Popular iPhone apps caught sending user location data to monetization firms • Hacker News Board

Re: Popular iPhone apps caught sending user location data to monetization firms

#191

Post by [deleted] » Sat, Sep 08, 2018, 4:35 PM UTC

kiallmacinnes wrote: post #107

MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

> The NOAA one isn’t made by the government, seems like using that name should be some kind of copyright infringement. I'm pretty sure copyright doesn't apply here! It's possible it's a trademark infringement? (No idea if the name or acronym are trademarked though), or possibly impersonation of a government entity? Either way, it's certainly not a copyright issue to use the name.

[deleted]

Re: Popular iPhone apps caught sending user location data to monetization firms

#192

Post by throwaway2048 » Sat, Sep 08, 2018, 4:39 PM UTC

acdha wrote: post #149

dschuetz wrote: post #82

Earlier quoted context omitted.

GPS data for a weather app is not necessary, because it's way to precise for its purpose. Most of the time I need to know how the weather is elsewhere, or how the weather is going to be today. How does precise (to a meter) GPS data help me there exactly?

Not to the meter but we get plenty of rainstorms where a half mile makes the difference between wet and dry, and Dark Sky’s push alerts are surprisingly useful.

There isn't weather stations every half mile.

Re: Popular iPhone apps caught sending user location data to monetization firms

#193

Post by ClassyJacket » Sat, Sep 08, 2018, 5:22 PM UTC

throwaway2048 wrote: post #192

acdha wrote: post #149

Earlier quoted context omitted.

Not to the meter but we get plenty of rainstorms where a half mile makes the difference between wet and dry, and Dark Sky’s push alerts are surprisingly useful.

There isn't weather stations every half mile.

Irrelevant, radar has accuracy at that level.

Re: Popular iPhone apps caught sending user location data to monetization firms

#194

Post by acdha » Sat, Sep 08, 2018, 5:33 PM UTC

throwaway2048 wrote: post #192

acdha wrote: post #149

Earlier quoted context omitted.

Not to the meter but we get plenty of rainstorms where a half mile makes the difference between wet and dry, and Dark Sky’s push alerts are surprisingly useful.

There isn't weather stations every half mile.

They use radar and software to predict storm growth and trajectories. Next time you look at a radar map ask yourself the physical size represented by one pixel: in much of the United States it should be something like 150m.

Re: Popular iPhone apps caught sending user location data to monetization firms

#195

Post by gameswithgo » Sat, Sep 08, 2018, 5:37 PM UTC

Good thing we submit to a monopolistic store model for our computing devices so we don't get malware.

end sarcasm

Re: Popular iPhone apps caught sending user location data to monetization firms

#196

Post by user5994461 » Sat, Sep 08, 2018, 5:37 PM UTC

tialaramex wrote: post #145

user5994461 wrote: post #143

Earlier quoted context omitted.

It's hardly doable in practice. For example, certificates have to be updated at least yearly, leaving your app completely broken unless updated.

1a. You don't have to pin the leaf. You can pin an intermediate 1b. Or you can pin the public key and ignore the certificate altogether, new certificates for the same key can be obtained as necessary. 2. The maximum certificate lifetime is currently 825 days, which, unless you're on another planet, is not "yearly". 3. If you're pinning for an application (not a generic website accessible in browsers) you don't need a…

1a. You can't control what root/intermediate will be used by your certificate supplier one year from now.

1b. You should not reuse private keys between certificates and never for intermediate or root.

2. It's yearly or 2 years for the most common suppliers.

3. Have fun getting your certificate accepted from every device and operating system.

Anyway. I am not saying that it can't be done, I'm saying that there are a lot of challenges to doing it properly and any mistake will make the app completely broken.

Re: Popular iPhone apps caught sending user location data to monetization firms

#197

Post by throwawaymath » Sat, Sep 08, 2018, 5:56 PM UTC

TeMPOraL wrote: post #95

willstrafach wrote: post #48

Earlier quoted context omitted.

The firms would then have a much harder time knowing if the information is genuinely from end users, if they no longer collect directly from user devices.

Basically, the scoundrels don't trust other scoundrels. That's what's saving us from getting server-rendered first-party ads on most websites, that would make adblocking much more difficult.

What you're describing already happens. The only way to defeat that is with client-side mitigations like uBlock. DNS-level mitigations like Pi-Hole will stop the content from loading if the ads aren't loaded.

Re: Popular iPhone apps caught sending user location data to monetization firms

#198

Post by throwawaymath » Sat, Sep 08, 2018, 6:02 PM UTC

willstrafach wrote: post #48

rjvir wrote: post #46

Earlier quoted context omitted.

I bet Apple will crack down on these location tracking SDKs, but it likely wouldn't eliminate this type of tracking. The main reason these apps are getting caught is because they are blatantly including the SDKs of the monetization firms in their client apps, and transparently sending data directly to the servers of those firms. But what's to stop a weather app from just doing it server-side, so it's undetectable to…

The firms would then have a much harder time knowing if the information is genuinely from end users, if they no longer collect directly from user devices.

A lot of firms (maybe most?) which buy this data actually don't care about that much as long as you can otherwise demonstrate the data is valid. If the data is predictive over time, it's valid, and most firms will happily accept that demonstration (with the proviso that they cease working with you once the data loses predictive value).

The reason the apps use those SDKs directly is because there's a hierarchy of resellers. The app developers themselves are lazy and typically want the SDK functionality which is provided free in return for their users' data. They're not always in the business of selling data themselves, they're just ambivalent.

Then the SDK providers abstract their own involvement in any particular app while still getting data.

Re: Popular iPhone apps caught sending user location data to monetization firms

#199

Post by rhizome » Sat, Sep 08, 2018, 6:08 PM UTC

Rapzid wrote: post #113

samstave wrote: post #103

Earlier quoted context omitted.

my point is that i dont need to install an app to type "temp in sf" in google and see if a jacket is needed.

Do you live in SF? I honestly can't tell if that is porposedly facetious or simply ignorant of the vast divesity of weather and weather reporting needs outside of SF..

Not to mention how rare it is for SF to have fewer than several microclimates operating at the same time.

Re: Popular iPhone apps caught sending user location data to monetization firms

#200

Post by walterbell » Sat, Sep 08, 2018, 6:15 PM UTC

tomaskafka wrote: post #184

Weather channel. Powers iOS built-in weather, and fetching actual weather data = sending exact user location every hour. I have no idea why Apple allows this (the whole point of making Apple maps was to stop google tracking iOS users and here a service is getting everything). (And Android - try to find an android phone where a default always on weather widget isn't preloaded on homescreen.)

Weather Channel is owned by IBM. Apple and IBM have a larger business partnership. IBM has a retail analytics business.

https://www.marketwatch.com/amp/story/guid/AABFA5DE-330F-11E...

> Deep Thunder combines big data and machine-learning tools from IBM Research with The Weather Company’s global forecasting model ... the tool will help companies with critical decision making. The data will be able to show how minor changes to weather, such as temperature, might affect things like consumer buying behavior, helping retailers to adjust their supply chains and shelve stock