Apple allows some iOS apps to track user locations via lists of nearby SSIDs

Post by lxgr » Thu, Dec 21, 2023, 10:34 PM UTC

paxys wrote: post #105

Reading through the linked docs, this API seems to specifically be for apps created by owners of WiFi hotspots to help users connect to those hotspots ( https://developer.apple.com/documentation/networkextension/h... ). > NEHotspotHelper allows your app to participate in the process of authenticating with hotspot networks, that is, Wi-Fi networks where the user must interact with the network to gain access to the wid…

    1. application is using CoreLocation API and has user's authorization to access precise location. [This seems harmless – the app already gets the precise location anyway here.]

    2. application has used NEHotspotConfiguration API to configure the current Wi-Fi network. [This seems to be the scope of the article!]

    3. application has active VPN configurations installed. [This one is quite surprising to me!]

    4. application has active NEDNSSettingsManager configuration installed. [No idea what this is exactly, but it seems similar to the VPN one.]

Post by lxgr » Thu, Dec 21, 2023, 10:38 PM UTC

Analemma_ wrote: post #237

ccorcos wrote: post #233

Earlier quoted context omitted.

Seems like Apple should give users the ability to download an app while rejecting an entitlement.

You can. iOS apps have to request individual permissions - I'm not sure about the specific level of granularity here, but you can deny location access while still letting the rest of the app run, and the app has to be able to deal with it.

Post by TylerE » Thu, Dec 21, 2023, 10:57 PM UTC

vinay_ys wrote: post #165

paxys wrote: post #105

Reading through the linked docs, this API seems to specifically be for apps created by owners of WiFi hotspots to help users connect to those hotspots ( https://developer.apple.com/documentation/networkextension/h... ). > NEHotspotHelper allows your app to participate in the process of authenticating with hotspot networks, that is, Wi-Fi networks where the user must interact with the network to gain access to the wid…

Even if only genuine hotspot apps got the entitlement, it is not a user-friendly privacy-first design. Such API use should trigger a user-visible permission dialog before apps get background-notified and user should be able to select the one of "allow-once, allow while using, allow-in-background, never" and the app activity should show up in app privacy reports.

Post by staplers » Thu, Dec 21, 2023, 11:04 PM UTC

freedomben wrote: post #139

stavros wrote: post #59

Earlier quoted context omitted.

Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?

I've asked similar questions before and am usually told that this is how Apple does things and it's what makes their users happy. It's in fact why they love and choose Apple. They trust Apple to make the right decisions, and this is in fact a big part of the value add of their products. This is much related to the walled garden approach. For example, ask about why sideloading should remain not an option at all, rathe…

Post by sunnybeetroot » Thu, Dec 21, 2023, 11:26 PM UTC

lxgr wrote: post #273

Analemma_ wrote: post #237

Earlier quoted context omitted.

You can. iOS apps have to request individual permissions - I'm not sure about the specific level of granularity here, but you can deny location access while still letting the rest of the app run, and the app has to be able to deal with it.

No, you can reject permissions, but not entitlements. Entitlements are granted (statically, per developer certificate or maybe app ID, not sure) by Apple, permissions are (optionally) granted by users at runtime. The only way to not have an app making use of an API gated by (only) an entitlement is to never install it. Of course there could be permissions that are gated behind entitlements, but in this case it seems…