3 ms·

This is not possible if you have not granted Location Services access, due to the nature of how iOS works. This only shows that a coordinate pair is being sent

This is not possible if you have not granted Location Services access, due to the nature of how iOS works. This only shows that a coordinate pair is being sent to the Uber API, which may have been cached from a time in the past, such as last time a ride was requested. The author counters this only by driving away in attempt to “reset” it, but instead of sniffing the traffic to see that the headers changed to reflect the new coordinates, they reached their conclusion by returning home and sniffing the traffic and saw that the coordinates remained the same. For this to work as described, something in iOS would have to be incredibly broken.

ydushyant 9y ago
I totally agree with you!!
mxxx 9y ago
He hasn't really done much to prove conclusively that it's not just coordinates associated with his wifi SSID. > there is a red push pin right on top of literally the room I am sitting in in the house using Google Maps Satellite View. why not step outside and try again, see if it moves. or is that room just where he spends most of his time with the phone location services turned on connected to wifi...?
- noncoml 9y ago
  Why would/should the Uber app try to associate SSIDs with coordinates?
  - mxxx 9y ago
    For the exact scenario that the author is describing; attempting to ping your location while you've got your GPS switched off. I don't think it's a particularly uncommon practice. Not saying it's likely, just something that he should probably attempt to disprove before declaring that the Uber app is sneakily using your GPS after you tell your phone to turn it off.
- jhgg 9y ago
  >coordinates associated with his wifi SSID. I don't believe there's a public API for this on iOS. In order to use wifi hotspots to assist with GPS on iOS, you'd have to have location services enabled for the app. That being said, it's very possible the app is just holding onto the last coordinates it was able to receive when location services was enabled for the app. This may be the default sane behavior to allow it to boot faster, as it'll be able to show/use the previously cached location to load maps, rather than waiting for a GPS fix to be acquired. The author's test case of booting waze at a different location and then seeing if uber picks up that location after traveling away from it, without booting up the app is probably bogus, as unless granted, uber does not have access to location in background, and thus will not be able to access new location data while the app is not running. Once location services is disabled again, and the app is booted, the app should not see the previous location a GPS fix was able to be acquired (as that would break the implicit guarantee that an app using location services w/o background permissions should only see where you are currently, and not where you have been). It's my suspicion this data is probably not directly used, and rather is used to enrich analytic events emitted internally within uber.
  - willstrafach 9y ago
    > I don't believe there's a public API for this on iOS There actually was a way to do this. It no longer works as of iOS 11 though.
- SilasX 9y ago
  You're both technically right, but you're writing in a way that suggests his article is somehow without basis or not something to worry about; but it's just the opposite. It seems he's pointing out that, even if you turn off location services, any app can just get around that by locating you via wifi. Isn't that worrisome, even if not unique to Uber?
  - willstrafach 9y ago
    I fully understand your point, and it is indeed a problem. In fact I have personally called out other apps for this: https://www.washingtonpost.com/news/capital-weather-gang/wp/2017/08/23/security-researcher-discovered-accuweather-app-tracks-and-shares-your-location-even-if-you-opt-out/ https://www.washingtonpost.com/news/capital-weather-gang/wp/... Thing is, possibly as a result, Apple blocked ARP access in iOS 11. You can no longer get the BSSID and use that to get user location. Because the post indicates he used an iOS 11 device, this leads me to believe the coordinates were also not obtained with Wi-Fi information.
  - mxxx 9y ago
    yeah don't get me wrong, if that's what it's doing it's still a dark pattern. but maybe _slightly_ less insidious than the alternative.

ydushyant 9y ago

I totally agree with you!!

mxxx 9y ago

He hasn't really done much to prove conclusively that it's not just coordinates associated with his wifi SSID. > there is a red push pin right on top of literally the room I am sitting in in the house using Google Maps Satellite View. why not step outside and try again, see if it moves. or is that room just where he spends most of his time with the phone location services turned on connected to wifi...?

noncoml 9y ago
Why would/should the Uber app try to associate SSIDs with coordinates?
- mxxx 9y ago
  For the exact scenario that the author is describing; attempting to ping your location while you've got your GPS switched off. I don't think it's a particularly uncommon practice. Not saying it's likely, just something that he should probably attempt to disprove before declaring that the Uber app is sneakily using your GPS after you tell your phone to turn it off.
jhgg 9y ago
>coordinates associated with his wifi SSID. I don't believe there's a public API for this on iOS. In order to use wifi hotspots to assist with GPS on iOS, you'd have to have location services enabled for the app. That being said, it's very possible the app is just holding onto the last coordinates it was able to receive when location services was enabled for the app. This may be the default sane behavior to allow it to boot faster, as it'll be able to show/use the previously cached location to load maps, rather than waiting for a GPS fix to be acquired. The author's test case of booting waze at a different location and then seeing if uber picks up that location after traveling away from it, without booting up the app is probably bogus, as unless granted, uber does not have access to location in background, and thus will not be able to access new location data while the app is not running. Once location services is disabled again, and the app is booted, the app should not see the previous location a GPS fix was able to be acquired (as that would break the implicit guarantee that an app using location services w/o background permissions should only see where you are currently, and not where you have been). It's my suspicion this data is probably not directly used, and rather is used to enrich analytic events emitted internally within uber.
- willstrafach 9y ago
  > I don't believe there's a public API for this on iOS There actually was a way to do this. It no longer works as of iOS 11 though.
SilasX 9y ago
You're both technically right, but you're writing in a way that suggests his article is somehow without basis or not something to worry about; but it's just the opposite. It seems he's pointing out that, even if you turn off location services, any app can just get around that by locating you via wifi. Isn't that worrisome, even if not unique to Uber?
- willstrafach 9y ago
  I fully understand your point, and it is indeed a problem. In fact I have personally called out other apps for this: https://www.washingtonpost.com/news/capital-weather-gang/wp/2017/08/23/security-researcher-discovered-accuweather-app-tracks-and-shares-your-location-even-if-you-opt-out/ https://www.washingtonpost.com/news/capital-weather-gang/wp/... Thing is, possibly as a result, Apple blocked ARP access in iOS 11. You can no longer get the BSSID and use that to get user location. Because the post indicates he used an iOS 11 device, this leads me to believe the coordinates were also not obtained with Wi-Fi information.
- mxxx 9y ago
  yeah don't get me wrong, if that's what it's doing it's still a dark pattern. but maybe _slightly_ less insidious than the alternative.