Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular iPhone apps caught sending user location data to monetization firms

techcrunch.com

Post reply on HN
Print view View original

201–210 of 261 posts

Re: Popular iPhone apps caught sending user location data to monetization firms

#201

Post by binomialxenon »

dawnerd wrote: post #108
lawnchair_larry wrote: post #51

I really wish there was a reliable way to just shitlist all of these affiliate/analytics/tracking/ad SDKs device-wide. Third party SDKs sending who-knows-what to who-knows-where is such a plague in the app ecosystem, and even the developers including them seem to have no idea what the implications are. I don’t want any of them, ever.

pihole is really easy to setup and the default block list gets a large chunk.

Pi-hole is great and all, but people use their phones on mobile data too and on various other WLANs away from home.

Re: Popular iPhone apps caught sending user location data to monetization firms

#202

Post by traviswingo »

walterbell wrote: post #4

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

I’ve reverse engineered ssl encrypted iPhone app traffic before using Charles proxy and a self generate ssl cert to decrypt the requests. From there, you can see which endpoints are receiving what data in plain English.

I’ve only done this for apps not using certificate pinning. It gets more complicated from there.

Re: Popular iPhone apps caught sending user location data to monetization firms

#203

Post by willstrafach »

aaaaaaaaaab wrote: post #188
driverdan wrote: post #174

Earlier quoted context omitted.

You didn't ask what it was or where it came from?

I’ve asked, but my concerns were taken as a joke, because in the past I’ve constantly been complaining about our data collection practices. I was objecting when the marketig team pushed in the AppsFlyer SDK, then the Branch.io SDK, then the Google AdMob SDK, then the MoPub SDK, then the ComScore SDK, then the Saasquatch SDK, then the Kahuna SDK. The Facebook SDK is included too, of course. So after all this complaini…

Anonymous tips accepted at hello@sudosecuritygroup.com

Re: Popular iPhone apps caught sending user location data to monetization firms

#204

Post by willstrafach »

ccnafr wrote: post #119
maxden wrote: post #2

This is the report the article is based on https://guardianapp.com/ios-app-location-report-sep2018.html

Funny that HN mods always replace links to original sources except TechCrunch... TC can post all the blog-spam they want

To be somewhat fair in this case, the TC author got an advance copy of the reporting and data in order to get some company responses included, so I suppose there is a value-add in that respect.

Re: Popular iPhone apps caught sending user location data to monetization firms

#205

Post by willstrafach »

tombrossman wrote: post #123
lawnchair_larry wrote: post #51

I really wish there was a reliable way to just shitlist all of these affiliate/analytics/tracking/ad SDKs device-wide. Third party SDKs sending who-knows-what to who-knows-where is such a plague in the app ecosystem, and even the developers including them seem to have no idea what the implications are. I don’t want any of them, ever.

A reasonable compromise would be to have some way of determining which apps don't do this prior to installing them, such as a paid app that does not need to rely on ads and proactively declares this in the app description. Google Play clearly labels adware and I am genuinely surprised that Apple's App Store does not. I am happy to pay for apps that do not contain adverts or unnecessary tracking, but I have no way of…

For iOS, there will be: https://guardianapp.com

Also, we will either provide a searchable app index, or freely share findings/info with parties such as Exodus (This has not been fully decided as of yet).

Re: Popular iPhone apps caught sending user location data to monetization firms

#206

Post by willstrafach »

krausejj wrote: post #171
krausejj wrote: post #164

Why isn’t Google on this list? Is it because they monetize your location data in-house?

(this was meant to be snarky. i'm just a developer with a calendar app that requests location data to humbly provide location place recommendations... no monetization, no sharing of this data, and it's essential to being able to fill out the "location" field accurately. this constant stream of negative attacks against apps not built by FAANG is destroying trust in independent apps, due to the actions of a few bad act…

Respectfully, one goal of doing this research was to shine a light on those who are engaging in these practices, so that users who dislike it can potentially find alternatives.

This is a good thing for any apps who do things right.

Re: Popular iPhone apps caught sending user location data to monetization firms

#207

Post by MBCook »

ChuckMcM wrote: post #66
MBCook wrote: post #61

Earlier quoted context omitted.

There are plenty of counterexamples to that. People making small games they want to give away for free, utilities that are too small to be able to charge for, free apps that have additional features behind an IAP or subscription. Just because an app it’s free doesn’t mean it has to be something incredibly scummy.

#1 source of malware on the Android ecosystem was flashlight apps. I don't disagree that there are examples of apps or code that people have written and given away for free just because, my comment was more along the lines of "companies" giving away a free app.

I remember them being a huge chunk of the scam/ad ecosystem on iOS before it was integrated into the OS a couple versions ago.

Re: Popular iPhone apps caught sending user location data to monetization firms

#208

Post by jefftk »

manmal wrote: post #129

My wife recently was at a certain chain store for books and paper accessories. She did not interact with Amazon in the store, and does not have the Amazon app installed. And yet, just minutes later, she started receiving Amazon recommendations for exactly the kind of items you would expect at the store she had been. I told her that this a coincidence, but other apps sending her location could actually explain it.

Did she buy something there with a credit card? That data is commonly resold.

Re: Popular iPhone apps caught sending user location data to monetization firms

#209

Post by AndrewHart »

"researchers found 24 popular iPhone apps that were collecting location data — like Bluetooth beacons to Wi-Fi network names... and cell network names."

A point of note - finding the names of wireless routers, or cell network - requires calling private APIs, so those apps should be banned from the store on that basis alone.

Re: Popular iPhone apps caught sending user location data to monetization firms

#210

Post by ma2rten »

willstrafach wrote: post #18
walterbell wrote: post #4

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

A lot of work went into rooting out these trackers, what data they sent, and what apps they were in. We used a combination of static code analysis for each, runtime analysis (eg. Corellium), and network packet capture/analysis. The good news is that only that last part is required if you would like to try this, now that the commonly used hostnames are published. Folks can add the full list to a system such as Pi-Hole…

now that the commonly used hostnames are published.

The problem I see with that is that apps could easily start proxying the requests though their own servers.

Post reply on HN