Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple allows some iOS apps to track user locations via lists of nearby SSIDs

wingu.se

Post reply on HN
Print view View original

41–50 of 327 posts

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#41

Post by ghusto »

mrtksn wrote: post #3

TL;DR: Apps can access the nearby Wi-Fi hotspot SSID and MAC addresses through an API that is intended to help with connecting to hotspots. Then they can use this info to look-up in databases that collect SSIDs based on their locations. Seems like a valid concern, though the author's writing style can be off putting since has a tone with an agenda. However, AFAIK apps need to declare the use of this API and have a go…

> TL:DR; Apps can access the nearby Wi-Fi hotspot SSID and MAC addresses through an API that is intended to help with connecting to hotspots. Then they can use this info to look-up in databases that collect SSIDs based on their locations.

This is the whole story. Thank you for writing it, and sorry that you're getting downvoted for it.

> I'm sorry you don't like it but that's the truth, the author left out crucial details to make it juicier

I wish there was a way to know when people had downvoted with "this is true but I don't like that it's true".

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#42

Post by intelVISA »

karmakaze wrote: post #31
mrpippy wrote: post #12

It’s worth noting that use of NEHotspotHelper requires a special entitlement (com.apple.developer.networking.HotspotHelper) that you have to apply for, and presumably Apple won’t grant unless your app has a legitimate need for it. That said, this maybe shows an incompatibility between Apple’s privacy strategy and “super-apps” like WeChat and AliPay. When a company shoves all functionality into one app, that app sudde…

> presumably Apple won’t grant unless your app has a legitimate need for it. Increasingly clear that Apple is in charge of what happens on your devices not the users themselves.

Wasn't it ever thus?

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#44

Post by rkunde »

eduction wrote: post #40

I thought users were prompted to give permission for this already? I get asked if I want to give “local network” access to apps sometimes (- lot these days actually) which I take to mean the ability to see local WiFi hotspots. I almost always deny this (and after reading this just turned it off for Spotify). I think the dialog that asks for permission could be improved, though, as most people don’t realize this can b…

That’s for sending and receiving local network traffic, eg. talking to devices on the same subnet, and discovery of Chromecast and similar targets.

Edit: AirPlay does not require this permission.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#45

Post by dylan604 »

INGSOCIALITE wrote: post #4
mrtksn wrote: post #3

TL;DR: Apps can access the nearby Wi-Fi hotspot SSID and MAC addresses through an API that is intended to help with connecting to hotspots. Then they can use this info to look-up in databases that collect SSIDs based on their locations. Seems like a valid concern, though the author's writing style can be off putting since has a tone with an agenda. However, AFAIK apps need to declare the use of this API and have a go…

i wouldn't be worried about my flashlight app tracking me, i'd be worried about the large players who probably GET the use of this API, google facebook etc etc.

I would absolutely be concerned about a flashlight app doing all the nefarious things. A flashlight app? Today? Still? Really? It's one of those apps that's absolutely useless since the OS provides this feature natively now. It is absolutely the type of app I would assume has no reason other than harvesting data.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#46

Post by wwtrv »

mrtksn wrote: post #17
INGSOCIALITE wrote: post #4

Earlier quoted context omitted.

i wouldn't be worried about my flashlight app tracking me, i'd be worried about the large players who probably GET the use of this API, google facebook etc etc.

As I said, it's a valid concern. However the author forget the mention that you need to apply and get approved to use this API. I find it dishonest and alarmist. Here's the request form that you fill up for it: https://developer.apple.com/contact/request/hotspot-helper/

> However the author forget the mention that you need to apply and get approved to use this API.

And? How is this any better? e.g. if I'm a dissident/etc. in China I would be much concerned about government affiliated large corporations being able to track my location than some random private developer (not that this specific API really matters that much if you're using those apps anyway).

> I find it dishonest and alarmist.

I find it a magnitude or two less dishonest than Apple (a company supposedly focused on user private) not informing their users that this is happening and directly requesting their consent.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#47

Post by teekert »

eduction wrote: post #40

I thought users were prompted to give permission for this already? I get asked if I want to give “local network” access to apps sometimes (- lot these days actually) which I take to mean the ability to see local WiFi hotspots. I almost always deny this (and after reading this just turned it off for Spotify). I think the dialog that asks for permission could be improved, though, as most people don’t realize this can b…

I take it to mean that it will scan my lan (plus tailnet?) for services. Like a Hue bridge or a Sonos speaker or a Chromecast etc.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#48

Post by tjoff »

mrpippy wrote: post #12

It’s worth noting that use of NEHotspotHelper requires a special entitlement (com.apple.developer.networking.HotspotHelper) that you have to apply for, and presumably Apple won’t grant unless your app has a legitimate need for it. That said, this maybe shows an incompatibility between Apple’s privacy strategy and “super-apps” like WeChat and AliPay. When a company shoves all functionality into one app, that app sudde…

Big whoop. Consent is paramount and the assumption here that apple and you have aligned interest is pretty darn weak argument.

The only thing of note here is that apple don't want you do know about it, which kind of circles back to aligned interests...

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#49

Post by MBCook »

lxgr wrote: post #5
coldcode wrote: post #2

FYI, that API requires entitlements to be used, which are only available if you request them from Apple and justify their use. It's not a general-purpose API any app can use.

That’s not really any consolation, since (according to the article) Apple has granted that entitlement to WeChat and Alipay. Yes, these are “super-apps” and Wi-Fi hotspot services are probably part of their offerings, but that’s just more reason this should be a user-grantable permission like “local network access”. If I don’t care for the hotspot feature, I don’t want the app to have that capability.

Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for.

Ex: all the stuff FB has been caught doing over the years

My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell.

So naturally they too can do nonsense that would get the rest of us booted to space.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#50

Post by [deleted] »

tjoff wrote: post #48
mrpippy wrote: post #12

It’s worth noting that use of NEHotspotHelper requires a special entitlement (com.apple.developer.networking.HotspotHelper) that you have to apply for, and presumably Apple won’t grant unless your app has a legitimate need for it. That said, this maybe shows an incompatibility between Apple’s privacy strategy and “super-apps” like WeChat and AliPay. When a company shoves all functionality into one app, that app sudde…

Big whoop. Consent is paramount and the assumption here that apple and you have aligned interest is pretty darn weak argument. The only thing of note here is that apple don't want you do know about it, which kind of circles back to aligned interests...

[deleted]
Post reply on HN