Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular iPhone apps caught sending user location data to monetization firms

techcrunch.com

Post reply on HN
Print view View original

231–240 of 261 posts

Re: Popular iPhone apps caught sending user location data to monetization firms

#231

Post by saagarjha »

MBCook wrote: post #168
saagarjha wrote: post #74

Earlier quoted context omitted.

Safari extensions can do the same, both on macOS on iOS (though significantly reduced, since loading the extension requires user interaction).

My understanding was you couldn’t even have extensions on iOS, except for ad blocker style things which are explicitly limited by API to prevent blocker from knowing what it was blocking due to tracking concerns. I may be wrong about safari on Mac iOS.

No, there are extensions for both macOS and iOS. For iOS the user needs to explicitly tap the extension for each page they want it work on, while on macOS it can run on every page once it’s been approved.

Re: Popular iPhone apps caught sending user location data to monetization firms

#232

Post by saagarjha »

aaaaaaaaaab wrote: post #114

The company I work for was acquired by a Chinese giant. Recently they sent us a static lib (i.e. no source available) to include in our app for “fraud detection”. We complied.

If you’re curious about it and free to do so, you could send it to me and I could run it though a disassembler.

Re: Popular iPhone apps caught sending user location data to monetization firms

#233

Post by saagarjha »

dschuetz wrote: post #90
saagarjha wrote: post #83

Earlier quoted context omitted.

It's easy to figure out what an iOS device is connecting to: use a network extension that inspects network traffic. And given that Apple has none of the restrictions they impose on third party developers, they can essentially do what Little Snitch does on macOS.

There is no way to control the iOS firewall via extensions in iOS. Meaning, it's still not supported, and what you see as "essentially" the same misses the point. I want to block connections of specific apps. What iOS can do is reveal connections made by the network device to the outside. Duh. Set up Wireshark on some AP and get the same info.

Make a VPN extension and drop all traffic you don’t want. Viola, a poor man’s firewall.

Re: Popular iPhone apps caught sending user location data to monetization firms

#234

Post by willstrafach »

ma2rten wrote: post #226
willstrafach wrote: post #214

Earlier quoted context omitted.

I personally believe this is unlikely, because then the firms paying for this data will not be so sure that the information is legitimate, whereas collecting directly from user devices makes fraud more difficult.

Are you sure that that is actually a big problem for them? I imagine it would be quite hard to convincingly fake user data data. I could also imagine ways around that. For instance their proprietary SDK could generate the data and cryptographically sign it. Or they could require that app makers set up a special subdomain that points to their ip address. I guess it would only be worth the trouble if enough people care…

Not certain what you mean about the IP address, but for signing it, they would need to bundle a key and that could be extracted.

It is a genuinely tricky challenge from their perspective.

Re: Popular iPhone apps caught sending user location data to monetization firms

#235

Post by someguydave »

willstrafach wrote: post #18
walterbell wrote: post #4

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

A lot of work went into rooting out these trackers, what data they sent, and what apps they were in. We used a combination of static code analysis for each, runtime analysis (eg. Corellium), and network packet capture/analysis. The good news is that only that last part is required if you would like to try this, now that the commonly used hostnames are published. Folks can add the full list to a system such as Pi-Hole…

Why doesn't Apple disclose the entitlements they have approved for every app on the app store?

Re: Popular iPhone apps caught sending user location data to monetization firms

#236

Post by jplayer01 »

ekianjo wrote: post #131
jplayer01 wrote: post #124

Earlier quoted context omitted.

How do I get FDroid on my iPhone?

You dont have to restrict yourself to using an Iphone. Embrace choice.

So I have to settle with an environment that doesn't value privacy or security on a hardware or software level because of some vague ideal of free choice. Okay.

Re: Popular iPhone apps caught sending user location data to monetization firms

#237

Post by Too »

MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

> Of course some of these apps, like the ones that you NEED to use for certain parking meters, are especially evil because there is an any choice. If you need that service, you’re giving up your privacy.

It's amazing neither iOS nor Android has a location picker/Intent that can be launched by the OS to give an app a one time location. Like the ones that exist for contacts, picking photos or sharing links[1].

For parking meter apps i only want to give location access when i press the "find closest parking" button, never else.

While we are on the topic, app store reviews should also be much stricter on enforcing usage of standard Intents. Many apps request full contact list, camera and full file system permission when they could use Intents for all their use cases. Maybe enforcing is a bit strict but apps not following the spirit of the OS architecture and requiring more permissions than needed should be ranked lower in app store rating and search results.

[1] https://developer.android.com/guide/components/intents-commo...

Re: Popular iPhone apps caught sending user location data to monetization firms

#239

Post by phobosdeimos »

jimnotgym wrote: post #135
MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

> Of course some of these apps, like the ones that you NEED to use for certain parking meters, are especially evil because there is an any choice. If you need that service, you’re giving up your privacy. Which of course makes it a direct violation of GDPR. I hope a group of European citizens take some action

Actually you don't need to give location. Parking meters have a four digit code written on them that you can use instead. Location is just for convenience.

Re: Popular iPhone apps caught sending user location data to monetization firms

#240

Post by phobosdeimos »

LeoPanthera wrote: post #9
mrfusion wrote: post #7

I’m confused. On iPhone you control which apps get location data. You also get warnings on the top of the screen when an app is using your location. How are these apps getting around that?

I don't know if it's possible anymore, but one way used to be that the app would send a list of every wifi network it could see. This can be used to calculate your position surprisingly accurately, in most places in the world.

Disable WiFi scanning. One of those settings that is hidden and 95% of users have never heard off.
Post reply on HN