Live data from Hacker News

Everyone knows your location: tracking myself down through in-app ads

timsh.org

161–170 of 628 posts

Re: Everyone knows your location: tracking myself down through in-app ads

#161
Even just to look at the picture near the top (which is also repeated near the bottom), if you do not allow the app to track you that only disables one of the items of the information and not all of them. This is explained later in the document, that it is not explained very well to end users. I agree that it could be explained better. Perhaps, "Allow app to track your activity..." can have a option to display a more elaborate description, explaining that it only affects the Advertising Tracking ID (and what that means) and has no effect on other methods of tracking.

And, looking further in the document, we can see there is more.

Some of them, such as IP address and timestamp it is reasonable to use for programs that access the internet (although it should be possible for the user to set up a proxy and/or adjust the clock in order to change these things, the server would still use its own timestamp anyways).

Available memory also makes sense to be readable (although ideally, the user should be allowed to limit the amount of memory available to specific programs, in order that there is enough memory remaining for other programs; the reported total memory should then include only the memory available to this program and not to all programs), and the same should be true of the number of CPU cores and the amount of available disk space.

Others probably should not normally be known by most programs (but some are usefulf or some kind of programs), and even when they are, the operating system ought to allow users to reprogram what information is available and what filters, logging, etc will be used.

The presence of wired headphones probably should not be accessible by software, and the redirection should be handled by hardware. Perhaps an exception makes sense if the settings need to be different, e.g. mono vs stereo, although even then, programs should only see those settings (and only if they have audio output), and the user should be allowed to override them due to preferences (e.g. some users might want mono even if connected to external speakers or headphones; on my computer sometimes only one speaker works and sometimes both, so it is useful to me to be able to switch to mono).

Furthermore, there is the consideration, if the advertisers/spies are stealing your power and network bandwidth and quota in order to do these things; then, that is theft.

Re: Everyone knows your location: tracking myself down through in-app ads

#162
post #21

>If it was LTE, I bet the lat/lon would be much more precise. False. Apps don't have access to cellid information unless they also have location permissions, in which case they can just request your location directly. >the free apps you install and use collect your precise location with timestamp [...] This is alarmist and contradictory given that the author admits a few paragraphs up that the "location shared was no…

Eh. Zip code level location + timestamp is still pretty invasive, even if, pedantically, that’s not very precise. We should compare if there a differences in the data sent in countries with better data privacy laws.

>Eh. Zip code level location + timestamp is still pretty invasive, even if, pedantically, that’s not very precise.

That's basically sent to multiple parties (ISPs, transit providers, CDNs, analytics/advertising/diagnostics/security vendors) everytime you visit a website. If this counts as "invasive" to you, you shouldn't be connected to the internet at all, much less buying a tracking device (a smartphone) and installing random ad-supported apps on it.

Re: Everyone knows your location: tracking myself down through in-app ads

#163
post #154

Parts I found relevant: - It was a clean state of a somewhat old phone (iPhone 11, factory defaults + new apple id) - A single (old) app was installed (Stack by KetchApp, 10-12 years old) - Was sending out an update a second pretty much instantly (5 kB - ~300 KB every second) - Within a minute: IP, Lat / Lon, country, phone model, carrier / network operator, vendor, OS version, connection type (wifi), headphone statu…

I dislike that as a developer, knowing something like the headphone status could be useful for the functionality of the app. But some other unscrupulous person is just exfiltrating it! This is part of the reason I agree with Apple’s stand against apps with sub-apps/“desktop like” due to not fine-grained enough permission settings. There is a significant privacy downside to “superapps” and now Elon is pushing for the X everything app.

Re: Everyone knows your location: tracking myself down through in-app ads

#164
Very interesting and disturbing research, definitely a wake up call for me. Does anyone know/can anyone recommend me software that can block these sorts of requests from going through? I know of pihole which blocks adds but does it also filter out these sorts of things?

Re: Everyone knows your location: tracking myself down through in-app ads

#165

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

> CashApp terminated my account for this shenanigans

Did you call to complain about the termination?

Re: Everyone knows your location: tracking myself down through in-app ads

#166
post #54

> was shocked by the amount and types of data sent with the bids to ad exchanges. Can this data fall into the hands of "evil" state actors, and why is Congress OK with that and not with tiktok?

Are the police evil state actors? They purchase location data from private companies to target protesters[1]

[1]https://www.eff.org/deeplinks/2022/08/how-law-enforcement-ar...

Re: Everyone knows your location: tracking myself down through in-app ads

#167

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

Assuming these marketplaces operate within the bounds of the law, would it break HN’s ToS to post them? I’d be interested in pursuing the same strategy.

Re: Everyone knows your location: tracking myself down through in-app ads

#168

Don't use mobile apps that could just be websites.

Extended to add don’t use websites without blockers. If they are willing to track via app, why would we think they would not track via browser?

At least on android the browser is limited by the android permission system, i.e. if you dont give browser GPS permissionit cannot give pages dito. In addition the browser will ask if you want to grant an app access to something like positioning data.

Furthermore, it is hard for a web page to run in background and receive user data.

Re: Everyone knows your location: tracking myself down through in-app ads

#169

Earlier quoted context omitted.

The problem is that to you it seems like your data but to Walgreens they see it as theirs. They generated it with their point of sale system. The data is about a transaction that you made, but they generated all of it. Until we have agreement as a society about what “my data” means, this kind of stuff is going to run rampant.

>what “my data” means It makes me wonder, if everyone 'owned' their own data, I wonder if it could be used as a form of UBI. Everyone has data from using services, everyone owns it, everyone can sell it to make a living just doing whatever they are doing everyday. This is only just a shower thought I had the other day though, there are probably many pitfalls when it comes to such an idea.

[deleted]

Re: Everyone knows your location: tracking myself down through in-app ads

#170
post #6

There are quite a few interesting tracking flows out there. My rent is paid through a company called Bilt. I discovered that when I shop at Walgreens now, Bilt sends me an email containing the full receipt of what I bought like so: > Hey [inahga], > > You shopped at Walgreens on 12/1/24 and earned Bilt Points with your > Neighborhood Pharmacy benefit. > > Items eligible for rewards > TOSTITOS HINT OF LIME RSTC 11OZ >…

So paying by cash is the easiest way to generally avoid this?

Clearly you can decide not to use Bilt, but maybe you get caught out some other way (bank, ...) - too difficult to track the trackers.

Post reply on HN