Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular iPhone apps caught sending user location data to monetization firms

techcrunch.com

Post reply on HN
Print view View original

241–250 of 261 posts

Re: Popular iPhone apps caught sending user location data to monetization firms

#241

Post by trendia »

jscheel wrote: post #169

From the article: "[ASKfm] asks for access to a user’s location that “won’t be shared with anyone.” But the app sends that location data to two data firms, AreaMetrics and Huq. When reached, the app maker said it believes its location collection practices “fit industry standards, and are therefore acceptable for our users.” Surely this is legally actionable activity, right?

Data collection fits "Industry standards" because the industry is inherently corrupt -- Adtech requires immense user data because they chose to target users rather than content.

Re: Popular iPhone apps caught sending user location data to monetization firms

#242

Post by TeMPOraL »

acdha wrote: post #148
TeMPOraL wrote: post #101

Earlier quoted context omitted.

> the app collects no data whatsoever. i have no idea what your IP address is (the app connects directly to environment canada to retrieve the raw radar data). no crash data/telemetry is collected automatically !!! You're the best. Thank you! Unfortunately not US/Can, otherwise I'd immediately switch to your app just because of that (I'd buy it anyway if it was paid, just to show support). I wish more devs would have…

Crash logging is extremely useful for catching edge cases or third party failures so I wouldn’t give that up but there’s no reason why it can’t involve the user with a Firefox-style “is it okay to report this? Here’s what gets sent…” prompt and aggressive data scrubbing. Sentry does a really nice job of restricting the data which is stored, for how long, and scrubbing things which might have been included by mistake.…

RE crash-logging Firefox-style, apps that do it this way gain a lot of respect from me, especially if they let me see the contents of the report before sending. I've even seen one or two Android apps that would handle bug reports by firing up an intent for sending e-mail, which when directed to the mail app, resulted with a new message, already filled in with all details, just waiting for you to press Send.

Re: Popular iPhone apps caught sending user location data to monetization firms

#243

Post by tinus_hn »

conradev wrote: post #218
tinus_hn wrote: post #152

Earlier quoted context omitted.

Clever but if you try tricks like that you can’t use the system libraries which is rather inconvenient.

As far as I know, all of the above is possible to implement with the hooks that the system provides, at least on iOS.

If you submit an app you have to set a flag indicating what kind of communication you’re going to use. If it’s not a secure connection using valid certificates you have to use the ‘insecure connection’ flag and that will cause extra review steps. If there’s no good reason you’ll be denied.

Re: Popular iPhone apps caught sending user location data to monetization firms

#244

Post by willstrafach »

someguydave wrote: post #235
willstrafach wrote: post #18

Earlier quoted context omitted.

A lot of work went into rooting out these trackers, what data they sent, and what apps they were in. We used a combination of static code analysis for each, runtime analysis (eg. Corellium), and network packet capture/analysis. The good news is that only that last part is required if you would like to try this, now that the commonly used hostnames are published. Folks can add the full list to a system such as Pi-Hole…

Why doesn't Apple disclose the entitlements they have approved for every app on the app store?

Approving entitlements is exceptionally rare honestly.

The only app I have found this happen with is Uber:

https://www.businessinsider.com/uber-iphone-app-secret-acces...

Re: Popular iPhone apps caught sending user location data to monetization firms

#245

Post by willstrafach »

sitkack wrote: post #222
willstrafach wrote: post #155

Earlier quoted context omitted.

> Niche startup idea, VPN for your mobile device that can analyze and block traffic. This is indeed what we (originators of this location tracking research) do.

Do you have it as a service, or a set of OpenVPN scripts I can install? I could see a nice Grafana dashboard of my outbound traffic. Install your cert on my device, break into sessions and then further analyze traffic.

This will be a commercial service, in order to fund ongoing research efforts allowing us to quickly discover and block all possible forms of tracking, phishing, and other malicious traffic.

That said, in the future, lists will be published for folks with the ability and time to operate a Pi-Hole for themselves, if preferred.

Re: Popular iPhone apps caught sending user location data to monetization firms

#246

Post by willstrafach »

walterbell wrote: post #35
willstrafach wrote: post #19

Earlier quoted context omitted.

Ours (guardianapp) does exactly this as well, although exclusively for iOS. We are using the data we glean from the static + runtime analysis for an upcoming mobile firewall app but are open to other interesting opportunities. Please feel free to send a message at any time, even if you would just like to compare notes on all this (hello@sudosecuritygroup.com).

Is your mobile firewall app going to implement iOS MDM, e.g. to enable per-app VPNs?

This will be available in the future, but was deemed too complicated for most mainstream users.

The initial default will be to simply offer a button called “Protect” and app handles all the rest.

Re: Popular iPhone apps caught sending user location data to monetization firms

#247

Post by danjoc »

A2017U1 wrote: post #96
danjoc wrote: post #12

Earlier quoted context omitted.

The EFF is just astroturfing, https://thebaffler.com/salvos/all-effd-up-levine >A solution for a few outliers doesn’t really influence the big picture. There's nothing stopping anyone from buying a Purism 5. If someone doesn't care about their privacy, they don't deserve it. Freedom isn't free, and all that.

>There's nothing stopping anyone from buying a Purism 5 Apart from the fact that it doesn't actually exist yet. Not to mention it's already a badly specced phone commanding top dollar being made by a small company that could easily go broke in a year. I'm all for what they are trying to achieve and really hope they succeed, but history is full of privacy phones that have failed spectacularly. For half the price I cou…

>Apart from the fact that it doesn't actually exist yet.

Well, sure, I'll give you that point, but it's going to happen.

>it's already a badly specced phone commanding top dollar

The selling point isn't the specs. It's the RYF certification and kill switches. Even if they can't get the RYF, it's still a better option than anything else out there.

>being made by a small company that could easily go broke in a year

I really doubt that. They have a laptop business already. They've been doing hardware for a while. This one might ship months late, but I'm confident it will happen.

>For half the price I could get a flagship Xiaomi, flash LineageOS on it and have a completely degoogled high quality Android phone likely supported for most of the next decade.

Yep, and you still have a sealed battery, a backdoored baseband, and binary blobs. The iMX.8 is pretty sweet. It has open source GPU. Can't say that for mali or powervr. I can consider making Librem 5 my convergence device.

Re: Popular iPhone apps caught sending user location data to monetization firms

#248

Post by null0pointer »

aaaaaaaaaab wrote: post #188
driverdan wrote: post #174

Earlier quoted context omitted.

You didn't ask what it was or where it came from?

I’ve asked, but my concerns were taken as a joke, because in the past I’ve constantly been complaining about our data collection practices. I was objecting when the marketig team pushed in the AppsFlyer SDK, then the Branch.io SDK, then the Google AdMob SDK, then the MoPub SDK, then the ComScore SDK, then the Saasquatch SDK, then the Kahuna SDK. The Facebook SDK is included too, of course. So after all this complaini…

What would it take for you to quit? Citing data collection practices as your reason.

Don't have to answer, I'm just curious as it seems your morals are at odds with your companies.

Re: Popular iPhone apps caught sending user location data to monetization firms

#249

Post by patoh »

sitkack wrote: post #99

How do I blackhole all traffic to these 3rd party data collection companies? The apps aren't even using their own bandwidth. This is a disgrace that Apple is allowing this and doesn't provide a control to monitor or stop it.

AdGuard Pro can do DNS blocking on iOS. The default AdGuard server selection will block tracking requests.

If you only want to block malware, or other more serious badness, you can opt for others servers such as Quad9 or OpenDNS .

Edit: AdGuard is also (partially?) opensource - https://github.com/AdguardTeam

Re: Popular iPhone apps caught sending user location data to monetization firms

#250

Post by aaaaaaaaaab »

null0pointer wrote: post #248
aaaaaaaaaab wrote: post #188

Earlier quoted context omitted.

I’ve asked, but my concerns were taken as a joke, because in the past I’ve constantly been complaining about our data collection practices. I was objecting when the marketig team pushed in the AppsFlyer SDK, then the Branch.io SDK, then the Google AdMob SDK, then the MoPub SDK, then the ComScore SDK, then the Saasquatch SDK, then the Kahuna SDK. The Facebook SDK is included too, of course. So after all this complaini…

What would it take for you to quit? Citing data collection practices as your reason. Don't have to answer, I'm just curious as it seems your morals are at odds with your companies.

True, and I'm already working on it! :fingerscrossed:
Post reply on HN