A family tracking app was leaking real-time location data

Yes. They are terrible. My mother uses it on my teenage brother so much that he actually leaves his phone places so she thinks he’s somewhere he isn’t.

So in wanting to keep your child safe by checking these apps often, you can make them _less_ safe and more dishonest.

Re: A family tracking app was leaking real-time location data

#7

Post by unixpickle » Fri, Apr 12, 2019, 2:55 PM UTC

Not the first time someone left a MongoDB database exposed to the wild, and it won't be the last. It's an easy thing to do, especially since MongoDB is so popular for small single-server projects.

A few years ago, I discovered the open MongoDB database of an educational website called Kaizena, which we were using in my high school English class. When I reported the problem to them, they quickly fixed it (probably with some iptables hack). They even wrote a blog post [1] about fixing it, where they claimed they added "additional firewalls to the database". More like _one_ firewall.

As a side note, Kaizena also had another security bug where their API would return JSON payloads that had private information in it (e.g. the voice feedback for other students' work). I reported it years ago, but who knows if it's fixed.

[1] https://blog.kaizena.com/post/68627783859/a-note-on-security

Re: A family tracking app was leaking real-time location data

#8

Post by dcbadacd » Fri, Apr 12, 2019, 2:57 PM UTC

rootusrootus wrote: post #4

napolux wrote: post #2

Are this kind of apps really a thing?

Yes of course. Personally I use Life360. It's very handy. Even Google had an app like it, until (of course!) they killed it.

Google maps still allows location sharing, not just covert one.

Re: A family tracking app was leaking real-time location data

#9

Post by ryandvm » Fri, Apr 12, 2019, 2:58 PM UTC

rootusrootus wrote: post #4

napolux wrote: post #2

Are this kind of apps really a thing?

Yes of course. Personally I use Life360. It's very handy. Even Google had an app like it, until (of course!) they killed it.

They brought it back. It's branded "location sharing" in the current iteration of Google Maps. Works just like Latitude used to. You can see people who are sharing their location with you right in Google Maps.

Re: A family tracking app was leaking real-time location data

#10

Post by rootusrootus » Fri, Apr 12, 2019, 3:14 PM UTC

willio58 wrote: post #6

napolux wrote: post #2

Are this kind of apps really a thing?

Yes. They are terrible. My mother uses it on my teenage brother so much that he actually leaves his phone places so she thinks he’s somewhere he isn’t. So in wanting to keep your child safe by checking these apps often, you can make them _less_ safe and more dishonest.

That's not a problem with the app.