Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPhones and 3G iPads log your location in an unencrypted file on the device

radar.oreilly.com

Post reply on HN
Print view View original

131–140 of 196 posts

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#131

Post by allwein »

allwein wrote: post #127

So after doing a quick analysis of the data on my iPhone, I've come to the conclusion that this isn't a huge issue at all. First, I'll start with the WiFi data (WifiLocation table): Among the information captured is MAC, Timestamp, and Lat/Long. I have a total of 118,640 records in my table. I did a "SELECT DISTINCT MAC FROM WifiLocation", and got... 118,640 records. This tells me that it's not "tracking my every mov…

I just ran the additional test I noted above. I went into Google Maps and had it locate my position. Then I did a new backup to look at the data again.

I had 9 additional records, all Timestamped identically, from while I was using Google Maps. However, there were 112 other records where the Timestamp was updated.

So again, it seems to only update the database when you use a Location Based Service. And it does update any existing records with a current timestamp.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#132

Post by phlux »

allwein wrote: post #127

So after doing a quick analysis of the data on my iPhone, I've come to the conclusion that this isn't a huge issue at all. First, I'll start with the WiFi data (WifiLocation table): Among the information captured is MAC, Timestamp, and Lat/Long. I have a total of 118,640 records in my table. I did a "SELECT DISTINCT MAC FROM WifiLocation", and got... 118,640 records. This tells me that it's not "tracking my every mov…

This may be "good enough for legal work" if they want to associate you with the location of a crime/event.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#134

Post by edw »

burgerbrain wrote: post #120
edw wrote: post #113

Earlier quoted context omitted.

No. Are you suggesting that Apple's highest moral obligation is preventing the collection of data that might conceivably expose their users' wrong-doing—e.g. their betrayal of their spouse? To be clear, the collection of the data is only a "problem" if it exposes you as a liar. And it's not a "problem" for the person who was lied to; it's a boon. And if you weren't cheating, well, showing your call or location logs m…

"collection of data that might conceivably expose their users' wrong-doing" So to answer his question honestly: Yes, you are implying exactly that.

No, I am not. I wrote, "Life is complicated."

Turn the issue around: how would you feel if Apple bent over backwards to help your partner fuck other people behind your back and leave no trace?

I don't know why I'm bothering to write this, because you seem resistant to the concept of moral subtlety, but I will anyway: Studies have been done that show that morally equivalent choices can be posed in ways that lead to people using different moral heuristics for making decisions and reliably making different choices.

People move through the world and leave traces of that movement. Where should device makers stand on the continuum between recording everything and distributing it to everyone and recording nothing (and erasing everything it possibly can) and making sure that no information about a user's actions can leak out.

Do you understand that this is not a binary choice? Do you understand that there are outcomes that you and I can agree to call good or bad that can result from making a decision anywhere along this continuum? Do you understand that there is no easy solution? Do you get it?

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#135

Post by jhowell »

runjake wrote: post #63

I didn't know this was news. I and other security researchers & law enforcement have known about it for a while. I assisted in one court case where the data was used as evidence. I suspect the slick-looking iPhoneTracker app finally made it interesting to the media. Edit: There was a similar deal on iOS 3 but it seemed more like a bug, not a feature. Data would be purged at some unpredictable interval. I can't recall…

Makes me curious about what else "isn't news" that I don't know about this "discovery". That's a lot of awkwardly disclosed (if at all), personal (why do they even care), unencrypted data points (I'd be in trouble for not encrypting) for the one of the world's most valuable companies to persist into eternity. Would it be news if this was MSFT?

Maybe the news just hasn't happened yet?

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#136

Post by tewks »

allwein wrote: post #127

So after doing a quick analysis of the data on my iPhone, I've come to the conclusion that this isn't a huge issue at all. First, I'll start with the WiFi data (WifiLocation table): Among the information captured is MAC, Timestamp, and Lat/Long. I have a total of 118,640 records in my table. I did a "SELECT DISTINCT MAC FROM WifiLocation", and got... 118,640 records. This tells me that it's not "tracking my every mov…

Great analysis which is the first I've seen to come up with a reasonable explanation for the existence of this file. Caching this data is a logical method by which to speed up location lookups.

However, there's no reason why this data should not be stored by default under the OS's "Data Protection" encryption as email is by default on devices where a passcode is set:

http://support.apple.com/kb/HT4175

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#137

Post by adsr »

phlux wrote: post #132
allwein wrote: post #127

So after doing a quick analysis of the data on my iPhone, I've come to the conclusion that this isn't a huge issue at all. First, I'll start with the WiFi data (WifiLocation table): Among the information captured is MAC, Timestamp, and Lat/Long. I have a total of 118,640 records in my table. I did a "SELECT DISTINCT MAC FROM WifiLocation", and got... 118,640 records. This tells me that it's not "tracking my every mov…

This may be "good enough for legal work" if they want to associate you with the location of a crime/event.

Not really, since you have physical access to the file you can edit it. That should immediately disqualify it as evidence. I think this type of data normally is gathered from the phone company when used as evidence, then the involved parties can not tamper with the file.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#138

Post by thought_alarm »

xsmasher wrote: post #133

I assume Apple collects this data to pass back to skyhook so they can update their database of wifi-to-geolocation data. Must be nice to have millions of sensors roaming around collecting data for you.

Other way around. It's a cache for CoreLocation, and the location data comes from Skyhook.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#139

Post by dustyreagan »

allwein wrote: post #127

So after doing a quick analysis of the data on my iPhone, I've come to the conclusion that this isn't a huge issue at all. First, I'll start with the WiFi data (WifiLocation table): Among the information captured is MAC, Timestamp, and Lat/Long. I have a total of 118,640 records in my table. I did a "SELECT DISTINCT MAC FROM WifiLocation", and got... 118,640 records. This tells me that it's not "tracking my every mov…

The problem is this data is being recorded without the user's knowledge or permission. (Unless it's a tiny line in the EULA I'm unaware of.)

If the data is being used to help the performance of Location Based Services, there is no need to keep years worth of data, that persists, and is backed-up every time you sync. Apple could simply keep a log of the last 4 or 5 data points.

Further, the data may not be super accurate, but that's only because the technology isn't good enough. If it were (and it will be eventually) that table would have pinpoint precise data. The precedent is being set right now. Is this ok? Personally I think this sort of behavior is unethical. Location tracking logs should be opt-in. It certainly shouldn't be hidden or a secret.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#140

Post by ugh »

allwein wrote: post #127

So after doing a quick analysis of the data on my iPhone, I've come to the conclusion that this isn't a huge issue at all. First, I'll start with the WiFi data (WifiLocation table): Among the information captured is MAC, Timestamp, and Lat/Long. I have a total of 118,640 records in my table. I did a "SELECT DISTINCT MAC FROM WifiLocation", and got... 118,640 records. This tells me that it's not "tracking my every mov…

Location tracking on iOS devices without GPS (for example an iPod touch) sometimes works without any internet connection (it nearly always works with an internet connection – WLAN access points are used to determine the approximate location), especially in urban environments (with a lot of WLAN access points). I always figured that iOS devices download location info on all the surrounding WLAN access points (maybe even those not in range – it seemed like that in my tests) as soon as you use location services and are connected to the internet.

This database could have something to do with that.

Post reply on HN