Popular iPhone apps caught sending user location data to monetization firms

Post by octosphere » Sat, Sep 08, 2018, 3:28 PM UTC

MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

Post by TravisLS » Sat, Sep 08, 2018, 3:36 PM UTC

octosphere wrote: post #181

MBCook wrote: post #26

No surprise to see a number of weather apps on here. Seems to be such an incredibly scummy category. The built in Apple app is fine for basic information. There are plenty of high-quality third-party apps. Weather Line (my fav) is $2. DarkSky is $4. Instead people go for these weird free apps covered in ads with terrible UIs. The NOAA one isn’t made by the government, seems like using that name should be some kind of…

> It’s amazing how much better your experience is if you just avoid free apps when possible. It doesn't necessarily follow that because an app is free that it has a higher probability of being malicious. If anything developers will introduce malicious code into paid apps because those types of users typically have money in their iTunes account and are more interesting / have a better list of credentials to steal than…

Post by codedokode » Sat, Sep 08, 2018, 3:39 PM UTC

zadkey wrote: post #182

It's been said before, "If it's free, you are the product".

Post by gringoblake » Sat, Sep 08, 2018, 3:54 PM UTC

paxys wrote: post #6

walterbell wrote: post #4

How do researchers find this information? Presumably the apps are using encrypted network connections to submit your location data to surveillance backends. Is guardianapp reversing each application using jail broken devices? Using an iOS emulator to inspect the running app?

Lots of ways 1. You can inspect HTTPS traffic by installing a trusted MITM cert on your device - no jailbreaking necessary. 2. You can inspect the libraries provided by the owners of tracking endpoints to see what they collect and transfer. 3. Decompiling app bundles is usually pretty effective, and you can download them straight from iTunes.

Post by jasonlotito » Sat, Sep 08, 2018, 4:13 PM UTC

danjoc wrote: post #65

MBCook wrote: post #30

Earlier quoted context omitted.

If I buy that phone, and I get a weather app… it’s going to need to know where I am to provide me the forecast. And once I give it that permission, how does the phone/OS prevent them from selling the data that I gave them permission to have? It doesn’t.

> it’s going to need to know where I am to provide me the forecast Why would you think that? I don't need to give a weather app my location. It only needs to have one or more locations of interest to me. My weather widget pulls multiple locations for me, and has no access to my location data.