5 ms·

> Ads are not the main privacy issue any longer, since there’s client-side protection against them. False. There is client-side protection in some browsers now

> Ads are not the main privacy issue any longer, since there’s client-side protection against them. False. There is client-side protection in some browsers now, but this attack exploits native apps that submit precise geolocation when requesting location-targeted ads. It demonstrates how to essentially reverse engineer that precise location with a matrix of ads crafted for this purpose.

roblabla 9y ago
My phone (Android/LineageOS) blocks native ads too. There's adaway that does this nicely. Client-side protection exists.
- Twirrim 9y ago
  also DNS66 helps
- abalone 9y ago
  The claim was not merely that client-side protection "exists." It was that ads are not a privacy issue any longer, implying a ubiquitous native solution, which is false. It's great that some OSes are trying to solve it system-wide but host blocking isn't viable as ubiquitous protection against this attack. It would just break all ads all the time, which ultimately would make the platform untenable for ad-based apps. What you want is something like the machine-learning Intelligent Tracking Prevention that Safari just rolled out, but applied to native apps. That is non-trivial.
  - Feniks 9y ago
    "It would just break all ads all the time" Sounds like a feature not a bug. Anyways I'm sure tech savvy folks who care about privacy and hate ads already have all the basic angles covered. I know I do!
_puk 9y ago
There is a bit of an arms race between get a few $/c extra CPM by spoofing the geo location (the app needs to ask for this, and have reason to from App Store perspective, so not always available), and the data aggregators detecting said spoofing (all clients having the same geo / patterns in geo etc). Reverse engineering will get you a PoC, but you can buy the cleansed data fairly easily (apparently..)
interfixus 9y ago
There's very real client-side protection: Do not have sleazy, add-supported apps installed, and - for what it's worth - keep your GPS and location services turned off except when explicitly needed.
- mirimir 9y ago
  Better yet, don't use a smartphone when you care about your location being tracked.
  - monochromatic 9y ago
    Well, sure. If I'm ever going to go murder someone, I'll try to remember to leave it at home. But I care some about it being tracked even when I'm not doing anything bad.
    - mirimir 9y ago
      Well, OPSEC isn't all or nothing. And there's lots of other good advice.
- abalone 9y ago
  It’s not clear if you believe all ad-supported apps are sleazy or if you think it’s clear to users when apps use precise geotargeted ads. Either way that doesn’t constitute “very real client-side protection” anymore than expecting folks to regularly disable basic functionality.

roblabla 9y ago

My phone (Android/LineageOS) blocks native ads too. There's adaway that does this nicely. Client-side protection exists.

Twirrim 9y ago
also DNS66 helps
abalone 9y ago
The claim was not merely that client-side protection "exists." It was that ads are not a privacy issue any longer, implying a ubiquitous native solution, which is false. It's great that some OSes are trying to solve it system-wide but host blocking isn't viable as ubiquitous protection against this attack. It would just break all ads all the time, which ultimately would make the platform untenable for ad-based apps. What you want is something like the machine-learning Intelligent Tracking Prevention that Safari just rolled out, but applied to native apps. That is non-trivial.
- Feniks 9y ago
  "It would just break all ads all the time" Sounds like a feature not a bug. Anyways I'm sure tech savvy folks who care about privacy and hate ads already have all the basic angles covered. I know I do!

_puk 9y ago

There is a bit of an arms race between get a few $/c extra CPM by spoofing the geo location (the app needs to ask for this, and have reason to from App Store perspective, so not always available), and the data aggregators detecting said spoofing (all clients having the same geo / patterns in geo etc). Reverse engineering will get you a PoC, but you can buy the cleansed data fairly easily (apparently..)

interfixus 9y ago

There's very real client-side protection: Do not have sleazy, add-supported apps installed, and - for what it's worth - keep your GPS and location services turned off except when explicitly needed.

mirimir 9y ago
Better yet, don't use a smartphone when you care about your location being tracked.
- monochromatic 9y ago
  Well, sure. If I'm ever going to go murder someone, I'll try to remember to leave it at home. But I care some about it being tracked even when I'm not doing anything bad.
  - mirimir 9y ago
    Well, OPSEC isn't all or nothing. And there's lots of other good advice.
abalone 9y ago
It’s not clear if you believe all ad-supported apps are sleazy or if you think it’s clear to users when apps use precise geotargeted ads. Either way that doesn’t constitute “very real client-side protection” anymore than expecting folks to regularly disable basic functionality.