81–90 of 327 posts
One should realize that what they call ‘track user locations’ is actually ‘get a list of visible SSIDs’. Should be behind a permissions check, but not the end of the world.
"Get a list of visible SSIDs" is exactly how phones derive your location. There's little distinction between seeing SSIDs and seeing GPS coordinates for 99.9% of the population.
Earlier quoted context omitted.
Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…
No app gets special treatment for any of the user-grantable permissions like location, Bluetooth, local network access, contacts, photos... What makes this any different? It really seems more like an oversight than a conscious decision, similarly to how (I believe) both iOS and Android have retroactively had to bucket some of the Bluetooth LE permissions into "location", since that's what you can effectively do with…
TL;DR: Apps can access the nearby Wi-Fi hotspot SSID and MAC addresses through an API that is intended to help with connecting to hotspots. Then they can use this info to look-up in databases that collect SSIDs based on their locations. Seems like a valid concern, though the author's writing style can be off putting since has a tone with an agenda. However, AFAIK apps need to declare the use of this API and have a go…
Earlier quoted context omitted.
FWIW I used WeChat a few years ago and at that point it definitely asked for local network access (which is what this article is about; a mechanism for collecting SSIDs which can then later be correlated to locations). If there is an entitlement, it is as of yet unclear whether it means a consent dialog/privacy toggle or not. IIRC an entitlement only means you can ask for this sort of access, not get it automatically…
Hm, I assume any app can ask for whatever it wants, but that's just an assumption. I don't know if app developers need to apply to be able to request permissions, but I don't own an iPhone.
Other things are just available to any developer but have to have a user prompt, for example saving to the photo library.
Earlier quoted context omitted.
Visible SSIDs are absolutely used to fingerprint location.
At least in the early days, every iPhone maintained a local lookup table between ssids and gps coordinates in a SQLite database. https://www.networkworld.com/article/752872/security-apple-o...
If you are in a city you see 50 SSIDs at any given moment. Are you at those 50 locations at the same time? No. Is there a way to triangulate where you are exactly? No, its unreliable and not an exact science.
Earlier quoted context omitted.
"Get a list of visible SSIDs" is exactly how phones derive your location. There's little distinction between seeing SSIDs and seeing GPS coordinates for 99.9% of the population.
Back in the real world SSIDs are a very coarse and not very reliable way of locating devices. You are exaggerating.
GPS takes time to acquire and isn't always available indoors. SSID method is quicker, and it's most likely the method your phone uses to get the position first.
Earlier quoted context omitted.
> TL:DR; Apps can access the nearby Wi-Fi hotspot SSID and MAC addresses through an API that is intended to help with connecting to hotspots. Then they can use this info to look-up in databases that collect SSIDs based on their locations. This is the whole story. Thank you for writing it, and sorry that you're getting downvoted for it. > I'm sorry you don't like it but that's the truth, the author left out crucial de…
I wish too. I hate it when I don't know why I'm downvoted.
Knowing why the downvotes are happening could be a useful signal to help me improve commenting in the future. Not knowing why just makes the downvotes informationless noise.
Earlier quoted context omitted.
Wasn't it ever thus?
I had the first iPhone up to the 3GS. It didn't feel that way then. Now there are continuous software updates that keep changing arbitrary and invisible policies.
If you’re a software developer, you must understand that the user cannot actually understand what any code is doing. Even if you’re using open source, it’s an illusion to think you know what it’s doing. Heck, even the developer doesn’t know what it’s doing a lot of the time (how long does it take to figure out what’s happening with a tricky bug?).
So yes, Apple’s policies do mediate what a developer can do on behalf of the user. That’s how it works.
Earlier quoted context omitted.
Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…
Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?
I think.
Legal advice about what is and isn't legal under GDPR (and equivalents) varies a lot.