Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows your location: tracking myself down through in-app ads

timsh.org

Post reply on HN
Print view View original

341–350 of 628 posts

Re: Everyone knows your location: tracking myself down through in-app ads

#341

Post by wkat4242 »

TheJoeMan wrote: post #163
araes wrote: post #154

Parts I found relevant: - It was a clean state of a somewhat old phone (iPhone 11, factory defaults + new apple id) - A single (old) app was installed (Stack by KetchApp, 10-12 years old) - Was sending out an update a second pretty much instantly (5 kB - ~300 KB every second) - Within a minute: IP, Lat / Lon, country, phone model, carrier / network operator, vendor, OS version, connection type (wifi), headphone statu…

I dislike that as a developer, knowing something like the headphone status could be useful for the functionality of the app. But some other unscrupulous person is just exfiltrating it! This is part of the reason I agree with Apple’s stand against apps with sub-apps/“desktop like” due to not fine-grained enough permission settings. There is a significant privacy downside to “superapps” and now Elon is pushing for the…

Yeah and if you ask for permission for every little thing then users are going to get bombarded even when it's needed for legit purposes. It's a difficult tradeoff to make, even if you want to do the right thing (and I'm not really sure that Apple and especially Google really do)

Re: Everyone knows your location: tracking myself down through in-app ads

#342

Post by wkat4242 »

timsh wrote: post #110
sunnybeetroot wrote: post #79

Whilst I trust that the author did in fact look at the data of each request eventually, the screenshot they provided of Charles could not have been of the exact requests they intercepted given Charles is indicating that those are not yet SSL proxied (except for the 2 GET requests). EDIT: please ignore, author did it differently to what I expected.

I decrypted them all by installing Charles SSL cert on the iphone. This is why the requests seem not SSL proxied.

This technique doesn't work anymore on android because you can no longer add certificates to the system store and apps are free to choose to accept the user store CAs or not. That was changed in Android 7. For "security" they say. Security of Googles business model I'm sure.

Re: Everyone knows your location: tracking myself down through in-app ads

#343

Post by maeil »

ryandrake wrote: post #322
dylan604 wrote: post #310

Earlier quoted context omitted.

Until the app's devs get wise to this, and do not allow the app to function without the network access. It could be as simple as a full screen, non-closable screen that says the app requires network access with a button to the proper setting to correct the issue.

Such "go away" screens are in violation of Apple's AppStore rules. You cannot make a permission a condition of using the app, and stop the user from using it if they don't grant that permission. The app should gracefully do as much as it possibly can without the permission.

This holds for every app and every permission? Because I'm quite sure I recently used an app that closed for not allowing a permission. May be misremembering..

Re: Everyone knows your location: tracking myself down through in-app ads

#344

Post by sizzle »

theptip wrote: post #35

> Why do they need to know my screen brightness, memory amount, current volume and if I'm wearing headphones? This is clearly adding entropy to de-anonymize users between apps, rather than to add specificity to ad bids.

Straight up fingerprinting us without consent it’s pure insanity.

Re: Everyone knows your location: tracking myself down through in-app ads

#345

Post by maeil »

Aurornis wrote: post #280
qingcharles wrote: post #156

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

> (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans) When I was at a medium-sized consumer-facing company whose name you’d recognize if you’re in the tech space (intentionally vague) we had some customers try this. They’d find product managers or directors on LinkedIn then start trying to contact them with phone numbers found on the internet, personal email addr…

> So I can see why companies are quick to lock out customers who try these games.

Most of the companies who customers try these "games" against are places like Google and Meta that literally do not provide a way for the average customer to reach a human. None.

Those have got it coming for them, the megacorps' stance on this is despicable and far worse than the customers directly reaching execs who could instantly change this but don't because it would cut into their $72 billion per year net profit.

This is a case where laws simply did not catch up to the digital era. In the brick and mortar era it was by definition possible to reach humans.

I get that your company was smaller and probably did allow for a way to reach a human but that's not generalizable.

Re: Everyone knows your location: tracking myself down through in-app ads

#346

Post by wkat4242 »

From TFA:

> This is the worst thing about these data trades that happen constantly around the world - each small part of it is (or seems) legit. It's the bigger picture that makes them look ugly.

No it doesn't seem legit to me at all. Any of it.

Re: Everyone knows your location: tracking myself down through in-app ads

#348

Post by eudhxhdhsb32 »

sneak wrote: post #253
gruez wrote: post #177

Earlier quoted context omitted.

>One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. >As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. Fortunately this is changing with iOS 18 with "limited contacts" sharing. https://mobiledevmemo.com/wp-cont…

How about a no/limited internet setting? So many apps spy on you and they don’t need network at all to function.

GrapheneOS has that. It asks every time you install a new app whether it should have network permissions.

Re: Everyone knows your location: tracking myself down through in-app ads

#349

Post by ggm »

The thing I found I grokked, and think is important from this article is that private browsing doesn't end this information flow. It only marks the JSON data blob as "asked not to be identified or collated" and its substantively an honour system. There are penalties (lawsuit against google for misleading people on the fact data was still collected) but the walls to breach here are low, given that non-PII can be crossmatched, to confirm "who you are" in some sense.

There is no such thing as "private" browsing inside the factory installed browser, with factory installed DNS, and any kind of location data, or other cross-collating information along with your IP. The loss of privacy may be contextual and somewhat statistical, but it would be wrong to assume you weren't identified.

What it does do, is let you see how bidding mechanisms in services like flights and hotels will change bid when the same location as you comes to request service and doesn't have the prior search cookie state. Thats useful I guess.

"find things at a different pricepoint" cookie monster mode?

Re: Everyone knows your location: tracking myself down through in-app ads

#350

Post by ajcp »

A4ET8a8uTh0_v2 wrote: post #187
qingcharles wrote: post #156

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

Honestly, kudos. The rules should apply to the ones foisting this system upon us as well. This is probably the only way to make anyone in power reconsider current setup. And people laughed at Red Reddington when he said he had no email.

It's odd that of the two replies referencing people, both got their names obviously wrong. Is that a new phishing tactic?
Post reply on HN