Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple allows some iOS apps to track user locations via lists of nearby SSIDs

wingu.se

Post reply on HN
Print view View original

11–20 of 327 posts

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#11

Post by filleokus »

coldcode wrote: post #2

FYI, that API requires entitlements to be used, which are only available if you request them from Apple and justify their use. It's not a general-purpose API any app can use.

But if Facebook/Instagram/Messenger (or Alipay / WeChat as mentioned in the article) has this entitlement and does fishy stuff, I guess this can actually be a large privacy issue?

Does Apple do any analysis of entitlement usage and withdraw them when abused? A similar thing I remember is the Facebook VPN "scandal" where I think Apple withdrew the Facebook enterprise signing certificate?

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#12

Post by mrpippy »

It’s worth noting that use of NEHotspotHelper requires a special entitlement (com.apple.developer.networking.HotspotHelper) that you have to apply for, and presumably Apple won’t grant unless your app has a legitimate need for it.

That said, this maybe shows an incompatibility between Apple’s privacy strategy and “super-apps” like WeChat and AliPay. When a company shoves all functionality into one app, that app suddenly has all the entitlements, and it’s harder to tell when and how any sensitive data is being used.

The West generally doesn’t develop apps this way. For example, Comcast has a separate “WiFi Hotspots” app. Although LOL, they posted 2 days ago that its functionality is being combined into the main Xfinity app. Maybe the West is catching up.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#13

Post by bhpm »

mrpippy wrote: post #12

It’s worth noting that use of NEHotspotHelper requires a special entitlement (com.apple.developer.networking.HotspotHelper) that you have to apply for, and presumably Apple won’t grant unless your app has a legitimate need for it. That said, this maybe shows an incompatibility between Apple’s privacy strategy and “super-apps” like WeChat and AliPay. When a company shoves all functionality into one app, that app sudde…

Musk wants Twitter to be a super app.

https://www.theverge.com/2023/7/26/23808796/elon-musks-x-eve...

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#14

Post by lxgr »

donohoe wrote: post #10

How is it any different than an app that makes an request to their services API, thereby getting IP address which in itself can be used to get location information? There is always a vector for abuse, and I think Apple has taken large steps to reduce that. I find this story a bit of a non-event.

There’s a huge difference!

Wi-Fi positioning is usually accurate within a few meters; my IP is frequently on the other side of the globe (when using a VPN or just roaming globally).

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#15

Post by JKCalhoun »

peddling-brink wrote: post #7

Docs: https://developer.apple.com/documentation/technotes/tn3111-i... I’d guess a review would stop the smaller spam apps, but not the big players, as noted by the author and other commenters.

Thanks. The docs confirm that an entitlement is required to call this API — still does not make clear to me whether the presence of the entitlement brings up a prompt allowing the user to deny the use of the API.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#16

Post by secondcoming »

INGSOCIALITE wrote: post #4
mrtksn wrote: post #3

TL;DR: Apps can access the nearby Wi-Fi hotspot SSID and MAC addresses through an API that is intended to help with connecting to hotspots. Then they can use this info to look-up in databases that collect SSIDs based on their locations. Seems like a valid concern, though the author's writing style can be off putting since has a tone with an agenda. However, AFAIK apps need to declare the use of this API and have a go…

i wouldn't be worried about my flashlight app tracking me, i'd be worried about the large players who probably GET the use of this API, google facebook etc etc.

If that app has ads then your info is being sent to advertisers.

Why would a flashlight app even need your location?

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#17

Post by mrtksn »

INGSOCIALITE wrote: post #4
mrtksn wrote: post #3

TL;DR: Apps can access the nearby Wi-Fi hotspot SSID and MAC addresses through an API that is intended to help with connecting to hotspots. Then they can use this info to look-up in databases that collect SSIDs based on their locations. Seems like a valid concern, though the author's writing style can be off putting since has a tone with an agenda. However, AFAIK apps need to declare the use of this API and have a go…

i wouldn't be worried about my flashlight app tracking me, i'd be worried about the large players who probably GET the use of this API, google facebook etc etc.

As I said, it's a valid concern. However the author forget the mention that you need to apply and get approved to use this API. I find it dishonest and alarmist.

Here's the request form that you fill up for it: https://developer.apple.com/contact/request/hotspot-helper/

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#18

Post by filleokus »

donohoe wrote: post #10

How is it any different than an app that makes an request to their services API, thereby getting IP address which in itself can be used to get location information? There is always a vector for abuse, and I think Apple has taken large steps to reduce that. I find this story a bit of a non-event.

IP gives you a rough location (like which city at best), SSID/BSSID can give you street/building level accuracy if it's in a database like https://wigle.net

Considering the scale of these apps, I'm guessing they have internal wifilocation databases with fairly great accuracy.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#19

Post by nequo »

mrpippy wrote: post #12

It’s worth noting that use of NEHotspotHelper requires a special entitlement (com.apple.developer.networking.HotspotHelper) that you have to apply for, and presumably Apple won’t grant unless your app has a legitimate need for it. That said, this maybe shows an incompatibility between Apple’s privacy strategy and “super-apps” like WeChat and AliPay. When a company shoves all functionality into one app, that app sudde…

> com.apple.developer.networking.HotspotHelper

Where do you revoke this entitlement on iOS? Settings → Privacy & Security → Local Network? Or is this something else?

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#20

Post by peddling-brink »

JKCalhoun wrote: post #15
peddling-brink wrote: post #7

Docs: https://developer.apple.com/documentation/technotes/tn3111-i... I’d guess a review would stop the smaller spam apps, but not the big players, as noted by the author and other commenters.

Thanks. The docs confirm that an entitlement is required to call this API — still does not make clear to me whether the presence of the entitlement brings up a prompt allowing the user to deny the use of the API.

If it does, it would be for network, not location. Per the rules, this isn’t a location api, except it actually is.

Iirc Android has always asked for location to enable Bluetooth, I wonder if there are similar apis there?

Post reply on HN