Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular iPhone apps caught sending user location data to monetization firms

techcrunch.com

Post reply on HN
Print view View original

211–220 of 261 posts

Re: Popular iPhone apps caught sending user location data to monetization firms

#211

Post by crtasm »

walterbell wrote: post #38
MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

In the US, high quality weather data and forecasts can be bookmarked as a web page/icon for your zip code, https://www.weather.gov . Works well and no data leakage.

But you do get Google analytics and the dodgy sounding 4seeresults.com and cfigroup.com embeds.

Re: Popular iPhone apps caught sending user location data to monetization firms

#212

Post by pbhjpbhj »

MBCook wrote: post #166
kiallmacinnes wrote: post #107

Earlier quoted context omitted.

> The NOAA one isn’t made by the government, seems like using that name should be some kind of copyright infringement. I'm pretty sure copyright doesn't apply here! It's possible it's a trademark infringement? (No idea if the name or acronym are trademarked though), or possibly impersonation of a government entity? Either way, it's certainly not a copyright issue to use the name.

You’re right, trademark infringement just what I should’ve written. It’s probably fine legally. They’re showing new NOAA weather data, so calling it a “NOAA weather“ or “NOAA Radar” is correct, just misleading.

Usually "misleading" is what Trademarks are intended to prevent. If it's misleading (in the EU at least) then it's most likely an infringement.

"NOAA weather" as the app name implies that the direct source of the _app_ is NOAA, "Weather using NOAA data" and similar wording disambiguates and avoids trademark infringement (and/or passing off ["misappropriation"/misrepresentation in USA] - which is a very weak unregistered version of Trademark which this situation nonetheless appears to fall foul of).

Re: Popular iPhone apps caught sending user location data to monetization firms

#213

Post by dawnerd »

binomialxenon wrote: post #201
dawnerd wrote: post #108

Earlier quoted context omitted.

pihole is really easy to setup and the default block list gets a large chunk.

Pi-hole is great and all, but people use their phones on mobile data too and on various other WLANs away from home.

Yeah I wish Apple let us put custom dns for mobile data. Can always just vpn to your own network.

Re: Popular iPhone apps caught sending user location data to monetization firms

#214

Post by willstrafach »

ma2rten wrote: post #210
willstrafach wrote: post #18

Earlier quoted context omitted.

A lot of work went into rooting out these trackers, what data they sent, and what apps they were in. We used a combination of static code analysis for each, runtime analysis (eg. Corellium), and network packet capture/analysis. The good news is that only that last part is required if you would like to try this, now that the commonly used hostnames are published. Folks can add the full list to a system such as Pi-Hole…

now that the commonly used hostnames are published. The problem I see with that is that apps could easily start proxying the requests though their own servers.

I personally believe this is unlikely, because then the firms paying for this data will not be so sure that the information is legitimate, whereas collecting directly from user devices makes fraud more difficult.

Re: Popular iPhone apps caught sending user location data to monetization firms

#216

Post by xenophonf »

kiallmacinnes wrote: post #107
MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

> The NOAA one isn’t made by the government, seems like using that name should be some kind of copyright infringement. I'm pretty sure copyright doesn't apply here! It's possible it's a trademark infringement? (No idea if the name or acronym are trademarked though), or possibly impersonation of a government entity? Either way, it's certainly not a copyright issue to use the name.

The Lanham Act prevents anyone from registering trademarks that "Consists of or comprises the flag or coat of arms or other insignia of the United States, or of any State or municipality, or of any foreign nation, or any simulation thereof":

https://www.law.cornell.edu/uscode/text/15/1052

That includes government agencies themselves:

https://cases.justia.com/federal/appellate-courts/cafc/12-13...

Re: Popular iPhone apps caught sending user location data to monetization firms

#218

Post by conradev »

tinus_hn wrote: post #152
tialaramex wrote: post #145

Earlier quoted context omitted.

1a. You don't have to pin the leaf. You can pin an intermediate 1b. Or you can pin the public key and ignore the certificate altogether, new certificates for the same key can be obtained as necessary. 2. The maximum certificate lifetime is currently 825 days, which, unless you're on another planet, is not "yearly". 3. If you're pinning for an application (not a generic website accessible in browsers) you don't need a…

Clever but if you try tricks like that you can’t use the system libraries which is rather inconvenient.

As far as I know, all of the above is possible to implement with the hooks that the system provides, at least on iOS.

Re: Popular iPhone apps caught sending user location data to monetization firms

#219

Post by conradev »

user5994461 wrote: post #196
tialaramex wrote: post #145

Earlier quoted context omitted.

1a. You don't have to pin the leaf. You can pin an intermediate 1b. Or you can pin the public key and ignore the certificate altogether, new certificates for the same key can be obtained as necessary. 2. The maximum certificate lifetime is currently 825 days, which, unless you're on another planet, is not "yearly". 3. If you're pinning for an application (not a generic website accessible in browsers) you don't need a…

1a. You can't control what root/intermediate will be used by your certificate supplier one year from now. 1b. You should not reuse private keys between certificates and never for intermediate or root. 2. It's yearly or 2 years for the most common suppliers. 3. Have fun getting your certificate accepted from every device and operating system. Anyway. I am not saying that it can't be done, I'm saying that there are a l…

> Have fun getting your certificate accepted from every device and operating system.

You have full control in a native iOS app over which certificates you accept or reject. Which is why the author specified that the trick would work if the endpoint is just for apps.

Post reply on HN