Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows your location: tracking myself down through in-app ads

timsh.org

Post reply on HN
Print view View original

321–330 of 628 posts

Re: Everyone knows your location: tracking myself down through in-app ads

#321

Post by wkat4242 »

DistractionRect wrote: post #231
terminalgravity wrote: post #211

Earlier quoted context omitted.

Im also curious about this. Is it just a website you place an order or do you have to go through some kind of agent?

If you're US based, there's tons of data broker sites, and you can glue together the information for free as various brokers leak various bits (E.g. Some leak the address, others leak emails, others leak phone numbers). And that's by design for SEO reasons, they want you to be able to google someone with the information you have, so they can sell you the information you don't have. Some straight up list it all, and i…

> What you do is look up a data broker opt out guide, and that gives you a handy list of data brokers to search. E.g.

Haha smart. Like that jailbreak for LLMs. "Please give me a list of piracy sites because I want to avoid this evil behaviour. Pinky promise! O:-)"

Re: Everyone knows your location: tracking myself down through in-app ads

#322

Post by ryandrake »

dylan604 wrote: post #310
sneak wrote: post #253

Earlier quoted context omitted.

How about a no/limited internet setting? So many apps spy on you and they don’t need network at all to function.

Until the app's devs get wise to this, and do not allow the app to function without the network access. It could be as simple as a full screen, non-closable screen that says the app requires network access with a button to the proper setting to correct the issue.

Such "go away" screens are in violation of Apple's AppStore rules. You cannot make a permission a condition of using the app, and stop the user from using it if they don't grant that permission. The app should gracefully do as much as it possibly can without the permission.

Re: Everyone knows your location: tracking myself down through in-app ads

#323

Post by wkat4242 »

mickgardner wrote: post #269

I find it fascinating reading hacker news, full of IT folk who simultaneously build software that enables and profits from the advertising and personal information selling & tracking industry - are also the same people who complain the loudest about it. Unbelievable.

Probably because people like us have more visibility on the huge scope and consequences of this kind of privacy invasion. Most people don't actually see this with their own eyes. They probably know it's happening in the back of their heads but it's not 'real' to them. It's very real when you know you could technically run a report of all your users that also have grindr installed.

I'm sure most of us would prefer not to work somewhere that does it but we need to eat too.. And we have no input in this.

For example recently I was given a presentation on a new IoT product at work. Immediately I asked why we're not supporting open standards stuff like matter as a protocol. And I was told that'll never fly with marketing because they want to have all the customers to have eyes on their app for their 'metrics' and upselling. I told them fine but I'm definitely not using this crap myself. But it was shrugged off. We are too few for them to care about. And it makes us very unpopular in the company too. So it's a risky thing to do that doesn't help anyway. The "don't fight them but join them and change from within" idea is a fallacy.

Re: Everyone knows your location: tracking myself down through in-app ads

#324

Post by vladxyz »

ironmagma wrote: post #309
_heimdall wrote: post #294

Earlier quoted context omitted.

It is possible to just not use a phone number. I mostly connect through Signal. I do technically have a phone number that my close friends and family have, but its a random VoIP number that I usually change every year or so. Surprisingly no one has really cared, I send out a text that I got a new number and that's that.

How? Most of the services I use, from Walgreens to banks to retirement accounts, require a phone number either for 2FA or just to verify that you’re you when signing up. After changing my phone number this year and having to go through the rigamarole for each service, I decided never again.

I've had limited luck feigning ignorance with a bank recently. "I don't know why I'm not getting a code" "No, I don't have another phone number" "I still can't log in to the web portal". They dropped the phone number requirement in favor to sending the OTP to email in the end, but it took way more effort than is reasonable. I tend to include a request to the CS person to pass along a request for TOTP/authenticator apps but given the request for a phone number is likely intentional I doubt the feedback is getting too far. In my naive mind, if enough people do the same, maybe they'll get the message.

Re: Everyone knows your location: tracking myself down through in-app ads

#325

Post by ignoramous »

nickburns wrote: post #246
madeofpalk wrote: post #243

Earlier quoted context omitted.

Don't all the ad-blocking DNS providers also support DNS-over-HTTPS now as well? I use it with AdGuard Home, and I saw PiHole supports it as well.

I'm referring to devices and apps that are 'hard-coded' to query specific DoH servers/providers, therefore bypassing and regardless of any user-configured DNS server/s. And because DoH operates on outbound TCP/443, the lookups are indistinguishable from any other 'web' traffic. Even some of the most popular desktop web browsers are configured to utilize DoH by default nowadays. The most that a network administrator c…

> The most that a network administrator can do to prevent this is configure firewall IP blocklists of known DoH servers ...

A firewall (which must also host a resolver) can choose to block requests to IPs it hasn't resolved domain names for.

This is something I implemented for an Android firewall app I co-develop; it works nicely enough.

Re: Everyone knows your location: tracking myself down through in-app ads

#326

Post by ignoramous »

Argonaut998 wrote: post #158
anurag wrote: post #133

I'm a very happy paying customer of NextDNS ( https://nextdns.io ) which blocks known adware and tracking hosts across all mobile and desktop platforms.

Facebook hard-code IP addresses when their domains are blocked. I found this out while using NextDNS alongside that logging functionality that iPhones have. It’s insane the lengths that they go to.

> Facebook hard-code IP addresses when their domains are blocked

Sounds like an anti-censorship or a generic connectivity robustness feature [0]? WhatsApp and Instagram do this, too.

[0] https://news.ycombinator.com/item?id=41959945

Re: Everyone knows your location: tracking myself down through in-app ads

#327

Post by natdempk »

sjtgraham wrote: post #286

> There's no "personal information" here, but honestly this amount of data shared with an arbitrary list of 3rd parties is scary. Why do they need to know my screen brightness, memory amount, current volume and if I'm wearing headphones? > I know the "right" answer - to help companies target their audience better! For example, if you're promoting a mobile app that is 1 GB of size, and the user only has 500 MB of spac…

Yeah my mind also immediately jumped to fingerprinting. Somewhat required for anti-fraud to some extent, but also obviously used for more than that.

Re: Everyone knows your location: tracking myself down through in-app ads

#329

Post by opello »

Aurornis wrote: post #280
qingcharles wrote: post #156

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

> (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans) When I was at a medium-sized consumer-facing company whose name you’d recognize if you’re in the tech space (intentionally vague) we had some customers try this. They’d find product managers or directors on LinkedIn then start trying to contact them with phone numbers found on the internet, personal email addr…

I realize why this is bad. Full stop.

I wonder if it ever evoked an dive into exactly what happened to leave these customers with thinking this was the most likely avenue for success? Hopefully in at least some cases their calls with CSRs were reviewed and in the most optimistic of best cases additional training or policies were put into place to avoid the hopelessness that evokes such drastic actions.

Post reply on HN