4 ms·

No one seems to explain how Uber could track user when the have deleted the app ? It look more like an hack more than "a lack of boundaries" to me...

• trendia 10y ago
  And what benefit would they receive from knowing the location of people who don't even use the service?
  • sjilo 10y ago
    They could find them and convince them to reinstall.
  • calbear81 10y ago
    They use location tracking even when you're not using the app to predict where the demand might be going and to get data for future products like the Uber Shuttle which runs fixed routes.
  • solox3 10y ago
    Demand mapping, driver supply allocation, more accurate surge pricing for the rest of us with the app...
  • rafe33 10y ago
    If you read the article, it helped ensure that no drivers were scamming them by creating repeat fake customer accounts to increase the payout bonus.
• zdrummond 10y ago
  If I remember the old article, it was not that they could track after the app was deleted, but after the user had exited the app... after they had finished their Uber ride and went on their way
  • snissn 10y ago
    Which potentially could give them the feedback of answering the question "how close to their actual destination did their uber driver drop them off?"
  • monochromatic 10y ago
    That's a lot more plausible. Tracking after you've deleted the app would be pretty surprising.
  • swang 10y ago
    no that was "legal" in the sense that they forced users to turn on location and they stated they would track you up to 5 minutes after you left your uber, for "safety" reasons. this article is talking about something else it seems.
    • stickfigure 10y ago
      Or possibly the author is mistaken, as happens so often in tech journalism. I'm not going to defend Kalanick, but I'm through with getting emotionally worked up by news articles.
• marklyon 10y ago
  …and, if true, exposes significant concerns about the OS. I'm less concerned about Uber exploiting this flaw than some far more malicious actor.
• ajross 10y ago
  That's what I'm asking too. This is the first reporting of what sure sounds like an iOS security vulnerability exploited by the Uber app, and there's no technical content at all, it's just a description of a phone call between two executives. Come on, NYT!
  • geofft 10y ago
    There's technical content at the bottom of the article: To halt the activity, Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents. There was one problem: Fingerprinting iPhones broke Apple’s rules. Mr. Cook believed that wiping an iPhone should ensure customers that no trace of the owner’s identity remained on the device.
• tedmiston 10y ago
  Currently, and until they re-allow in-app location only as an option, I block Uber with no location access and only enable it while I'm requesting a ride, then block it again after it's started. A little tedious but it's better than giving them full background location — it's also resulted in me using Lift more.
• zzalpha 10y ago
  They mention fingerprinting in the article. Uber engineers assigned a persistent identity to iPhones with a small piece of code, a practice called “fingerprinting.” Uber could then identify an iPhone and prevent itself from being fooled even after the device was erased of its contents. There was one problem: Fingerprinting iPhones broke Apple’s rules. Mr. Cook believed that wiping an iPhone should ensure customers that no trace of the owner’s identity remained on the device. I expect what they do is fingerprint the device to detect fraudulent use later. Typically this is done by combining a bunch of identifiers and details on the device and then hashing the result. The output is a unique identifier for that specific device. While technically this doesn't store any "identity" information on the device itself, if done correctly, the device could be identified and tracked across wipes (hence Cook's comment). Of course, the article does a piss poor job explaining this, but for many readers the nuance doesn't matter... They capture the spirit well enough, even if the details are pretty misleading.
• geofft 10y ago
  The article means "track" in the sense of "uniquely identify the physical device," not "send location information." Uber had code that would persistently identify which device was being used across two different installations of the app, even if the device had been factory-reset. (I suppose they could do something like find the MAC address, although Apple has been making that harder.) Furthermore, that code wasn't triggered, somehow, in devices near Cupertino, indicating that they were trying to hide the code from App Store reviwers. I think I feel that this is very qualitatively different from gathering location data on users who have deleted the app (if such a thing were possible), but nevertheless a serious ethical lapse.
• pthreads 10y ago
  In this case, by tracking, it means the device's unique identity via fingerprinting. It does not mean location tracking or other similar information. So if multiple accounts are created on the same device (deleting the app in between) it would indicate that those accounts are fraudulent accounts. The issue with location tracking even when the Uber app is not running is a different issue. In my opinion Apple should have suspended their app from the iTunes App Store until they fixed the app. Because isn't that what they do to other small players? I would say there is a bit of hypocrisy on Apple's part here.
  • _delirium 10y ago
    If you add in the part where they "geofenced" Apple's headquarters, so the app behaved differently in that location than elsewhere in order to hide what it was doing, I'm not sure anyone else would even be merely suspended. Explicitly trying to hide your app behavior from App Store reviewers is such an overt sign that your app is doing something bad that it'll get anyone else's developer account banned from the app store entirely.