Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPhones and 3G iPads log your location in an unencrypted file on the device

radar.oreilly.com

Post reply on HN
Print view View original

151–160 of 196 posts

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#151

Post by eridius »

runjake wrote: post #84
PandaPacha wrote: post #81

Earlier quoted context omitted.

In deed nothing new. About a year ago a man discovered that his wife's iPhone was sending about 75 Mb of data to Apple via wifi in early morning : https://discussions.apple.com/thread/2450738?threadID=245073... It turned out it was dumps of GPS data and other stuffs. Apple acknowledged that to the House of Representatives. They're gathering data about their customers, including GPS : [PDF] http://markey.house.gov/doc…

Good info, thanks. It's important to note that the above use of "anonymous" is laughable in context. In order for that uploaded data to be useful by Apple, it needs to maintain both the lat/long and wi-fi access point ethernet addresses & signal strengths. This is pretty much a globally-unique identifier.

Identifier of what, though? The two data points you just described identify the wireless network, not the iPhone. In fact, what you just described is precisely the data required for obtaining a device location from the nearby wireless networks, a la Skyhook.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#152

Post by 5l »

edw wrote: post #134
burgerbrain wrote: post #120

Earlier quoted context omitted.

"collection of data that might conceivably expose their users' wrong-doing" So to answer his question honestly: Yes, you are implying exactly that.

No, I am not. I wrote, "Life is complicated." Turn the issue around: how would you feel if Apple bent over backwards to help your partner fuck other people behind your back and leave no trace? I don't know why I'm bothering to write this, because you seem resistant to the concept of moral subtlety, but I will anyway: Studies have been done that show that morally equivalent choices can be posed in ways that lead to pe…

There is an easy solution. Apple has no business making moral judgements about my right to privacy. They should do everything in their power to protect it unless some lawful authority says otherwise in the course of a criminal investigation.

In such an investigation, your location history could be obtained from the mobile provider. Therefore this additional data could only possibly be of use to people who have no right to it in the first place.

So to phrase it in your language; yes, Apple's highest moral obligation is preventing the collection of unnecessary data about me, and indeed to tell me what it is collecting, why, and to whom it will be disclosed. In fact, where I live, all these principles are enshrined in a law called the Data Protection Act.

In the UK and the wider EU at least, Apple could be in a considerable amount of trouble for collecting this data.

Edit x2: grammar.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#153

Post by justsee »

The same community that would generally react very negatively to reports of a company storing passwords unencrypted in a database seems to effortlessly explain away Apple's approach to storing a significant amount of personal tracking data unencrypted, not on one pretty inaccessible server but on multiple easily-accessible devices. Fascinating.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#154

Post by dustyreagan »

sigzero wrote: post #149
dustyreagan wrote: post #139

Earlier quoted context omitted.

The problem is this data is being recorded without the user's knowledge or permission. (Unless it's a tiny line in the EULA I'm unaware of.) If the data is being used to help the performance of Location Based Services, there is no need to keep years worth of data, that persists, and is backed-up every time you sync. Apple could simply keep a log of the last 4 or 5 data points. Further, the data may not be super accur…

Unethical? Really? I don't think it is that at all. A mistake it isn't encrypted? Yes.

I think the fact that they're logging my location without my knowledge or permission for their personal interests (whether their exploiting it now or not), is unethical. The lack of encryption is just an implementation oversight on their part.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#155

Post by burgerbrain »

edw wrote: post #134
burgerbrain wrote: post #120

Earlier quoted context omitted.

"collection of data that might conceivably expose their users' wrong-doing" So to answer his question honestly: Yes, you are implying exactly that.

No, I am not. I wrote, "Life is complicated." Turn the issue around: how would you feel if Apple bent over backwards to help your partner fuck other people behind your back and leave no trace? I don't know why I'm bothering to write this, because you seem resistant to the concept of moral subtlety, but I will anyway: Studies have been done that show that morally equivalent choices can be posed in ways that lead to pe…

"to help your partner fuck other people behind your back and leave no trace?"

You really are hung up on this "nothing to hide" deal aren't you?

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#156

Post by dedward »

ugh wrote: post #140
allwein wrote: post #127

So after doing a quick analysis of the data on my iPhone, I've come to the conclusion that this isn't a huge issue at all. First, I'll start with the WiFi data (WifiLocation table): Among the information captured is MAC, Timestamp, and Lat/Long. I have a total of 118,640 records in my table. I did a "SELECT DISTINCT MAC FROM WifiLocation", and got... 118,640 records. This tells me that it's not "tracking my every mov…

Location tracking on iOS devices without GPS (for example an iPod touch) sometimes works without any internet connection (it nearly always works with an internet connection – WLAN access points are used to determine the approximate location), especially in urban environments (with a lot of WLAN access points). I always figured that iOS devices download location info on all the surrounding WLAN access points (maybe ev…

Does the iPhone actually have real GPS, or is it just based on 3G towers?

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#157

Post by jessedhillon »

dedward wrote: post #156
ugh wrote: post #140

Earlier quoted context omitted.

Location tracking on iOS devices without GPS (for example an iPod touch) sometimes works without any internet connection (it nearly always works with an internet connection – WLAN access points are used to determine the approximate location), especially in urban environments (with a lot of WLAN access points). I always figured that iOS devices download location info on all the surrounding WLAN access points (maybe ev…

Does the iPhone actually have real GPS, or is it just based on 3G towers?

It has A-GPS, which is inferior in some ways to true GPS, but is much more accurate than triangulating from towers (which it will resort to under certain conditions.)

http://en.wikipedia.org/wiki/List_of_devices_with_Assisted_G...

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#158

Post by guelo »

runjake wrote: post #63

I didn't know this was news. I and other security researchers & law enforcement have known about it for a while. I assisted in one court case where the data was used as evidence. I suspect the slick-looking iPhoneTracker app finally made it interesting to the media. Edit: There was a similar deal on iOS 3 but it seemed more like a bug, not a feature. Data would be purged at some unpredictable interval. I can't recall…

Side question, could you explain your ethics in helping the cops bust someone by using a tracking device they did not know they were carrying? Personally I find it repugnant and would not participate, the right to privacy is more important than a single crime.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#159

Post by foobarbazetc »

PandaPacha wrote: post #129
code_duck wrote: post #86

Earlier quoted context omitted.

I noticed Google asks to do this in Android, too. They make you explicitly OK it though, at least on my (Verizon Droid) phone. In location options, if you check certain options it warns you that Google will be logging wifi info and other details even while apps that access this info are not running. The warning shown when you click "Use wireless networks" in Location settings is "Location consent Allow Google's locat…

Yes it does scan surrounding wifi SSID because Google Maps uses Skyhook ( http://www.skyhookwireless.com/ , belongs to Google) to geolocate users faster than just using pure GPS signal. So does Apple which also use Google Maps geolocation services on their iPhones. My guess is that Apple is gathering all those data in order to build their own Skyhook. It makes sense, specially when you keep in mind that Apple bough t…

Google don't use Skyhook. They use their own database.

Skyhook is suing them due to this.

Re: IPhones and 3G iPads log your location in an unencrypted file on the device

#160

Post by foobarbazetc »

tlear wrote: post #17

This is a perfect timing for promotion of Playbook and BB security. I am sure RIM will miss the opportunity though.

And I'm sure Playbook has its own gaping security holes that no one will find or care about because no one's going to buy it.
Post reply on HN