Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple allows some iOS apps to track user locations via lists of nearby SSIDs

wingu.se

Post reply on HN
Print view View original

71–80 of 327 posts

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#71

Post by [deleted] »

rkunde wrote: post #44
eduction wrote: post #40

I thought users were prompted to give permission for this already? I get asked if I want to give “local network” access to apps sometimes (- lot these days actually) which I take to mean the ability to see local WiFi hotspots. I almost always deny this (and after reading this just turned it off for Spotify). I think the dialog that asks for permission could be improved, though, as most people don’t realize this can b…

That’s for sending and receiving local network traffic, eg. talking to devices on the same subnet, and discovery of Chromecast and similar targets. Edit: AirPlay does not require this permission.

[deleted]

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#72

Post by stavros »

anileated wrote: post #69
stavros wrote: post #59

Earlier quoted context omitted.

Why does apple get to decide which app gets automatic access to my private data, on my device, without needing to ask me?

FWIW I used WeChat a few years ago and at that point it definitely asked for local network access (which is what this article is about; a mechanism for collecting SSIDs which can then later be correlated to locations). If there is an entitlement, it is as of yet unclear whether it means a consent dialog/privacy toggle or not. IIRC an entitlement only means you can ask for this sort of access, not get it automatically…

Hm, I assume any app can ask for whatever it wants, but that's just an assumption. I don't know if app developers need to apply to be able to request permissions, but I don't own an iPhone.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#73

Post by lxgr »

MBCook wrote: post #49
lxgr wrote: post #5

Earlier quoted context omitted.

That’s not really any consolation, since (according to the article) Apple has granted that entitlement to WeChat and Alipay. Yes, these are “super-apps” and Wi-Fi hotspot services are probably part of their offerings, but that’s just more reason this should be a user-grantable permission like “local network access”. If I don’t care for the hotspot feature, I don’t want the app to have that capability.

Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…

No app gets special treatment for any of the user-grantable permissions like location, Bluetooth, local network access, contacts, photos...

What makes this any different? It really seems more like an oversight than a conscious decision, similarly to how (I believe) both iOS and Android have retroactively had to bucket some of the Bluetooth LE permissions into "location", since that's what you can effectively do with them.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#75

Post by Hippocrates »

rkunde wrote: post #44
eduction wrote: post #40

I thought users were prompted to give permission for this already? I get asked if I want to give “local network” access to apps sometimes (- lot these days actually) which I take to mean the ability to see local WiFi hotspots. I almost always deny this (and after reading this just turned it off for Spotify). I think the dialog that asks for permission could be improved, though, as most people don’t realize this can b…

That’s for sending and receiving local network traffic, eg. talking to devices on the same subnet, and discovery of Chromecast and similar targets. Edit: AirPlay does not require this permission.

I don't believe it is necessary for airplay, but probably is for Chromecast, Sonos, and many devices to establish ad-hoc connectivity for setup and operation.

I take this popup to mean that they want to fingerprint and locate my home network or backdoor it somehow. I ALWAYS deny this access unless the app specifically requires it, and that is rare.

WiFi based geolocationing should be a well known privacy threat by now. The popup should really communicate that better and provide tighter controls.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#76

Post by [deleted] »

JKCalhoun wrote: post #8
coldcode wrote: post #2

FYI, that API requires entitlements to be used, which are only available if you request them from Apple and justify their use. It's not a general-purpose API any app can use.

Most entitlements though trigger a privacy prompt to allow the user to disable the functionality. Without writing a test app, I don't know that this is the case with this entitlement. I think it should ask the user's permission.

[deleted]

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#77

Post by ascagnel_ »

graftak wrote: post #68
rkunde wrote: post #44

Earlier quoted context omitted.

That’s for sending and receiving local network traffic, eg. talking to devices on the same subnet, and discovery of Chromecast and similar targets. Edit: AirPlay does not require this permission.

You’d think that AirPlay would be abstracted away by an OS API that does the local network discovery itself.

In my experience, it is. My podcast app of choice doesn’t have that permission (I don’t even think it asked for it), but it has the ability to bring up the system audio output selector widget and do AirPlay.

If anything, I usually see this for apps that want to do playback via Chromecast/Miracast. The well-behaved apps wait until the user interacts with Chromecast output, the iffier ones ask on first launch.

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#79

Post by rullelito »

mrpippy wrote: post #12

It’s worth noting that use of NEHotspotHelper requires a special entitlement (com.apple.developer.networking.HotspotHelper) that you have to apply for, and presumably Apple won’t grant unless your app has a legitimate need for it. That said, this maybe shows an incompatibility between Apple’s privacy strategy and “super-apps” like WeChat and AliPay. When a company shoves all functionality into one app, that app sudde…

So Apple decides which companies should have your location data? Niiiice

Re: Apple allows some iOS apps to track user locations via lists of nearby SSIDs

#80

Post by onlyrealcuzzo »

MBCook wrote: post #49
lxgr wrote: post #5

Earlier quoted context omitted.

That’s not really any consolation, since (according to the article) Apple has granted that entitlement to WeChat and Alipay. Yes, these are “super-apps” and Wi-Fi hotspot services are probably part of their offerings, but that’s just more reason this should be a user-grantable permission like “local network access”. If I don’t care for the hotspot feature, I don’t want the app to have that capability.

Certain apps have always gotten special treatment. If it’s big enough to mess with phone sales they’re allowed nonsense a normal dev would be permanently banned for. Ex: all the stuff FB has been caught doing over the years My understanding (no first hand experience) is that WeChat and Alipay are basically required in China. If a phone doesn’t have them, it’s worthless and won’t sell. So naturally they too can do non…

Interesting that cutting monetary deals was a problem for Google, but special access APIs are fine.
Post reply on HN