Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows your location: tracking myself down through in-app ads

timsh.org

Post reply on HN
Print view View original

601–610 of 628 posts

Re: Everyone knows your location: tracking myself down through in-app ads

#601

Post by ParetoOptimal »

matheusmoreira wrote: post #524
hellojesus wrote: post #354

Earlier quoted context omitted.

Grapheneos lets you pick this for apps before they even launch. You can revoke their network access, as well as define storage scopes for apps at a folder level, so if an app needs access to photos, you can define a folder, and that is the only folder it can scan for photos. I used that when submitting parental leave at work. I didn't want to provide full access to all my photos and files for work, so all they got wa…

A big problem with GrapheneOS is the fact it only officially supports Google phones. Google is apparently incapable of selling those things globally, limiting availability. There's also the fact hardware remote attestation is creeping into the Android ecosystem. There's absolutely no way to daily drive something like GrapheneOS if essential services such as banks and messaging services start discriminating against yo…

Is a bank app on your phone essential? I've never had a bank app installed on my phone.

Re: Everyone knows your location: tracking myself down through in-app ads

#602

Post by DoctorOetker »

ParetoOptimal wrote: post #600
DoctorOetker wrote: post #578

Earlier quoted context omitted.

As we all know some of the "consent" pop-ups have a first page of general settings, and then a "vendors" page to further deselect all the "legitimate interests". I recently noticed that a fraction of the "vendors" allow deselecting the "legitimate interest" but have the "consent" tick box marked and unmodifiable. Consider the following page: https://www.brighthub.com/environment/renewable-energy/artic... The followin…

Maybe you should look up their CEOs info on SignalHire and ask them?

I refuse to reward their behavior, one doesn't fight fire with fire.

Re: Everyone knows your location: tracking myself down through in-app ads

#603

Post by pavel_lishin »

KennyBlanken wrote: post #452
opello wrote: post #329

Earlier quoted context omitted.

I realize why this is bad. Full stop. I wonder if it ever evoked an dive into exactly what happened to leave these customers with thinking this was the most likely avenue for success? Hopefully in at least some cases their calls with CSRs were reviewed and in the most optimistic of best cases additional training or policies were put into place to avoid the hopelessness that evokes such drastic actions.

That would require empathy from someone who is, right now, bragging about how they sicced their lawyers and the cops on customers they were fucking over. I'm going to guess that the answer would be "nope, didn't care." That Cirrus isn't going to pay for itself, friend...and you can't retire at 40 without breaking a few eggs. I remember when Google was locking accounts because people had the audacity to issue a charge…

> That would require empathy from someone who is, right now, bragging about how they sicced their lawyers and the cops on customers they were fucking over.

How do we know they were fucking them over?

There's always going to be a subset of people who take any perceived slight as an attack on their honor, and will over-react. (I've had death threats for deleting a reddit post, fwiw.)

Re: Everyone knows your location: tracking myself down through in-app ads

#604

Post by sneak »

ParetoOptimal wrote: post #601
matheusmoreira wrote: post #524

Earlier quoted context omitted.

A big problem with GrapheneOS is the fact it only officially supports Google phones. Google is apparently incapable of selling those things globally, limiting availability. There's also the fact hardware remote attestation is creeping into the Android ecosystem. There's absolutely no way to daily drive something like GrapheneOS if essential services such as banks and messaging services start discriminating against yo…

Is a bank app on your phone essential? I've never had a bank app installed on my phone.

Yes. I would not be able to use my AmEx as effectively if I could not receive notifications (usually second factor for charges) in the app.

Re: Everyone knows your location: tracking myself down through in-app ads

#605

Post by megous »

rpigab wrote: post #594
megous wrote: post #588

Earlier quoted context omitted.

Almost no mobile apps need to know the mac addresses of anything, let alone SSID/BSSID. Why would OS give this info up to some app?

Apps that have to link hardware via Wifi sometimes do, they take complete control over wifi in order to create a wireless access point and make the device connect to it during setup. I think Nikon camera remote control does this, also Meta Horizon, with Meta Quest VR headset, IIRC. There's also Wifi ranging feature, but it shouldn't need to expose SSIDs to the app, I don't know the API, it should be limited to giving…

That sounds like something that's also not that risky. Short lived, temporary access point with randomized BSSID/mac address should not be useful for long term tracking if done well.

Re: Everyone knows your location: tracking myself down through in-app ads

#606

Post by megous »

Vilian wrote: post #582
megous wrote: post #566

Earlier quoted context omitted.

This normal in your society? https://electronicintifada.net/content/switzerland-deports-e... Interesting thought policing you have in there.

Want me to link the latest mass deportation that USA is doing and compare with one person?

I'm not arguing that what USA is doing is normal, either.

Re: Everyone knows your location: tracking myself down through in-app ads

#607

Post by lsharkey602 »

DoctorOetker wrote: post #578
qingcharles wrote: post #453

Earlier quoted context omitted.

Right now, my goto is signalhire

As we all know some of the "consent" pop-ups have a first page of general settings, and then a "vendors" page to further deselect all the "legitimate interests". I recently noticed that a fraction of the "vendors" allow deselecting the "legitimate interest" but have the "consent" tick box marked and unmodifiable. Consider the following page: https://www.brighthub.com/environment/renewable-energy/artic... The followin…

As a European resident, I have put in a complaint to the company for you. Should it be dismissed out-of-hand, I will forward a complaint to my national Information Commissioner's office. I will post any results.

Re: Everyone knows your location: tracking myself down through in-app ads

#608

Post by shaftway »

theptip wrote: post #35

> Why do they need to know my screen brightness, memory amount, current volume and if I'm wearing headphones? This is clearly adding entropy to de-anonymize users between apps, rather than to add specificity to ad bids.

I'm in this industry, and I have knowledge about this.

It's important to point out that it takes a long time for uptake of new versions of ad SDKs. The general assumption is that it takes about 6 months after release of a new version for 50% of ad traffic to come from that version or newer. Also, for every version you release, approximately 1% of traffic will never upgrade past that version.

In that kind of world, over-collecting data makes sense, especially if you think nobody will ever find out. Like total / and free disk space. There's no good reason to need those, right? But let's say an advertiser comes to you and says "we want to spend $1M / day to advertise our 10GB game, but only to devices that could install it." All of a sudden it's useful to know that a device only has 8GB of disk space, or only 100MB of free space.

So OK, if we didn't collect disk space, now it makes sense to collect disk space. Let's add it to the SDK. It takes a month or two to release a new version of the SDK. 3 months to get any meaningful traffic from it, and another 3 months to get up to 50% of your traffic. Assuming the ramps are linear, 4 months of 0%, and then 3 months of ramping to 50%, 30 days per month, you'll make $22.5M in the first 7 months. But if you had the logic in there to begin with, you'd have made $210M during the same time period. That makes it an easy choice for the business folks.

There are answers to this, but they all have drawbacks. You could limit data that ad agencies can collect. This reduces the value of ads. And agencies have learned that some data (like location) is low-value and high-risk, so they're removing the ability to supply it. I think it'd be better to support a model where ad code can be updated independently of the app. This way we could push out bug fixes faster, and could remove our just-in-case collection, but Apple has no signs that this is coming soon, and Google's answer has been such a shit-show that we aren't considering it viable over the next 4 years.

Edit: To address screen brightness specifically, it's a very rough proxy for age of the user.

Re: Everyone knows your location: tracking myself down through in-app ads

#609

Post by pavel_lishin »

shaftway wrote: post #608
theptip wrote: post #35

> Why do they need to know my screen brightness, memory amount, current volume and if I'm wearing headphones? This is clearly adding entropy to de-anonymize users between apps, rather than to add specificity to ad bids.

I'm in this industry, and I have knowledge about this. It's important to point out that it takes a long time for uptake of new versions of ad SDKs. The general assumption is that it takes about 6 months after release of a new version for 50% of ad traffic to come from that version or newer. Also, for every version you release, approximately 1% of traffic will never upgrade past that version. In that kind of world, ov…

> But let's say an advertiser comes to you and says "we want to spend $1M / day to advertise our 10GB game, but only to devices that could install it."

I don't want to call you a liar, but having seen ads that are presumably targeted at me, it feels like a total fiction to say that anyone is actually capable or interested in doing this.

I get advertisements for just absolute nonsense garbage that has no bearing on my life, and no bearing on anything that could have possibly been collected from my device.

The closest thing is that when I was in Mexico for a week, some of my podcast pre-roll ads were in Spanish. (Which, I should note, I do not speak fluently enough to even understand.) Even now, the occasional ad I'm served on a podcast is in Spanish.

And that's it. They saw that my IP came from Quintana Roo, and (somewhat reasonably) decided that I need to hear Spanish-language content. Even when I physically moved back to the United States.

Re: Everyone knows your location: tracking myself down through in-app ads

#610

Post by scyzoryk_xyz »

qingcharles wrote: post #156

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

That’s a textbook „surveillance capitalism” move.

Any chance of a tutorial or some materials on doing exactly this sort of thing?

Post reply on HN