Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows your location: tracking myself down through in-app ads

timsh.org

Post reply on HN
Print view View original

541–550 of 628 posts

Re: Everyone knows your location: tracking myself down through in-app ads

#541

Post by 1vuio0pswjnm7 »

buro9 wrote: post #535

Use NextDNS ( https://nextdns.io ) on your mobile phone as a Private DNS provider, and switch as many apps as allow it to be web apps, i.e. https://m.uber.com works just fine, and use Firefox on mobile and enable `about:config` via `chrome://geckoview/content/config.xhtml` , from there switch `beacon.enabled` to false. Far less requires an actual app than most people imagine. It's the apps that leak so much.

Mobile phones suck as computers. NetGuard PCAP files are must read if using a mobile phone as a computer.

One setup that works reasonably well is

NetGuard --> Nebulo --> DNSdist on own router

On phone,

(a) set DNS in Wifi to localhost, i.e., disable service provider DNS

(b) set VPN to Block all connections without VPN

(c) set Netguard to forward port 53 to Nebulo

(d) set Nebulo to run in non-VPN mode

(e) set DNS configuration in Nebulo to DNSdist on router

On router, point DNSdist at nsd or tinydns serving custom root zone containing all needed DNS data. Apps like NetGuard, Nebulo, PCAPdroid, etc. allow one to easily export the DNS data needed for the zone file.

There is at least one leak in this setup. Nebulo's "Internal DNS server" can only be set to Cloudflare, Google or Quad9. In theory this should only be used to resolve the address of the DoH provider and nothing else. But not allowing the user to choose their own DNS data source and forcing the user to keep pinging (querying) Cloudflare, Google or Quad9 is poor design. Those addresses are unlikely to change anyway.

Using a browser in place of other apps seems like good strategy but the browser "app" is far, far more complicated than many open source "apps" and much more difficult to control.

Firefox is not only filled with telemetry, almost no one compiles it themselves, it has more settings than any normal user can keep track of and it is constantly changing. Layer upon layer of unneeded complexity.

Re: Everyone knows your location: tracking myself down through in-app ads

#542

Post by rpigab »

ActorNightly wrote: post #285
simonw wrote: post #193

Anyone understand why an apparently accurate latitude/longitude showed up in one of those traces despite location services not being enabled for the app in question?

Phones send out probe requests to get a list of open wifis. If you have a static access point, with a known geo location, software can be running on that point to remember a mac address of the phone from a probe and store it. Thus enabling real time tracking. Im like 60% sure this is how they figured out who the Bomber was in Austin TX.

This is also why some Chinese apps put everything inside a single app and request every permission there is, then track you through Wifi SSIDs seen by your device.

Re: Everyone knows your location: tracking myself down through in-app ads

#543

Post by cutemonster »

ajcp wrote: post #350
A4ET8a8uTh0_v2 wrote: post #187

Earlier quoted context omitted.

Honestly, kudos. The rules should apply to the ones foisting this system upon us as well. This is probably the only way to make anyone in power reconsider current setup. And people laughed at Red Reddington when he said he had no email.

It's odd that of the two replies referencing people, both got their names obviously wrong. Is that a new phishing tactic?

Which are those comments? Aha, "Make Cuban" is one such comment and Mr Oliver someone

Re: Everyone knows your location: tracking myself down through in-app ads

#544

Post by youcouldalways »

qingcharles wrote: post #156

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

Changing your number every year could mitigate as it would introduce entropy and stale data into the system. When done at scale, data lifetime would behave similar to the automatic deletion of messages on whatsapp. Somewhat mimicking an in person verbal conversation where only people's memories remember what was said and even their version gets changed every time memory recall takes place. Systems already exist in real life that protect privacy, it's just that we do a poor job of reproducing them with tech.

Changing your telephone number every year could be an artificial holiday like valentines day or halloween. It can be done if people deem it's important.

Re: Everyone knows your location: tracking myself down through in-app ads

#545

Post by ironmanszombie »

qingcharles wrote: post #156

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

[dead]

Re: Everyone knows your location: tracking myself down through in-app ads

#546

Post by pphysch »

notduncansmith wrote: post #386
ajcp wrote: post #350

Earlier quoted context omitted.

It's odd that of the two replies referencing people, both got their names obviously wrong. Is that a new phishing tactic?

Russian bot tactic? Guessing it’s an easy way to farm interaction as people comment back to correct the mistake.

An innocent coincidence, by two established users that link their contact info in their profile. It must be the Russians!

It's genuinely sad that this level of Cold War paranoia has been normalized again.

Re: Everyone knows your location: tracking myself down through in-app ads

#547

Post by Dhruv_Gheewala »

timsh wrote: post #109

wow @apokryptein thanks for posting my article here... I'm shocked it's #1 rn. if anyone has any questions regarding the post - I'm here to answer & talk!

Wow, such a beautiful article you have written. Usually, I’m not into reading much but after very long I’ve completed a full article with such interest. Thanks for it !!

Re: Everyone knows your location: tracking myself down through in-app ads

#548

Post by idoitalready »

youcouldalways wrote: post #544
qingcharles wrote: post #156

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

Changing your number every year could mitigate as it would introduce entropy and stale data into the system. When done at scale, data lifetime would behave similar to the automatic deletion of messages on whatsapp. Somewhat mimicking an in person verbal conversation where only people's memories remember what was said and even their version gets changed every time memory recall takes place. Systems already exist in re…

I already do this. It gives me an opportunity to trim the contact list to people I actually talk to regularly which I send the new number too. Also shows me my footprint online since I have to update the number. I only change it for places I actually use regularly or are important.

Re: Everyone knows your location: tracking myself down through in-app ads

#549

Post by casenmgreen »

ironmagma wrote: post #309
_heimdall wrote: post #294

Earlier quoted context omitted.

It is possible to just not use a phone number. I mostly connect through Signal. I do technically have a phone number that my close friends and family have, but its a random VoIP number that I usually change every year or so. Surprisingly no one has really cared, I send out a text that I got a new number and that's that.

How? Most of the services I use, from Walgreens to banks to retirement accounts, require a phone number either for 2FA or just to verify that you’re you when signing up. After changing my phone number this year and having to go through the rigamarole for each service, I decided never again.

Never give a phone number to anyone.

Phone number is the gold standard identifying for third party data collation services.

This is why so many companies demand it.

One solution is a burner phone and burner SIM, for SMS only.

Re: Everyone knows your location: tracking myself down through in-app ads

#550

Post by tclancy »

bruce511 wrote: post #401
otteromkram wrote: post #383

Earlier quoted context omitted.

EBay, Amazon, Walmart, CVS, etc. Name a major company, then try to contact customer service and interact with an actual human. Even if they do have a contact phone number, good luck navigating the mazes of voice prompts. Amazon isn't actually so bad about this, but I couldn't tell you if their CSR chat bot is an actual person or mid-level AI by now.

My only connection to Amazon support has been for AWS. Perhaps though this should be an example of good customer service where talking to a human is easy, and not lumped in with the likes of Google where its impossible. Perhaps your experience with the online shop is different, but frankly they're in my "good" column, not my "bad" column.

This is not like for like: AWS assigns reps because the dollar amounts are significant compared to your monthly cell phone bill or a purchase at Amazon. It's not surprising that buying a car gets you better customer service than renting one.
Post reply on HN