Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone knows your location: tracking myself down through in-app ads

timsh.org

Post reply on HN
Print view View original

611–620 of 628 posts

Re: Everyone knows your location: tracking myself down through in-app ads

#611

Post by shaftway »

pavel_lishin wrote: post #609
shaftway wrote: post #608

Earlier quoted context omitted.

I'm in this industry, and I have knowledge about this. It's important to point out that it takes a long time for uptake of new versions of ad SDKs. The general assumption is that it takes about 6 months after release of a new version for 50% of ad traffic to come from that version or newer. Also, for every version you release, approximately 1% of traffic will never upgrade past that version. In that kind of world, ov…

> But let's say an advertiser comes to you and says "we want to spend $1M / day to advertise our 10GB game, but only to devices that could install it." I don't want to call you a liar, but having seen ads that are presumably targeted at me, it feels like a total fiction to say that anyone is actually capable or interested in doing this. I get advertisements for just absolute nonsense garbage that has no bearing on my…

The mobile ad industry is weird, and has some perverse incentives. Good games don't advertise (they don't need to). Games that hook the users just enough that they can show them more ads tend to plow that money right back into advertising to get more users. Those are the ads you see 99% of the time, and they're not really targeted. They're just people who know that the average 15 second interstitial will net them $0.006 in revenue, so they bid for it at $0.005.

Are there whales that spend $1m / day in advertising. Absolutely, 100%. Are they running at all times? No. We typically see that kind of spend from a single advertiser around 30 days out of the year. They're short campaigns, typically around a launch of a big title, and they always try to target as narrowly as they can to maximize their impact.

You're right about it using IP geo-location to guess where you are and what language you want. We also use that to determine if we should show you the GDPR disclosures. But try looking at ads on a Xiaomi phone versus a Samsung and you'll see a different set of ads, because one of those purchasers tends to have more disposable income.

Re: Everyone knows your location: tracking myself down through in-app ads

#612

Post by otterley »

inetknght wrote: post #583
otterley wrote: post #415

Earlier quoted context omitted.

You still have that right; you simply entered into a voluntary agreement with your employer not to exercise it in exchange for money. Happens all the time.

> you simply entered into a voluntary agreement with Let's stop you right there. Having a job is rarely truly voluntary. It's almost always obligatory instead.

That's just life. Modern society obligates us to do things like feed, clothe, and house ourselves; they aren't just going to result because you exist. Getting a job is an sacrifice we make to fulfill those other basic obligations.

To discuss further would require us to go into the rabbit hole to debate whether capitalism is the right structure for society, but so far, everything else that's been tried has been worse.

Re: Everyone knows your location: tracking myself down through in-app ads

#613

Post by ErigmolCt »

dangus wrote: post #559
ErigmolCt wrote: post #427

Earlier quoted context omitted.

"Private browsing" is just a polite request for companies to pretend they didn’t see you before

“Private browsing” is just private mostly in the sense of your local device, as in, your browsing history and cookies aren’t saved to disk. That still has some use as cookies are more direct tracking than fingerprinting (e.g., keeping you logged in, or a Google analytics script seeing that you’re a logged in Google user with a real identity provided to Google). “Ask app not to track” turns off Apple’s own device iden…

Most people assume "private" means something more

Re: Everyone knows your location: tracking myself down through in-app ads

#614

Post by ErigmolCt »

blueflow wrote: post #499
ErigmolCt wrote: post #425

Earlier quoted context omitted.

They’ve basically turned every phone into a tracking beacon

I'm sure there is a choir of "told you so"-singers somewhere.

Yeah, at this point, the surprise isn’t that it happened. It’s that people still pretend it’s not a big deal

Re: Everyone knows your location: tracking myself down through in-app ads

#615

Post by rpigab »

megous wrote: post #605
rpigab wrote: post #594

Earlier quoted context omitted.

Apps that have to link hardware via Wifi sometimes do, they take complete control over wifi in order to create a wireless access point and make the device connect to it during setup. I think Nikon camera remote control does this, also Meta Horizon, with Meta Quest VR headset, IIRC. There's also Wifi ranging feature, but it shouldn't need to expose SSIDs to the app, I don't know the API, it should be limited to giving…

That sounds like something that's also not that risky. Short lived, temporary access point with randomized BSSID/mac address should not be useful for long term tracking if done well.

It is not, if the developer only does what is expected. I believe when you have to perform this, the Android authorization asked to the user is complete control over the network adapter settings.

Re: Everyone knows your location: tracking myself down through in-app ads

#616

Post by rgovostes »

ActorNightly wrote: post #285
simonw wrote: post #193

Anyone understand why an apparently accurate latitude/longitude showed up in one of those traces despite location services not being enabled for the app in question?

Phones send out probe requests to get a list of open wifis. If you have a static access point, with a known geo location, software can be running on that point to remember a mac address of the phone from a probe and store it. Thus enabling real time tracking. Im like 60% sure this is how they figured out who the Bomber was in Austin TX.

Not entirely... "Apple platforms use a randomized Media Access Control address (MAC address) when performing Wi-Fi scans when not associated with a Wi-Fi network." https://support.apple.com/guide/security/privacy-features-co...

Re: Everyone knows your location: tracking myself down through in-app ads

#617

Post by kortilla »

troupo wrote: post #428
kortilla wrote: post #219

Earlier quoted context omitted.

The lie doesn’t have to be intentional. All it takes is a really simple accidental debug logging flag to collect what amounts to a GDPR violation. The point is that no effort was made to implement a technical solution to protect privacy. So it’s upsettingly trivial to violate the GDPR unknowingly and any company that is even a little unscrupulous (of which there are hundreds) can easily ignore the law.

> The point is that no effort was made to implement a technical solution to protect privacy. And you want the government to do that? Why haven't the companies who at every turn shout how privacy conscious they are haven't done that? It's now been 8 years of GDPR. Why hasn't the world's largest advertising company incidentally owning the world's most popular browser implemented a technical solution for tracking and co…

> And you want the government to do that?

Yes, it’s their job. Building codes have technical specifications and don’t allow people to opt out. Airspace is very tightly regulated with technical specifications.

> Why hasn't the world's largest advertising company incidentally owning the world's most popular browser implemented a technical solution for tracking and cookie banners in the browser? Oh wait...

Because the government is the thing that is supposed to produce useful regulations, not an advertising company.

GDPR is like trying to solve smog by passing a law that says people can opt out of smog by staying out of the city. No regulations to actually reduce smog.

Re: Everyone knows your location: tracking myself down through in-app ads

#618

Post by baggy_trough »

xenic wrote: post #43
baggy_trough wrote: post #12

Earlier quoted context omitted.

Probably from IP address geolocation.

Doing that on the client side sounds pointless though, if you are already transmitting the ip.

It might be for consistency between vendors.

Re: Everyone knows your location: tracking myself down through in-app ads

#619

Post by DoctorOetker »

lsharkey602 wrote: post #607
DoctorOetker wrote: post #578

Earlier quoted context omitted.

As we all know some of the "consent" pop-ups have a first page of general settings, and then a "vendors" page to further deselect all the "legitimate interests". I recently noticed that a fraction of the "vendors" allow deselecting the "legitimate interest" but have the "consent" tick box marked and unmodifiable. Consider the following page: https://www.brighthub.com/environment/renewable-energy/artic... The followin…

As a European resident, I have put in a complaint to the company for you. Should it be dismissed out-of-hand, I will forward a complaint to my national Information Commissioner's office. I will post any results.

out of curiosity: which company did you put in a complaint to?

about posting any results: I assume you are aware that after some time it is no longer possible to add comments to a HN discussion, I assume you will post any progress as a HN submission?

Re: Everyone knows your location: tracking myself down through in-app ads

#620

Post by gsuuon »

XorNot wrote: post #232
qingcharles wrote: post #156

One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketp…

The thing is...contact details aren't really private information, basically by definition. The distinction is contact details privacy is based on the desire not be interrupted by people you didn't agree to be interrupted by - i.e. it's a spam problem - and realistically to solve this requires a total revamp of our communications systems (long overdue). The basic level of this would be forcing businesses to positively…

I think this could be one of the more legitimate uses of blockchain - distributed communications, contacts, and a refundable pay-per-call system to make spam calling uneconomical. Communication in general does desperately need an overhaul, phones are effectively useless as phones nowadays.
Post reply on HN