Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A family tracking app was leaking real-time location data

techcrunch.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: A family tracking app was leaking real-time location data

#31

Post by okmokmz »

ryandvm wrote: post #15
napolux wrote: post #2

Are this kind of apps really a thing?

I'm curious about the demographics of someone that would ask such a question (in such a manner). I suspect you do not have children, or at least not teenage ones. I recall that I used to hold much stronger (and different) opinions about child-rearing _before_ I had children of my own. I constantly struggle with balance between keeping my children safe and allowing them agency and the development of personal responsib…

As someone with extremely overbearing helicopter parents that now has a lot of issues that I have been working through over time with a therapist, please don't surveil and micromanage your children. It ultimately led to a lot of distrust of authority, anxiety, depression, social isolation, making worse choices in attempts to circumvent security controls and attempt to have control over my life, and other long lasting negative effects. I can guarantee that anything you implement (gps tracking, cameras, filters, logs) will be easily identified and bypassed, causing distrust and potentially even less safe decisions/scenarios.

Re: A family tracking app was leaking real-time location data

#32

Post by apayan »

symlock wrote: post #29
apayan wrote: post #26

Shameless plug: I've built a family location sharing app that uses end-to-end encryption, so you don't have to worry about this sort of data leak (or any other). It's available for iOS and Android. (It's in beta, but quite functional). https://www.zood.xyz

Very Interested, but what markers are there for me to trust you/your company? Is it Open Source? Have you been around for long? Are you audited? Is there a sustainable business model? The https://www.zood.xyz/products/location#about-zood-location page doesn't really say anything other than you promise you are doing what you say (and you probably are).

Fair question. As of this writing, there isn't anything to trust me short of sniffing all the packets coming out of the phone and/or decompiling the APK.

While in beta, I'm not charging, but in order to align my interests with those of users I will be charging for it once I'm done beta testing. So far I've only been testing with family and close friends.

The app isn't currently open source, but I want to find a license model that will let folks see the source code while still preventing someone from forking it and running their own instance of my company. As you noted, this needs to be a sustainable endeavor, and I think that would be unlikely if I just release it all under MIT or BSD-3

It's too early for an audit (and I don't have the money for one yet), but I'm using libsodium for the crypto so there's no need to worry about me writing my own bad crypto primitves.

The website is sparse, because the current audience for it is my family and friends who I've contacted about helping me with the beta testing. I intend to flesh out the site a lot more before I come out of beta.

Re: A family tracking app was leaking real-time location data

#33

Post by fcarraldo »

apayan wrote: post #26

Shameless plug: I've built a family location sharing app that uses end-to-end encryption, so you don't have to worry about this sort of data leak (or any other). It's available for iOS and Android. (It's in beta, but quite functional). https://www.zood.xyz

What's the advantage of Zood over Find My Friends from Apple[0] and Family Link from Google[1]?

[0]https://itunes.apple.com/us/app/find-my-friends/id466122094

[1]https://support.google.com/families/answer/7103413?hl=en

Re: A family tracking app was leaking real-time location data

#34

Post by apayan »

fcarraldo wrote: post #33
apayan wrote: post #26

Shameless plug: I've built a family location sharing app that uses end-to-end encryption, so you don't have to worry about this sort of data leak (or any other). It's available for iOS and Android. (It's in beta, but quite functional). https://www.zood.xyz

What's the advantage of Zood over Find My Friends from Apple[0] and Family Link from Google[1]? [0] https://itunes.apple.com/us/app/find-my-friends/id466122094 [1] https://support.google.com/families/answer/7103413?hl=en

The biggest difference is that Zood uses end-to-end encryption, meaning I (as the service operator) can't see your location. Your location is encrypted before it ever leaves your phone, and the only person that can decrypt it, is the person with which you are sharing. More info on the second half of the page here:

https://www.zood.xyz/products/location

Re: A family tracking app was leaking real-time location data

#35

Post by brewdad »

cyberfart wrote: post #30
macintux wrote: post #18

Earlier quoted context omitted.

In the eyes of the law (or at least the courts), journalists have broader latitude in the course of investigative reporting.

Yes but until that's decided in court, is this not confessing to a crime?

Until that's decided in court, there is no crime only actions that may or may not be legal.

Re: A family tracking app was leaking real-time location data

#36

Post by acheron »

ryandvm wrote: post #15
napolux wrote: post #2

Are this kind of apps really a thing?

I'm curious about the demographics of someone that would ask such a question (in such a manner). I suspect you do not have children, or at least not teenage ones. I recall that I used to hold much stronger (and different) opinions about child-rearing _before_ I had children of my own. I constantly struggle with balance between keeping my children safe and allowing them agency and the development of personal responsib…

> I suspect you do not have children

The absolute worst genre of HN comments is "single childless guy criticizes others about their parenting". You've got some examples in the replies to this comment.

I will say you're probably doing fine.

Re: A family tracking app was leaking real-time location data

#37

Post by ocdtrekkie »

apayan wrote: post #32
symlock wrote: post #29

Earlier quoted context omitted.

Very Interested, but what markers are there for me to trust you/your company? Is it Open Source? Have you been around for long? Are you audited? Is there a sustainable business model? The https://www.zood.xyz/products/location#about-zood-location page doesn't really say anything other than you promise you are doing what you say (and you probably are).

Fair question. As of this writing, there isn't anything to trust me short of sniffing all the packets coming out of the phone and/or decompiling the APK. While in beta, I'm not charging, but in order to align my interests with those of users I will be charging for it once I'm done beta testing. So far I've only been testing with family and close friends. The app isn't currently open source, but I want to find a licen…

You could do a reference source-type thing, where it isn't open source and using your source is prohibited, but people can browse it for specified purposes, such as auditing security issues: https://en.wikipedia.org/wiki/Shared_Source_Initiative#Restr...

Copyleft open source licenses only help you so much, people can still clone your company as long as their version is also open source. There's no way to prohibit corporate use of your code and still have an OSI-approved license.

The spot that kinda falls between those two classes is if you want people to be able to fork or self-host for personal/non-commercial use, and there's a few also not open source license examples out there for that too. There's a couple of that sort listed under https://en.wikipedia.org/wiki/Source-available_software (Commons Clause or Mega Limited Code Review sound fairly similar to what you might want.)

Re: A family tracking app was leaking real-time location data

#38

Post by code_duck »

napolux wrote: post #13
code_duck wrote: post #3

Earlier quoted context omitted.

Well, Apple has had one called “Find My Friends” since 2011.

But you have to authorize them and I trust more Apple than any random dev making an app with my location. I used the "find my frieds" enabling my wife to track me for when I went in a long distance working trip from Italy in a very sketchy area of the US called SILICON VALLEY. Jokes apart, a temporary "find my friends" can be useful, but a continuous tracking it's nonsense to me.

People routinely grant apps location access for much more dubious reasons. Anyhow, I was just pointing out this is an function that people definitely find useful.

Re: A family tracking app was leaking real-time location data

#39

Post by gnicholas »

cyberfart wrote: post #17

> We contacted one app user at random who, albeit surprised and startled by the findings, confirmed to TechCrunch that the coordinates found under their record were accurate. So they accessed the database as well as personal information of users? Is this not a crime whether or not the database was unprotected?

Sure seems risky to admit like this. The CFAA has been used very broadly, for example in the prosecution of Weev for accessing customer information on an unsecured AT&T server. It appears this conviction was overturned based on venue (a technicality unrelated to the CFAA), and the underlying question of the CFAA's breadth is still unknown. [1] At the very least, the author is opening himself up to prosecution — even if he ultimately could prevail.

Journalists do enjoy certain freedoms, but to my knowledge (as a former lawyer), special treatment under the CFAA isn't one of them.

1: https://www.wired.com/2014/04/att-hacker-conviction-vacated/

Re: A family tracking app was leaking real-time location data

#40

Post by apayan »

ocdtrekkie wrote: post #37
apayan wrote: post #32

Earlier quoted context omitted.

Fair question. As of this writing, there isn't anything to trust me short of sniffing all the packets coming out of the phone and/or decompiling the APK. While in beta, I'm not charging, but in order to align my interests with those of users I will be charging for it once I'm done beta testing. So far I've only been testing with family and close friends. The app isn't currently open source, but I want to find a licen…

You could do a reference source-type thing, where it isn't open source and using your source is prohibited, but people can browse it for specified purposes, such as auditing security issues: https://en.wikipedia.org/wiki/Shared_Source_Initiative#Restr... Copyleft open source licenses only help you so much, people can still clone your company as long as their version is also open source. There's no way to prohibit cor…

Despite being a big fan of copyleft, the "source available" license sounds like the right direction for Zood. Thanks for that link. I had not heard about Commons Clause or Mega Limited Code Review. I'll dig into it those.
Post reply on HN