Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple allows some iOS apps to track user locations via lists of nearby SSIDs

wingu.se

Post reply on HN
Print view View original

91–100 of 327 posts

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#91

Post by politician »

lxgr wrote: post #73
MBCook wrote: post #49

Earlier quoted context omitted.

Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…

No app gets special treatment for any of the user-grantable permissions like location, Bluetooth, local network access, contacts, photos... What makes this any different? It really seems more like an oversight than a conscious decision, similarly to how (I believe) both iOS and Android have retroactively had to bucket some of the Bluetooth LE permissions into "location", since that's what you can effectively do with…

What’s your basis for saying that Apple doesn’t provide special treatment to apps? I’ve directly experienced both of their special and their non public (phone calls only, refusal to communicate over email) processes.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#92

Post by charcircuit »

tinus_hn wrote: post #86
dmboyd wrote: post #70

Earlier quoted context omitted.

At least in the early days, every iPhone maintained a local lookup table between ssids and gps coordinates in a SQLite database. https://www.networkworld.com/article/752872/security-apple-o...

That doesn’t mean seeing an SSID means you are at exactly that location. If you are in a city you see 50 SSIDs at any given moment. Are you at those 50 locations at the same time? No. Is there a way to triangulate where you are exactly? No, its unreliable and not an exact science.

>Is there a way to triangulate where you are exactly? No

The phone knows the signal strength of each ssid. Why can't it triangulate where it is?

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#93

Post by School-Cotton »

charcircuit wrote: post #92
tinus_hn wrote: post #86

Earlier quoted context omitted.

That doesn’t mean seeing an SSID means you are at exactly that location. If you are in a city you see 50 SSIDs at any given moment. Are you at those 50 locations at the same time? No. Is there a way to triangulate where you are exactly? No, its unreliable and not an exact science.

>Is there a way to triangulate where you are exactly? No The phone knows the signal strength of each ssid. Why can't it triangulate where it is?

It can and does.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#94

Post by wodenokoto »

MBCook wrote: post #49
lxgr wrote: post #5

Earlier quoted context omitted.

That’s not really any consolation, since (according to the article) Apple has granted that entitlement to WeChat and Alipay. Yes, these are “super-apps” and Wi-Fi hotspot services are probably part of their offerings, but that’s just more reason this should be a user-grantable permission like “local network access”. If I don’t care for the hotspot feature, I don’t want the app to have that capability.

Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…

That doesn’t excuse anything! This is not “oh poor small time devs”, this is paying customers being lied to by Apple.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#95

Post by ben_w »

coldacid wrote: post #66
stavros wrote: post #59

Earlier quoted context omitted.

Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?

Because you bought a closed-source device by which you surrendered your privacy to whatever the source-controlling company wants.

Quite a few apps run tests to find out if they're running on a rooted device, and refuse to continue if they are.

Dunno if these apps do that or not, but I can easily imagine that using them is a Hobson's Choice even in OSS utopia: take the horse offered (app with tracking) or don't have a horse.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#96

Post by beardyw »

tinus_hn wrote: post #81
stavros wrote: post #61

Earlier quoted context omitted.

"Get a list of visible SSIDs" is exactly how phones derive your location. There's little distinction between seeing SSIDs and seeing GPS coordinates for 99.9% of the population.

Back in the real world SSIDs are a very coarse and not very reliable way of locating devices. You are exaggerating.

I built a small ap on an ESP (where SSID scanning is bread and butter). It would track my location to within a few yards. The down side is it needs multiple SSIDs to do that, so not so useful outside an urban environment.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#97

Post by anileated »

stavros wrote: post #72
anileated wrote: post #69

Earlier quoted context omitted.

FWIW I used WeChat a few years ago and at that point it definitely asked for local network access (which is what this article is about; a mechanism for collecting SSIDs which can then later be correlated to locations). If there is an entitlement, it is as of yet unclear whether it means a consent dialog/privacy toggle or not. IIRC an entitlement only means you can ask for this sort of access, not get it automatically…

Hm, I assume any app can ask for whatever it wants, but that's just an assumption. I don't know if app developers need to apply to be able to request permissions, but I don't own an iPhone.

I was remembering when trying out iOS development years back that entitlements were needed for many things and the ones I tried involved a consent screen.

From looking at https://developer.apple.com/documentation/bundleresources/en... I would say there are many more entitlements than consent screens, the phrasing suggests there is no 1:1 mapping between them and is not clear on whether they reliably come with consent screens (I suspect not).

It is very unfortunate that there is little clarity on that in the docs, and that entitlements are not exposed anywhere in the GUI. Sure, they are too technical, but they could at least be shown in some advanced info pane. I am seriously considering if I can dejail an old iPhone and perhaps inspect some big name apps for what they have been entitled to.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#98

Post by BobaFloutist »

electric_mayhem wrote: post #63
stavros wrote: post #59

Earlier quoted context omitted.

Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?

Does your employer have a donation matching program? It’s a great time of year to donate to the EFF.

It's so hard to prioritize non-profits these days. EFF is huge and super relevant, but so are aid programs to Ukraine or I/P, and reproductive health orgs. There's a lot going on I want to contribute to.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#99

Post by tinus_hn »

pornel wrote: post #87
tinus_hn wrote: post #81

Earlier quoted context omitted.

Back in the real world SSIDs are a very coarse and not very reliable way of locating devices. You are exaggerating.

Visibility of multiple networks can be used to refine the position. GPS takes time to acquire and isn't always available indoors. SSID method is quicker, and it's most likely the method your phone uses to get the position first.

As you say, it’s a method to get a coarse location and then refined using GPS which by the way does not really take time to acquire once you have downloaded the almanac and have the coarse location.

So this ‘allows applications to track location’ actually allows applications to track coarse location which then does not allow them to refine using GPS.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#100

Post by rkunde »

layer8 wrote: post #25
mrpippy wrote: post #12

It’s worth noting that use of NEHotspotHelper requires a special entitlement (com.apple.developer.networking.HotspotHelper) that you have to apply for, and presumably Apple won’t grant unless your app has a legitimate need for it. That said, this maybe shows an incompatibility between Apple’s privacy strategy and “super-apps” like WeChat and AliPay. When a company shoves all functionality into one app, that app sudde…

Is there a way for an end user to see which apps have this entitlement?

I don’t think you can unless you have a jailbroken device. If I remember correctly, entitlements are store in the AppStore receipt file.
Post reply on HN