Live data from Hacker News

Apple allows some iOS apps to track user locations via lists of nearby SSIDs

wingu.se

61–70 of 327 posts

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#61

One should realize that what they call ‘track user locations’ is actually ‘get a list of visible SSIDs’. Should be behind a permissions check, but not the end of the world.

"Get a list of visible SSIDs" is exactly how phones derive your location. There's little distinction between seeing SSIDs and seeing GPS coordinates for 99.9% of the population.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#62
Whether the user is aware and opt _in_ is the issue, right? But all of the network signals that are triggered by web applications, phone apps, OS, isn't it almost always possible to get SOME information about a user's geo location?

There's a theory that Silk Road's Ross Ulbricht leaked his location via a Captcha on a website, despite actively covering his tracks.

I think Bitcoin's Satoshi is/was an Australian bloke living in Japan because of his wording + timestamp on posts.

I was able to send a friend a little hello message via a Facebook ad by hyper targeting them (before fb disallowed that), which also confirmed their location.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#63
post #59
post #49

Earlier quoted context omitted.

Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…

Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?

Does your employer have a donation matching program?

It’s a great time of year to donate to the EFF.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#64

Earlier quoted context omitted.

i wouldn't be worried about my flashlight app tracking me, i'd be worried about the large players who probably GET the use of this API, google facebook etc etc.

I would absolutely be concerned about a flashlight app doing all the nefarious things. A flashlight app? Today? Still? Really? It's one of those apps that's absolutely useless since the OS provides this feature natively now. It is absolutely the type of app I would assume has no reason other than harvesting data.

You're conflating "utility to user" with "utility to developer". A flashlight app has no utility to the user, it doesn't really matter to me that it's useful to its developer (for collecting my personal data).

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#65
post #59

Earlier quoted context omitted.

Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?

Does your employer have a donation matching program? It’s a great time of year to donate to the EFF.

I donate to NOYB, but I second your sentiment.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#66
post #59
post #49

Earlier quoted context omitted.

Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…

Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?

Because you bought a closed-source device by which you surrendered your privacy to whatever the source-controlling company wants.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#67

One should realize that what they call ‘track user locations’ is actually ‘get a list of visible SSIDs’. Should be behind a permissions check, but not the end of the world.

It’s the same thing. Listing visible SSIDs and comparing them to very comprehensive databases is the whole way precise geolocation works in many devices, like MacBooks. I think even phone navigation has GPS much less precise than you see on screen, and the extra precision is gained with this technique. Making this technique really work is a large part of the reason Google drove or walked every street in the world with their recording gig.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#68
post #44

I thought users were prompted to give permission for this already? I get asked if I want to give “local network” access to apps sometimes (- lot these days actually) which I take to mean the ability to see local WiFi hotspots. I almost always deny this (and after reading this just turned it off for Spotify). I think the dialog that asks for permission could be improved, though, as most people don’t realize this can b…

That’s for sending and receiving local network traffic, eg. talking to devices on the same subnet, and discovery of Chromecast and similar targets. Edit: AirPlay does not require this permission.

You’d think that AirPlay would be abstracted away by an OS API that does the local network discovery itself.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#69
post #59
post #49

Earlier quoted context omitted.

Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…

Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?

FWIW I used WeChat a few years ago and at that point it definitely asked for local network access (which is what this article is about; a mechanism for collecting SSIDs which can then later be correlated to locations).

If there is an entitlement, it is as of yet unclear whether it means a consent dialog/privacy toggle or not. IIRC an entitlement only means you can ask for this sort of access, not get it automatically, but I may be wrong (I’ve never gotten far in iOS dev).

We can argue that this feature is misnamed, regular users will not understand what it is and would not be giving informed consent, and I can get behind that, but “automatic access to my private data on my device” looks like jumping to conclusions.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#70

One should realize that what they call ‘track user locations’ is actually ‘get a list of visible SSIDs’. Should be behind a permissions check, but not the end of the world.

Visible SSIDs are absolutely used to fingerprint location.

At least in the early days, every iPhone maintained a local lookup table between ssids and gps coordinates in a SQLite database.

https://www.networkworld.com/article/752872/security-apple-o...

Post reply on HN