Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple allows some iOS apps to track user locations via lists of nearby SSIDs

wingu.se

Post reply on HN
Print view View original

231–240 of 327 posts

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#231

Post by CharlesW »

rsync wrote: post #144
thih9 wrote: post #102

Which popular apps use that? Is it possible to check this? Like most here, I don’t have Wechat or Alipay installed. But I’m interested in e.g. Instagram, Facebook, Whatsapp, Twitter, Tiktok, Snapchat, Chrome, Firefox, Photoshop, Lightroom, etc.

I know I sound like a broken record but I really do think app stores owe us the ability to see, in advance, what permissions an app will request. I shouldn’t have to download and install the app just to see what kind of behaviors it is going to attempt. The app stores know this information and it would be trivially easy to present it in the details of the app prior to down loading.

> I know I sound like a broken record but I really do think app stores owe us the ability to see, in advance, what permissions an app will request.

Beyond what Apple already does? https://imgur.com/a/ouEqiGG

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#232

Post by vlovich123 »

thund wrote: post #192
vlovich123 wrote: post #168

Earlier quoted context omitted.

I think the perspective can be incorrect. No one expects Apple to get it perfect. Computing platforms are legitimately hard to secure, especially when you’re talking about privacy which is a lot more amorphously defined culturally vs typical CS security which is defined as subverting technical access controls. The key question is whether Apple will play a curator role in trying to reign in the ecosystem. They have in…

Open platforms can be reviewed and fixed more easily and faster

Can you clarify with examples/technical description how an open platform will be able to review & fix privacy/security issues like this more easily/faster? As far as I know this wouldn't be news on Android because such permissions are granted as a matter of course without review. Keep in mind that most people use the Google or Samsung stores which aren't open platforms for verifying permissions aren't misused.

For what it's worth spyware/malware consistently seems to target Android more than iOS [1]. To be fair Android has more units, but that's just one axis - iOS users should be more valuable to exploit because they're usually in a different socioeconomic bracket. Another data point is that Android developers get paid anywhere from $2k to $20k to add malware to their Google Play store app [2] - I can't find any articles similar for iOS so would be interesting to compare the marketplaces if anyone knows it for iOS.

[1] https://nordvpn.com/blog/ios-vs-android-security/

[2] https://www.bleepingcomputer.com/news/security/cybercriminal...

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#233

Post by ccorcos »

r00fus wrote: post #164
smith7018 wrote: post #154

Earlier quoted context omitted.

I’m sure that’s valid but I’ve worked for mobile app companies and can guarantee features like this are added just to get the entitlement.

Ah now I see - to get all the entitlements they create a super-app that happens to use those things. Then they can spy on us for our main use case

Seems like Apple should give users the ability to download an app while rejecting an entitlement.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#235

Post by BertoldVdb »

physicles wrote: post #126
iforgotpassword wrote: post #110

Earlier quoted context omitted.

Because the Chinese market is too important. For wechat you can maybe argue that it's a "super app" and probably also can be used to connect to wifi hotspots, but for alipay I fail to come up with an explanation..

Alipay is also pretty much an everything app (it also has its own ecosystem of mini-apps built on Alipay's platform). Except for the social aspect, it's nearly interchangeable with WeChat.

You can buy hotspot access with Alipay (scan QR code -> connect), presumably thats why.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#236

Post by talldatethrow »

dns_snek wrote: post #141
talldatethrow wrote: post #135

Earlier quoted context omitted.

Probably because you asked them for permission to use their phone and software.

They clearly purchased the phone, therefore it's not "their" (Apple's)

I honestly don't see it like that anymore. You paid in to buy the object but you're still asking for permission to use their overall ecosystem.

I think it's more like a child buying a teams jersey so that he can play on the team, but he can still get kicked off the team if he doesnt follow the rules. You can't argue "but I paid for the uniform with your logo, you must let me play 1st base!"

Sure the child still owns the uniform, and maybe he can get some use out of it or sell it off for spares (parts) to other people, but him paying doesn't make him own the team.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#237

Post by Analemma_ »

ccorcos wrote: post #233
r00fus wrote: post #164

Earlier quoted context omitted.

Ah now I see - to get all the entitlements they create a super-app that happens to use those things. Then they can spy on us for our main use case

Seems like Apple should give users the ability to download an app while rejecting an entitlement.

You can. iOS apps have to request individual permissions - I'm not sure about the specific level of granularity here, but you can deny location access while still letting the rest of the app run, and the app has to be able to deal with it.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#238

Post by Willamin »

rsync wrote: post #204
sneeze-slayer wrote: post #187

Earlier quoted context omitted.

In the Play store it is possible to see what permissions are required and data is collected.

I wonder if it is possible, as an Apple developer, to query "permissions requested" via some other channel ? I don't know anything about the ways Apple developers interface with the app store to submit or update or index their apps ... is it through xcode ? I wonder if there is some function in that toolchain that actually does what I am proposing ...

This is possible and relatively easy for Apple to do: for most (if not all) permissions, a declaration that you intend to ask for permission is required in the app's Info.plist manifest file.

When permission is requested and you've forgotten to declare that your app asks for it, the permission will be immediately denied without prompting the user.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#239

Post by Analemma_ »

ethbr1 wrote: post #194
samstave wrote: post #178

Earlier quoted context omitted.

The complexities and capabilities in the Chinese(well, most asia) mobile market are remarkable. I always find it funny when people boast about how great certain things are in the US without ever have traveled to HK, Singapore, Tokyo, Beijing etc... Most people dont realize just how entangled mobile life is in Asia, way more than in the US.

Centralized superapps seem incredibly dangerous to privacy, given that the limited mobile privacy models are designed around per-app permissions. 1. Create app that does 1 thing 2. Add more features to app 3. Abuse superset of permissions 4. Gov leans on app owner 5. Gov abuses superset of permissions

I think if you're in China the centralized superapp is the least of your worries, privacy-wise. I agree that this is probably part of why these things will never really take off in the US though (no matter what Elon wants to wish for).

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#240

Post by ben_w »

salawat wrote: post #157
ben_w wrote: post #95

Earlier quoted context omitted.

Quite a few apps run tests to find out if they're running on a rooted device, and refuse to continue if they are. Dunno if these apps do that or not, but I can easily imagine that using them is a Hobson's Choice even in OSS utopia: take the horse offered (app with tracking) or don't have a horse.

There is no Hobson's choice in OSS utopia, as the outcome of "app with tracking offered only" is "fork app - tracking". You can sit there and stew over the gall of those people to do it, but if you piss them off enough, it will happen.

To the extent you could ever replace WeChat and Alipay with OSS, that's already a possibility today even with closed OSes and App Stores.

To the extent that you can't (network effects or legal obligations or whatever) you still won't be able to if the code of those apps is made available under any license of your choice.

Post reply on HN