IPhones and 3G iPads log your location in an unencrypted file on the device • Hacker News Board

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#111

Post by calloc » Wed, Apr 20, 2011, 6:00 PM UTC

flipbrad wrote: post #41

edw wrote: post #32

Does no one else agree with me that this is awesome? I love being able to visualize my comings and goings. It's the story of the last year or so of my life, in colored dots. I hope Apple doesn't respond to the "outrage" by no longer collecting this data. To a first order approximation, I am with Scott McNealy over in the "Privacy?! Get over it" camp: http://www.wired.com/politics/law/news/1999/01/17538 As an aside, c…

if the feature was opt-in it might, conceivably, be called awesome. But not being told that my iDevice will log my every move and leave this data open to the next johnny-come-lately to get his hands on my device? Terribly uncool. Logging should be a setting, or better, an app. Not a hidden, no opt-out feature imposed on over a hundred million iDevice owners.

Set up a passcode, now they can't access the data on your phone unless they have the passcode, or your iTunes plist file ...

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#112

Post by ChuckMcM » Wed, Apr 20, 2011, 6:06 PM UTC

chadp wrote: post #31

Someone should make an app for jailbroken phones to disable this location logging (or delete it regularly).. many would likely pay for it!

Interesting idea, although I actually like just injecting noise (add say 500nm to all of the co-ordinates or some such) which would basically corrupt the database that this was being injected into.

On a more interesting note if you put '); droptable; into your file could you delete the receiving database? A whole new vector for SQL injection hacks I suspect.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#113

Post by edw » Wed, Apr 20, 2011, 6:14 PM UTC

crocowhile wrote: post #106

edw wrote: post #103

Earlier quoted context omitted.

Yes, evidence is a problem for people who do things that have legal or economic consequences. Of course, actions often have moral and ethical consequences even if they leave no evidence behind.

Are you suggesting that a privacy leak is a concern only for those who have something to hide?

No. Are you suggesting that Apple's highest moral obligation is preventing the collection of data that might conceivably expose their users' wrong-doing—e.g. their betrayal of their spouse?

To be clear, the collection of the data is only a "problem" if it exposes you as a liar. And it's not a "problem" for the person who was lied to; it's a boon. And if you weren't cheating, well, showing your call or location logs might be a way of saying, "Look, I have nothing to hide."

Privacy vs. disclosure of data is a complicated issue. It involves issues of personal autonomy as well as trust. Do you give up some autonomy because you know that people know what you're doing at any moment? Of course. But there is often a pay-off to doing so: people actually trust you.

Life is complicated, and you can't down-vote moral complexity out of life, no matter how high your karma is.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#114

Post by huhtenberg » Wed, Apr 20, 2011, 6:19 PM UTC

ImprovedSilence wrote: post #30

desigooner wrote: post #19

It might not be directly related but there was a news story on CNET [1] yesterday about cops in Michigan using a device from Cellebrite to download information from phones of people they stopped for violations that includes contacts, phone logs, messages, photographs and location history. Does Apple's decision of having such information stored on the phone unencrypted make it easy for such devices? The device claims…

I've actually used that device before. It's fairly common in law enforcement and inteligence agencies, and it will take everything. Including passwords/deleted info. There is no reason for using it on a traffic stop though, that's just straight up invasion of privacy and would piss me off to no end. It's use is (and should be) for the more criminal/forensic cases.

I wonder if that device utilizes some form of "law enforcement backdoor API", a phone analog of the "lawful intercept" in networking. Because frankly I don't understand how else it could retrieve previously deleted data from the phone.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#115

Post by burgerbrain » Wed, Apr 20, 2011, 6:21 PM UTC

kovar wrote: post #66

cooldeal wrote: post #23

Earlier quoted context omitted.

http://www.thenewspaper.com/news/34/3458.asp

There's a lot of marketing hype in here. There are a lot of mobile device collection tools and none of them fully collect every device out there. Also, collecting a 64GB i over USB will take at least 24 minutes. (You don't really just want the photos, do you.) That makes for a long traffic stop.

24 minutes is a long traffic stop? Have you never been pulled over for speeding? That's a positively snappy traffic stop...

Also, what the hell are you doing turning over your phone to police officers during traffic stops......

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#116

Post by kovar » Wed, Apr 20, 2011, 6:22 PM UTC

awakeasleep wrote: post #107

I wish this wasn't presented as sinister. The fact is, that phone companies store all that data for EVERY cell phone, and it's always available to government agencies and divorce attorneys after a subpoena. All this does is raise the common man's awareness , and possibly provides an afternoon of fun looking at your travel history. If you want your iphone data secret, it prompts you to encrypt your backups when you fi…

The issue is that this data used to only be available via the service provider. Now it is available from the device, and the device it syncs to.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#117

Post by kovar » Wed, Apr 20, 2011, 6:24 PM UTC

runjake wrote: post #63

I didn't know this was news. I and other security researchers & law enforcement have known about it for a while. I assisted in one court case where the data was used as evidence. I suspect the slick-looking iPhoneTracker app finally made it interesting to the media. Edit: There was a similar deal on iOS 3 but it seemed more like a bug, not a feature. Data would be purged at some unpredictable interval. I can't recall…

Given the response on HTCIA, HTCC, and the CCE lists, this was news to many people in the LE community. I think your edit touches on the difference - this is a new source for the information, and it is very easy to collect from the sync host.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#118

Post by burgerbrain » Wed, Apr 20, 2011, 6:24 PM UTC

edw wrote: post #105

bigohms wrote: post #91

Earlier quoted context omitted.

I found the comparison was very apropos to the context and useful. Call me simplistic, but I'm glad it was cast and totally not inflamed (save for my original inflammation towards Apple).

It's not apropos. Can you be raped by your vibrator or your blow up doll? This is about a device passively logging data, not a moral agent doing something to you. Show me the person that Apple has hurt. The only people I've been reading about here taking actions are law enforcement officials, people in black helicopters, and betrayed lovers.

"Can you be raped by your vibrator or your blow up doll?"

If either of those has sex with me without my consent, then yes. I would call that rape. Who in their right mind wouldn't?

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#119

Post by anonymous246 » Wed, Apr 20, 2011, 6:25 PM UTC

edw wrote: post #109

anonymous246 wrote: post #99

Earlier quoted context omitted.

I think he asked for the full database dump, not a meaningless country-level zoomed screenshot. But I give you props for revealing even this much; I would have certainly not done so.

I was going to do so, if only to prove that I don't give a shit, but after glancing at the instructions, I'm not going to do it unless someone provides me with a shell script. It's too much of a pain in the ass. But if any of you are pathetic and creepy enough to want to know where I was on any particular day, feel free to send me e-mail at edw@poseur.com and I'll let you know.

Do you use Mac? It seems writing a script would be easier for Mac. I can try to cook one up. I will post it here if I succeed.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#120

Post by burgerbrain » Wed, Apr 20, 2011, 6:29 PM UTC

edw wrote: post #113

crocowhile wrote: post #106

Earlier quoted context omitted.

Are you suggesting that a privacy leak is a concern only for those who have something to hide?

No. Are you suggesting that Apple's highest moral obligation is preventing the collection of data that might conceivably expose their users' wrong-doing—e.g. their betrayal of their spouse? To be clear, the collection of the data is only a "problem" if it exposes you as a liar. And it's not a "problem" for the person who was lied to; it's a boon. And if you weren't cheating, well, showing your call or location logs m…

"collection of data that might conceivably expose their users' wrong-doing"

So to answer his question honestly: Yes, you are implying exactly that.