Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple allows some iOS apps to track user locations via lists of nearby SSIDs

wingu.se

Post reply on HN
Print view View original

161–170 of 327 posts

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#161

Post by dwaite »

lloeki wrote: post #108
coldcode wrote: post #2

FYI, that API requires entitlements to be used, which are only available if you request them from Apple and justify their use. It's not a general-purpose API any app can use.

> that API requires entitlements to be used Lately I've witnessed a number of apps asking for Local Network permission ("Foo would like to find and connect to devices on your local network") when they have no business doing so in any possible way that I can think of.

Chrome Cast. There is no OS-level service for it to introspect the network looking for screens to cast to, so each app has to drop in a SDK - which then has to have permission to search the local network looking for screens.

This was improved in recent iOS, but I never count on Google updating their SDKs to take advantage of iOS features on any sort of schedule. Even when they do, it will require third party apps to individually update as well.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#162

Post by bear141 »

electric_mayhem wrote: post #147
bear141 wrote: post #125

Earlier quoted context omitted.

I wonder if there is a service to automate small (or large) donations to multiple organizations on a regular basis similar to an investment service? Edit: I can only find services marketed towards the nonprofit, not for the donor. A service that aggregated and automated all the nonprofits I want to regularly donate small amounts to would be great. I think it would be important to not require the nonprofits direct inv…

Benevity is a company that basically administers company matching donations. Database of approved nonprofits, can set up arbitrary amounts as recurring payments, and automatic matching if you do the donations through their site. It’s not quite “I got $500 this month to give back, scatter it amongst my chosen charities” but you could definitely use a service like that to set up baseline donations. I don’t do scheduled…

Thank you for this. I realize this suggestion fits the context of the thread, but I am currently self employed so I would love another suggestion that isn’t necessarily geared toward integrating with employer match programs.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#163

Post by JKCalhoun »

readams wrote: post #32
JKCalhoun wrote: post #22

Earlier quoted context omitted.

I love when I launch an app and then get a bevy of requests to access my Camera, my Microphone, my Contacts, etc... I nope out and if the functionality of the app is trashed, so goes the app.... Google Maps constantly hounding me to turn on precision location services, asking me if I am navigating for a friend and to allow access to my contacts... Wow, no.

You don't think location is useful for a map ... ?

It wants precise location — which I take to mean war-driving WiFi. GPS I am okay with for a map app.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#164

Post by r00fus »

smith7018 wrote: post #154
n2d4 wrote: post #133

Earlier quoted context omitted.

I don't know about Alipay, but afaict WeChat needs this feature for WeChat Wifi, which lets users connect to internet hotspots from their WeChat accounts https://mp.weixin.qq.com/s?__biz=MzI1NjA0NzQzOQ==&mid=265026...

I’m sure that’s valid but I’ve worked for mobile app companies and can guarantee features like this are added just to get the entitlement.

Ah now I see - to get all the entitlements they create a super-app that happens to use those things.

Then they can spy on us for our main use case

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#165

Post by vinay_ys »

paxys wrote: post #105

Reading through the linked docs, this API seems to specifically be for apps created by owners of WiFi hotspots to help users connect to those hotspots ( https://developer.apple.com/documentation/networkextension/h... ). > NEHotspotHelper allows your app to participate in the process of authenticating with hotspot networks, that is, Wi-Fi networks where the user must interact with the network to gain access to the wid…

Even if only genuine hotspot apps got the entitlement, it is not a user-friendly privacy-first design. Such API use should trigger a user-visible permission dialog before apps get background-notified and user should be able to select the one of "allow-once, allow while using, allow-in-background, never" and the app activity should show up in app privacy reports.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#166

Post by mcphage »

karmakaze wrote: post #58
intelVISA wrote: post #42

Earlier quoted context omitted.

Wasn't it ever thus?

I had the first iPhone up to the 3GS. It didn't feel that way then. Now there are continuous software updates that keep changing arbitrary and invisible policies.

> I had the first iPhone up to the 3GS. It didn't feel that way then.

The history of smartphones is control being tightened further and further over time. With the phones you had, apps could track your location lots of different ways, and over time those data leaks are being bricked shut. Everything is moving in the direction from "Apps can do whatever they feel like" to "Apple controls what apps can do" to "The user controls what apps can do".

This specific leak seems like it's stuck in the "Apple controls what apps can do" stage, so hopefully this post will help get it moving again.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#167

Post by dwaite »

rkunde wrote: post #44
eduction wrote: post #40

I thought users were prompted to give permission for this already? I get asked if I want to give “local network” access to apps sometimes (- lot these days actually) which I take to mean the ability to see local WiFi hotspots. I almost always deny this (and after reading this just turned it off for Spotify). I think the dialog that asks for permission could be improved, though, as most people don’t realize this can b…

That’s for sending and receiving local network traffic, eg. talking to devices on the same subnet, and discovery of Chromecast and similar targets. Edit: AirPlay does not require this permission.

AVRouting in iOS 16 allows for a Media Device Discovery Extensions, which allows for a proper ChromeCast or similar app to provide media streaming in the same interface as AirPlay.

So far there doesn't seem to be any traction by Google to migrate to this.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#168

Post by vlovich123 »

ralmidani wrote: post #160

This is one of the majors problems with completely locked-down platforms. Assurances that the owner of the platform respects your privacy and prevents others from violating it are really just a pinky promise.

I think the perspective can be incorrect. No one expects Apple to get it perfect. Computing platforms are legitimately hard to secure, especially when you’re talking about privacy which is a lot more amorphously defined culturally vs typical CS security which is defined as subverting technical access controls.

The key question is whether Apple will play a curator role in trying to reign in the ecosystem. They have in the past (eg Uber was doing shady shit and there was a game of chicken to get them to stop). Of course Alipay and WeChat may be harder especially how Apple China is such a huge market for Apple and critical to their success now. It’ll be interesting to see how Apple adjusts to this over the next few years.

Open platforms also have this problem and also operate on pinky promises (perhaps even worse) so I’m not sure the point you’re trying to make unless it’s that “well if this problem isn’t solved I’d rather have an open platform”. The problem with that argument is that there are many issues and this is only one failure case which may be addressed in the future whereas open platforms have this one and many more that are unadressed.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#169

Post by breakfastduck »

lxgr wrote: post #5
coldcode wrote: post #2

FYI, that API requires entitlements to be used, which are only available if you request them from Apple and justify their use. It's not a general-purpose API any app can use.

That’s not really any consolation, since (according to the article) Apple has granted that entitlement to WeChat and Alipay. Yes, these are “super-apps” and Wi-Fi hotspot services are probably part of their offerings, but that’s just more reason this should be a user-grantable permission like “local network access”. If I don’t care for the hotspot feature, I don’t want the app to have that capability.

Chinese state supported spyware spies on you? I'm shocked!

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#170

Post by breakfastduck »

rsync wrote: post #144
thih9 wrote: post #102

Which popular apps use that? Is it possible to check this? Like most here, I don’t have Wechat or Alipay installed. But I’m interested in e.g. Instagram, Facebook, Whatsapp, Twitter, Tiktok, Snapchat, Chrome, Firefox, Photoshop, Lightroom, etc.

I know I sound like a broken record but I really do think app stores owe us the ability to see, in advance, what permissions an app will request. I shouldn’t have to download and install the app just to see what kind of behaviors it is going to attempt. The app stores know this information and it would be trivially easy to present it in the details of the app prior to down loading.

Yeah, this should absolutely be standard.
Post reply on HN