen bookmarks to my trusted weather/news/sports sites. Not only are they more secure and ad-free, they load faster too.

It depends on where you live. In Southern California I really didn’t care but on the east coast Dark Sky’s push notifications for imminent rain are handy.

That app's also interesting because they also make forecast.io, which is a great example of a modern web app being competitive with an app on most fronts other than notifications.

Re: Popular iPhone apps caught sending user location data to monetization firms

#147

Post by skywhopper »

the8472 wrote: post #142
paxys wrote: post #6

Earlier quoted context omitted.

Lots of ways 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. 2. You can inspect the libraries provided by the owners of tracking endpoints to see what they collect and transfer. 3. Decompiling app bundles is usually pretty effective, and you can download them straight from iTunes.

> 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. Then they'll just move to pinned certs in the apps?

They can (and should, in general) but often don't, because it's a lot more work. The point is, in practice self-MITM very often works.

Re: Popular iPhone apps caught sending user location data to monetization firms

#148

Post by acdha »

TeMPOraL wrote: post #101
modzu wrote: post #55

Earlier quoted context omitted.

the app collects no data whatsoever. i have no idea what your IP address is (the app connects directly to environment canada to retrieve the raw radar data). no crash data/telemetry is collected automatically, but bug reports are welcome on the github repo. so please don't insinuate that this policy is not true. and yes, there is a legal definition of personal information. since im based in canada, that would be as d…

> the app collects no data whatsoever. i have no idea what your IP address is (the app connects directly to environment canada to retrieve the raw radar data). no crash data/telemetry is collected automatically !!! You're the best. Thank you! Unfortunately not US/Can, otherwise I'd immediately switch to your app just because of that (I'd buy it anyway if it was paid, just to show support). I wish more devs would have…

Crash logging is extremely useful for catching edge cases or third party failures so I wouldn’t give that up but there’s no reason why it can’t involve the user with a Firefox-style “is it okay to report this? Here’s what gets sent…” prompt and aggressive data scrubbing.

Sentry does a really nice job of restricting the data which is stored, for how long, and scrubbing things which might have been included by mistake. I was just setting up an on-premise server yesterday and it’s pretty easy to configure it server-wide in a privacy-preserving manner.

Re: Popular iPhone apps caught sending user location data to monetization firms

#149

Post by acdha »

dschuetz wrote: post #82
MBCook wrote: post #59

Earlier quoted context omitted.

That’s not an issue in iOS/Safari because extensions can’t do that kind of thing. I’ve seen other people complain about this for chrome. I saw people justifying it by saying that that permission is necessary if you want to interact with the page directly (hide/show content, etc.). Doesn’t mean the extensions are to be using it, but it may be necessary. Much like GPS data for a weather app.

GPS data for a weather app is not necessary, because it's way to precise for its purpose. Most of the time I need to know how the weather is elsewhere, or how the weather is going to be today. How does precise (to a meter) GPS data help me there exactly?

Not to the meter but we get plenty of rainstorms where a half mile makes the difference between wet and dry, and Dark Sky’s push alerts are surprisingly useful.

Re: Popular iPhone apps caught sending user location data to monetization firms

#150

Post by jtbayly »

dwighttk wrote: post #31
MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

>There are so many good apps on the store made by good developers. It’s amazing how much better your experience is if you just avoid free apps when possible. Yes. It cannot be emphasized enough. Go pay for apps that are good.

Others have pointed out that there are good free apps.

But more interestingly, there are bad paid apps. Take this paid Mac app for instance: https://gizmodo.com/top-apple-mac-app-secretly-sends-your-br...

What I’d really like to know is whether anybody has any evidence whatsoever that paid apps in these same categories don’t do exactly the same things in exactly the same percentages.

Post reply on HN