20 ms·

iPhone apps share data with trackers, ad companies and research firms

369 points by akeck 7y ago

Despegar 7y ago
This is a good piece in the sense that it will get Apple to do something I've wanted for a long time, which is to ban all the third party frameworks that developers are shipping in their apps. They should either provide their own first party frameworks or select a handful of vetted partners that are allowed to provide those services to developers.
- la_barba 7y ago
  A couple of points. How realistic is that though? How would they even know where the code came from in a compiled binary? Also, a platform vendor controlling what code I can or can't use sounds like a totalitarian regime to me. IMHO a better idea would be to create privacy jails for apps and then users can decide if they want to stick certain apps inside jails where they don't get access to your IP, GPS data, accelerometer, camera, contacts, etc. Jails would be better than the annoying popups for permissions as they currently do it.
  - Despegar 7y ago
    >IMHO a better idea would be to create privacy jails for apps and then users can decide if they want to stick certain apps inside jails where they don't get access to your IP, GPS data, accelerometer, camera, contacts, etc. Jails would be better than the annoying popups for permissions as they currently do it. Nah that's a Do-Not-Track-esque cop out to preserve the ad and analytics industries. It's also extremely un-Apple. "Totalitarian" doesn't mean anything in this context because we're talking about computers and not governments. Privacy should be by default and not shift the burden to users or cost them in terms of user experience. Apple has the power to do that.
    - la_barba 7y ago
      Well, totalitarian in this context means shackling developers with micro-management of basic functions of software development. Apple has a large enough megaphone that I don't feel the need to care about whats best for them. They can do that themselves just fine. I'm only interested in it as a developer and as a user. As a developer I don't want an OS vendor telling me what code I write or which library I use. As a user, I want to be able to run an app inside a privacy jail that completely blocks access to my IP or GPS data - if I want to. >Privacy should be by default and not shift the burden to users or cost them in terms of user experience. Apple has the power to do that. You can have every single app run in a privacy jail by-default. Let the user opt-out on a per-app basis if they choose to. Apple could also simply just run a ad-blocker or a tracking scripts blocker as a system level feature. I admit that these kinds of measures are very 'controlling' if not totalitarian of their users. Should Microsoft allow users to install Chrome if the browser acts basically like a giant keylogger? Should we let users make the choice? Or let a benevolent dictator dictate what apps a user should be protected from. Reasonable people can come out of both sides of the privacy debate.
      - Despegar 7y ago
        >Well, totalitarian in this context means shackling developers with micro-management of basic functions of software development. This might be an interesting philosophical/religious debate about computers to some, but it's also one we had in 2008 when the App Store launched. It's clear after 11 years that Apple was right and the rest of the world simply does not share that religion. Conversely they sure do like the practical benefits from Apple's micromanagement. >You can have every single app run in a privacy jail by-default. Let the user opt-out on a per-app basis if they choose to. Apple could also simply just run a ad-blocker or a tracking scripts blocker as a system level feature. Apps already run in a sandbox and are private by default. The user has to give consent before an app gets location or contacts data. An ad blocker for apps is silly because it's an unnecessary hack when they control the App Store policies. The difference with giving permission to an app you downloaded is that you have a first party relationship with that app. You don't have a first party relationship with any of the SDKs that developers package into their app. They disclose it in their privacy policies that no one reads, but that's certainly not informed consent.
  - panpanna 7y ago
    Not sure about iOS but on Android these types of countermeasures have been available for a few years. See for example Orlis, ART, xprivacy, libradar and AdDroid for some pointers. (TBH, this should not be needed in the first place if Google did their job)
    - la_barba 7y ago
      Yeah iOS doesn't allow those kinds of apps. That's one thing I'm jealous of from Android.
      - panpanna 7y ago
        Well, Android has both the most and the least secure phones out there :)
- chillacy 7y ago
  People are perfectly capable of writing their own first party analytics framework. Or at least the part that uploads the data.
- deminature 7y ago
  Banning third party tracking frameworks means banning Fabric, Facebook, Twitter and other major SDKs. I'm skeptical Apple would take such a drastic step. Taking on the responsibility of providing these functions through a first party API is also a massive undertaking, which I'm not sure Apple would agree to.
  - munk-a 7y ago
    It would be absolutely beautiful if they did - they could even just cut some CDN network a check every month to host common assets in a privacy aware manner or do it themselves. It really wouldn't cost all that much. Web 4.0 integrated everywhere always-web is not at all consumer friendly - advertisers need to be downgraded to something that's suffered or rejected instead of supported.
- munk-a 7y ago
  I really doubt it will cause any sort of action, third party advertising is so deeply ingrained into iOS that there's some wonderfully terrible built in support - I remember helping to hook up an advertising ID share with a third party a bit ago in my employment history.
- threeseed 7y ago
  This makes no sense whatsoever. If you ban third parties framework then all that is going to happen is that those third party companies will just give you an API and standard schema and ask you to post the data to them. The value is in the dashboards not in the SDK. And then what you want Apple to block all HTTP POST requests too ?
- untog 7y ago
  I'm sorry, what? Ban all frameworks? That's absurd. How would they even know? You could just copy and paste the source code from a third-party framework into your own codebase.
  - tinus_hn 7y ago
    It wasn’t enforceable but frameworks used to be banned on iOS. Note by the way that most third party frameworks of course don’t give you the source code.
- beenBoutIT 7y ago
  If Apple had a better app portfolio they could just get rid of third party apps entirely and have people use progressive web apps in place of app store apps. Right now most apps have websites that provide almost the exact same experience as the native app without as many privileges. Uber is a great example https://m.uber.com/looking https://m.uber.com/looking
deleted 7y ago
[deleted]
beenBoutIT 7y ago
'What happens on your iPhone stays on your iPhone'; everything except SMS, MMS, email, phone calls, video calls and web browsing. Makes more sense for a place like Las Vegas.
- olliej 7y ago
  uhhhh You mean everything that involves sending data to other people involves ... sending things to other people? Or do you propose the SMS, MMS, email, phone calls, video calls, and web browsing should not actually be available?
  - beenBoutIT 7y ago
    Exactly, the primary purpose of the iPhone is to send things to other people.
    - zaphod4prez 7y ago
      ... people with to whom I choose to send things. I do not choose (or rather, I wish I could choose not to) send a ton of detailed information about my phone. my location, etc. to a bunch of unknown companies and people. I feel like I must be misunderstanding your point?
      - beenBoutIT 7y ago
        Metadata makes it an impossible wish. The act of sending or receiving anything provides companies the detailed information(phone, location, etc.) that you're trying to keep secret. Carriers like Verizon/AT&T/T-Mobile also sell users location data outright.
      - olliej 7y ago
        I think I'm misunderstanding your point. If you send a message to someone, or open a website, then necessarily you interact with a directory service (a telephone company, the message client's directory, DNS, etc). For iMessage, apple's servers then route the message to the appropriate account, and their various documentation on this says they don't record anything more than necessary (I assume each account has a glorified mailbox in which the encrypted messages are stored - there is no part of iMessage that can be decrypted by someone other than the recipient, except the destination - in an ideal world the sender would be stripped once its in the mailbox). If you load a webpage over https then no party in the middle knows what resources you pulled - alas they know the host because DNS queries aren't encrypted, and even if they were the IP addresses aren't, so with enough data it might be possible to infer destination for pages in hosting sites. None of these include your location information - beyond IP based inferences. The only people who have your location without explicitly asking is the carrier, and only because they can see you bouncing around towers
elagost 7y ago
Even for companies who are supposedly privacy-forward, their defaults say otherwise. A brand-new iPhone has all these privacy settings that are off by default, and that are usually confusingly labeled and buried several settings screens deep. Nobody really turns them on outside of a very small bubble. Once companies have your trust, they can't help but break it if it'll earn them another few bucks. Yelp's a household name and doesn't seem like a bad actor, but that's proven false by this article. Furthermore, while they claim to have your best interests in mind, Apple (and Google) let companies perform this kind of shady behavior on their platforms that they completely control. If they let others get away with this, can you really trust that the "don't upload my photos to your servers" switch really does what it says it does? How do you know your phone isn't recording audio and taking photos to send off to a datacenter in the middle of the night? (To be fair, a lot of this data that's being sent out probably has something to do with background services designed to make the experience better. Weather Channel might be gathering location in the background for more up-to-the-minute forecasts. For things like cloud storage services, scraping your camera roll and uploading the photos is probably something you ask them to do.)
- djrogers 7y ago
  Care to be more specific? Sharing of location, contacts, photos, calendars, access to your camera, etc are all disabled for 3rd party apps by default, and must be enabled individually for each app. What are all these privacy settings you are referring to that are off by default?
  - elagost 7y ago
    From what I understand (haven't set up an iPhone from default in a long time) but the 'limit ad tracking' is off by default, allowing apps to have background app refresh privileges is allowed for any app by default (you must manually disable for any offenders unless you want it off for everything), the privacy features in Safari are off by default, and Apple's own data-collection and location-collection is also on by default.
    - fhood 7y ago
ppeetteerr 7y ago
I don't know if there is much of a solution aside from blocking the domains not owned by an app publisher or not approved by apple (an ad tracker list, for instance). The best way to avoid being tracked is to use apps that you pay for, not apps that are free and make money with your data. You can also bookmark websites to your home screen instead of downloading apps, that way you don't grant apps the extra privileges. Finally, you can disable background app refresh.
- dhimes 7y ago
  I'm not convinced that the ones you pay for aren't tracking you too. As a non-app example, I pay for the Washington Post and uBlock Origin shows that I'm still food for doubleclick et al- even when I'm logged in.
- rampant_ai 7y ago
  > The best way to avoid being tracked is to use apps that you pay for, not apps that are free and make money with your data. Nearly all apps, paid or not, use 3rd party analytics tools to improve their engagement. If the app requires sensitive data to function, like your contacts, it's also available to the analytics tool. Even the app's developer might not be aware of what the tools they're using are collecting.
  - olliej 7y ago
    If the app developer is not aware of what the code they ship is collecting from their customers, the app developer should not be including that code. More over: why are you using an analytics system that involves sending your user's data to an arbitrary third party? Someone who is using your app has agreed to a relationship with you, not with facebook, or google, or what have you.
    - rampant_ai 7y ago
      > why are you using an analytics system that involves sending your user's data to an arbitrary third party Self-hosted analytics frameworks exist, but unfortunately aren't as popular because of the setup involved.
ksec 7y ago
I don't have a problem with Tracking when I am using the App. That is fair ( to a certain extent ) What really annoys me is Background App Refresh, how much data is being sent that is causing Battery Drain and Data Cost on Mobile? May be we should have Background Apps that only allow them to receive data? Or do we have to turn off Background App Refresh completely.
- olliej 7y ago
  I have a problem. Why should facebook or google know everything about every different app I use? If I have a bunch of apps all of which use facebook analytics then facebook knows the collection of apps I am using, and presumably my account information. That would also allow them to link those apps to my browsing if I ever use the web page version of those apps. An app - especially one I've paid for - has no justification for then providing my device and account information to an arbitrary third party, especially when many of them are well known as abusers of consumer privacy.
- beenBoutIT 7y ago
  If you're using Android the easiest way is to simply go into 'App info' and then hit 'Force stop'. That turns the app off entirely until the next time you actually use the app. Clicking the app's launcher normally starts the app back up.
- meissler 7y ago
  Especially when my wireless bill has a data limit. One month theScore app somehow used 5gb of background data.
- sosborn 7y ago
  My strategy is no background refresh and judicious application of “no cellular data” for each app.
- WAHa_06x36 7y ago
  All current popular protocols work by both sending and receiving data, even when you only want to receive data. So there is no reasonable way to have a receive-only mode.
amatecha 7y ago
Yeah, this is why I actually read the privacy policy on every app I install now. I've done this for the past 6mo or so. At this point I basically don't purchase apps that store any of my information on their servers (unless of course it's fundamentally required for the service, such as Spotify or the like).
- prophesi 7y ago
  I'm a bit confused. Shouldn't there be equal concern for apps that _share_ data with third-parties? The first-party app doesn't need to store any of the information in that case; they just hand it off in-transit. And have you had any luck with installing apps with such criteria? I'm on a similar boat, and primarily use F-Droid apps.
  - amatecha 7y ago
    Oh, yeah of course sharing data with 3rd parties is even more "nope" than just storing it themselves. The last app I looked at to consider purchasing, "Clear Todos", which was highly-reputed at some point? Their Privacy Policy link in App Store actually hits a 404 error page. To say the least, I almost never purchase anything from App Store these days. It's a pretty dire landscape, but I'm tired of "being the product", and I am willing to give up a lot of stuff to lessen how often my information is used/stored/profited from.
- throwawaymath 7y ago
  What do you do about the mobile apps which don't store your data themselves, but share it with various third parties?
- mirimir 7y ago
  > unless of course it's fundamentally required for the service, such as Spotify or the like Spotify does not need to track what you listen to, in order to stream music to you!
  - amatecha 7y ago
gok 7y ago
> there was some startling behavior by a household name: Yelp. It was receiving a message that included my IP address -- once every five minutes. A message that included your IP address? As in...any message sent over IP?
- mixmastamyk 7y ago
  In the header or in the payload? The second is not typical and a clue something fishy might be going on.
  - threeseed 7y ago
    The second is incredibly common almost the default. Most libraries will just collect as much info as they are able to, put it in JSON and ship it to some server. That includes your IP address.
    - IggleSniggle 7y ago
      Can you provide a source for this? I haven’t noticed this happening, although I believe the information is available in aggregate data. Of course, I also use uBlock etc so quite possible I simply haven’t noticed the trend.
      - karambir 7y ago
        Can confirm companies do this. I have helped build custom analytics solutions for android and iOS where apps dump literally anything and everything they can get data of. Product Managers are so inclined to scrape everything. I was surprised few years back when we could get device battery stats, nearby wifi ssids and even connected audio output device, if any. Later moved on to other roles.
        ryantgtg 7y ago
        As an example of how simple it is to get this info, check out the readme on this really popular React Native component: https://github.com/react-native-community/react-native-device-info https://github.com/react-native-community/react-native-devic... I’m not implying it’s a creepy component. This component captures some really useful information, depending on your needs. But yeah, simple stuff. And to back up an earlier comment in this thread, IP address is part of the user agent payload. That’s exceptionally common data to see, through browsers and apps. It doesn’t take a fancy library to capture that info. I really wanted to be alarmed by this article, but I left with more questions than answers. And I’m guessing Amplitude is bummed by this press. They actually responded to say they don’t share data with 3rd parties, yet their name is peppered throughout the article, with implications that they are sneaky and nefarious.
heywire 7y ago
I'll reproduce my comment [0] here from a similar article earlier this year [1]. Note: I ended up setting up that pi-hole, and I see it blocking a ton of DNS lookups for these types of companies across my family's devices. > I think many people would be surprised by the amount of analytics data leaving their phone _all the time_. I recently was doing some work where I had my iPhone proxied through mitmproxy on my laptop, and was blown away by just how much data was being sent. Some apps were sending a request to one or more analytics firms every single time I touched a UI control. I would set up a pi-hole and VPN to block this stuff, but I'm sure the app developers will just start tunneling the requests through their own hosts. Maybe some day one of these open source phones will actually be viable. [0] https://news.ycombinator.com/item?id=19109243 https://news.ycombinator.com/item?id=19109243 [1] https://news.ycombinator.com/item?id=19109027 https://news.ycombinator.com/item?id=19109027
- StreamBright 7y ago
  Same here, I also started to work on a project to consolidate pi-hole into a single binary using Rust. I want to run it on my laptop and on my routers at home as well.
  - SOLAR_FIELDS 7y ago
    Can you go into a little bit more detail about the reasoning behind this? I’m running a Pi-hole on raspberry pi as the single DNS server behind my whole home’s router. This means it blocks everything outbound in my house. Only thing it doesn’t block is when I’m on LTE/random WiFi access points, for which I’m considering routing all of my mobile devices via VPN through another instance of Pi-hole running on a digital ocean droplet. Beyond that what do running multiple instances of pi-hole do? Do you have multiple routers at home?
    - StreamBright 7y ago
      I travel a lot. I want to run something on my laptop so I do not need to VPN yet I have no ads.
pandemicsyn 7y ago
Kind of amusing reading this article on page that ublock origin reported as loading 38 trackers. Wonder what trackers the washingtonpost ios app itself uses.
- andrei_says_ 7y ago
  This comes up regularly in privacy discussions linking to articles in mainstream online publications. The editors and the writers of the articles are completely divorced from the decisions driving the technology and profitability of the publisher. It may be possible for writers to only publish articles in outlets which respect privacy at the expense of popularity but we're probably not hearing about those.
  - nothrabannosir 7y ago
    Fair, but as long as nothing changes, let us not stop pointing out the irony merely because things remain crooked. The buck has to stop somewhere, and at the end of the day wapo is profiting from tracking on an article bemoaning tracking. They're free to do so, and being hypocrites doesn't make them wrong, but being not wrong also doesn't make them infallible. And if someone finally founds a privacy respecting publisher, what better place for them to advertise than a comment lamenting a competitor's failing? Let's keep that door open :)
    - andrei_says_ 7y ago
      I’m wondering if a writer could get away with pointing this irony in their article. Could be a powerful gesture acknowledging the status quo and their own position.
    - briandear 7y ago
      Interestingly, Apple News does respect privacy. The privacy approaches of Siri, Apple News, Apple Music, etc. ought not be overlooked.
    - dhimes 7y ago
      To your point, as I said in a thread yesterday, I get these trackers and I'm logged in to WaPo. I pay them $100/year and they still track me. How can we make them stop? It's going to take our legislature, because this free market thing isn't going to do it.
lalos 7y ago
Anybody know of an easy way to block all Facebook SDK usage from iOS? The simplest that comes to mind would be through a custom DNS server, but even if you don't log in using FB SDK on apps they still ping back in someway or another to generate your shadow profile.
- DavideNL 7y ago
  I hate that Apple's walled garden forbids us to use a proper firewall on iOS... Anyways, a not so easy alternative is to install a Vpn Server like Algo and block all Facebook ips with ipset on the Vpn server. You can obtain all Facebook ips from their ASN number: whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > facebookips.txt https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...
  - tareqak 7y ago
    Thanks a lot for this command. Maybe I can use it blackhole all of that using my pi-hole server at home since I don't use any products or services from Facebook or its subsidiaries.
  - WAHa_06x36 7y ago
    You may hate that you can't do that, but do you really hate that scam companies can't install their own spying firewalls? Because they would. A lot.
- nvr219 7y ago
  At home I block all Facebook with pihole. Not 100% protection but it’s a start.
jammygit 7y ago
I used to run disconnect pro on my s8, which I believe is the app mentioned in this article. I recall that it tried to send a message to google play services every 2 minutes 24/7, no matter what. It creeped me out, so I’ve switched to an iPhone recently. Aside: I hope the librem does well it’s first release
amelius 7y ago
This makes me wonder, what is the difference between apps and websites, really?
- saagarjha 7y ago
  Apps are harder to tweak to where they don’t track you.
cfarm 7y ago
For the desktop web Duckduckgo has a plugin that shows you all the trackers that are on a webpage and lets you block them. They also have a mobile web app that you can use as your default web search on mobile. https://duckduckgo.com/app https://duckduckgo.com/app
layoutIfNeeded 7y ago
Please Apple do something about this, so I can stop sabotaging my career as an iOS developer by regularly arguing against tracking to my superiors.
_bxg1 7y ago
Wow. I'd diligently turned off background location for virtually everything, but I had no idea so many apps did background refresh by default. Your IP address is nearly as good as your GPS coordinates. (Edit: Maybe one's IP address on a cellular connection doesn't matter as much as I thought. I just did a check and it didn't even get my city correct.) Possibly the most surprising thing is that, unlike all other permissions, iOS didn't ask me directly before enabling background refresh. That's disturbing. Also, while I sympathized with Apple outsourcing Maps' business info to Yelp, they really should hold their partners to a much higher standard given all of their privacy rhetoric.
- tictok4 7y ago
  > I'd diligently turned off background location for virtually everything First thing I did with my wife's Iphone. I imagine that with that disabled and permissions set correctly , an iphone leaks less than an android.
  - ubermonkey 7y ago
    My understanding is that this is correct.
- florakel 7y ago
  For every app that I install I check if the app activated background app refresh. Most of the time it does not make any sense why an app would even need that, other than tracking me. Also disabling it for most apps is one of the best things you can do to extend your battery life. In Apple's defense it is a hard thing to ask the user whether or not they want to permit "background app refresh". Many users might not understand at all what this means. It is not as easy to understand as "allow app to send you notifications" or "allow app to use your location". Maybe Apple could force apps to request for each specific use case why they wants to be active in the background. Is it to enable basic functionality of the app or is it to track you? Would be great if the user could choose in which case to allow access and in which case not. Right now it is a blank check you give to each app and it is hard to tell whether the app abuses its permissions or not.
afniljl 7y ago
This is gonna be a black egg on Tim Cook's face given how often they keep touting privacy of the iOS system.
thewileyone 7y ago
So the virgin queen turns out to be an anal whore ... This news disturbs if you believe in fairy tales.
- mirimir 7y ago
  I'm reminded of the rule of thumb "if someone assures you that they're honest, they are probably lying".
  - proxyswapi 7y ago
    So does this also applies to Apple with their promises around being honest about protecting user privacy?
mirimir 7y ago
OK from https://www.apple.com/privacy/ https://www.apple.com/privacy/ > At Apple, we believe privacy is a fundamental human right. > And so much of your personal information — information you have a right to keep private — lives on your Apple devices. > Your heart rate after a run. Which news stories you read first. Where you bought your last coffee. What websites you visit. Who you call, email, or message. > Every Apple product is designed from the ground up to protect that information. And to empower you to choose what you share and with whom. > We’ve proved time and again that great experiences don’t have to come at the expense of your privacy and security. Instead, they can support them. ... and ... > Your personal data belongs to you, not others. > Whether you’re taking a photo, asking Siri a question, or getting directions, you can do it knowing that Apple doesn’t gather your personal information to sell to advertisers or other organizations. So what? I guess that they didn't promise that apps would be doing all that bad stuff. Which is disgusting.
- ve55 7y ago
  What can one expect Apple to do, disallow apps that do extensive tracking, causing their users to not be able to use any social media whatsoever? They don't have any feasible option in that space. It is nice that they do something rather than nothing.
  - IloveHN84 7y ago
    It would me removing Facebook, Twitter, WhatsApp, Instagram, Google & co. From AppStore. Then you'll land in the same ecosystem of WindowsPhone, which was declared dead form those app makers.
    - mirimir 7y ago
      Not if Google did the same.
  - mirimir 7y ago
    I expect them to stop lying about protecting users' privacy.
mirimir 7y ago
Could someone please post an archive link?
ezequiel-garzon 7y ago
What is a legitimate use of background app refresh? I just turned it off expecting not to receive notifications, but that’s not the case.
- sosborn 7y ago
  The Major League Baseball app is a good example. It has a widget that can show scores. It can only do this if background refresh is on though so that it can keep the scores current when the app is not being actively used. For most apps and use cases, background refresh isn’t necessary because when you want see data in an app, you open the app and it can refresh it then. Personally, I have background refresh off for everything. It helps save battery too.
  - ezequiel-garzon 7y ago
    Thank you. I’m surprised it’s not off by default. It’s off now!
spupy 7y ago
So what's the news here? That apps are sending information to tracking services? How is this iPhone specific?
- baxtr 7y ago
  Well, to be fair, Apple is pushing privacy as differentiator quite hard. So, it is ok if they get scrutinized more for things that don’t run well on their platform. I just checked: ALL my iPhone apps have background sync on. For what?
- throwayEngineer 7y ago
  Apple claims to be pro privacy, it's one of their last differentiators. But if this falls, it's an overpriced cheap Android IMO
- ubermonkey 7y ago
  It isn't. It's a good article in the sense that it points out bad app behavior, but a bad one in that it suggests this is an iPhone problem, not a mobile problem.
HeraldEmbar 7y ago
Privacy is not gone. We could set up laws and enforce them. We already do this for medical data (HIPAA). There's no reason we can't do this for other categories of personal data, such as what you buy and where you go. Europe does this with its GDPR. It can be done, but we need a government that doesn't prioritize interests of corporation-people over those of human people.
- cerberusss 7y ago
  But isn't GDPR already here? And these apps are still tracking us with unbridled enthusiasm.
telaelit 7y ago
As an iOS developer, it’s insane to me that this isn’t common knowledge.
- throwayEngineer 7y ago
  Apple's propaganda factory gives the illusion of privacy. Also, sorry about having to do iOS dev, F
scoutt 7y ago
Is there any link to the actual research data, used methodology, etc., to support these claims? Not that I don't believe the claims (I'm biased to think that it may be possible), but just want to know if I can run the study myself, or be ran by someone more capable than me on security matters; sharing results. Or should I think this article was crafted for us to download just another app (Privacy Pro SmartVPN)?
GaurVimen 7y ago
And don’t forget, we pay Apple and Google for the privilege of being tracked and having our “data” shared. Smile: the surveillance is nearly complete!
Vizarddesky 7y ago
App companies claim that the "data it collects for clients is kept private and not sold" If you believe that, I can get you a great price for the scrap iron from the Eiffel Tower.
dsgarnier 7y ago
For the past month of so I’ve been trying to determine what’s been enabling my iPhones Bluetooth or WiFi function - something is intentionally doing this. For example, if I turn off WiFi or Bluetooth at bedtime I find it enabled in the morning! If I go somewhere the WiFi or Bluetooth may enable. WTF? (No I’m not having a senior moment here...) “What in my iOS environment has recent changed?” I deliberately don’t upgrade my iOS apps because of new or unusual improvements I discover. Or better yet what recent Apps have been asking for Bluetooth access? MyRadar and Walkmeter have requested access to Bluetooth “for location accuracy.” Really now? My walking location is going to improve their weather or my walking location? Or maybe I need to uninstall Washington Post or New York Times Apps to find the pattern here.

369 points by akeck 7y ago

This is a good piece in the sense that it will get Apple to do something I've wanted for a long time, which is to ban all the third party frameworks that developers are shipping in their apps. They should either provide their own first party frameworks or select a handful of vetted partners that are allowed to provide those services to developers.

la_barba 7y ago
A couple of points. How realistic is that though? How would they even know where the code came from in a compiled binary? Also, a platform vendor controlling what code I can or can't use sounds like a totalitarian regime to me. IMHO a better idea would be to create privacy jails for apps and then users can decide if they want to stick certain apps inside jails where they don't get access to your IP, GPS data, accelerometer, camera, contacts, etc. Jails would be better than the annoying popups for permissions as they currently do it.
- Despegar 7y ago
  >IMHO a better idea would be to create privacy jails for apps and then users can decide if they want to stick certain apps inside jails where they don't get access to your IP, GPS data, accelerometer, camera, contacts, etc. Jails would be better than the annoying popups for permissions as they currently do it. Nah that's a Do-Not-Track-esque cop out to preserve the ad and analytics industries. It's also extremely un-Apple. "Totalitarian" doesn't mean anything in this context because we're talking about computers and not governments. Privacy should be by default and not shift the burden to users or cost them in terms of user experience. Apple has the power to do that.
  - la_barba 7y ago
    Well, totalitarian in this context means shackling developers with micro-management of basic functions of software development. Apple has a large enough megaphone that I don't feel the need to care about whats best for them. They can do that themselves just fine. I'm only interested in it as a developer and as a user. As a developer I don't want an OS vendor telling me what code I write or which library I use. As a user, I want to be able to run an app inside a privacy jail that completely blocks access to my IP or GPS data - if I want to. >Privacy should be by default and not shift the burden to users or cost them in terms of user experience. Apple has the power to do that. You can have every single app run in a privacy jail by-default. Let the user opt-out on a per-app basis if they choose to. Apple could also simply just run a ad-blocker or a tracking scripts blocker as a system level feature. I admit that these kinds of measures are very 'controlling' if not totalitarian of their users. Should Microsoft allow users to install Chrome if the browser acts basically like a giant keylogger? Should we let users make the choice? Or let a benevolent dictator dictate what apps a user should be protected from. Reasonable people can come out of both sides of the privacy debate.
    - Despegar 7y ago
      >Well, totalitarian in this context means shackling developers with micro-management of basic functions of software development. This might be an interesting philosophical/religious debate about computers to some, but it's also one we had in 2008 when the App Store launched. It's clear after 11 years that Apple was right and the rest of the world simply does not share that religion. Conversely they sure do like the practical benefits from Apple's micromanagement. >You can have every single app run in a privacy jail by-default. Let the user opt-out on a per-app basis if they choose to. Apple could also simply just run a ad-blocker or a tracking scripts blocker as a system level feature. Apps already run in a sandbox and are private by default. The user has to give consent before an app gets location or contacts data. An ad blocker for apps is silly because it's an unnecessary hack when they control the App Store policies. The difference with giving permission to an app you downloaded is that you have a first party relationship with that app. You don't have a first party relationship with any of the SDKs that developers package into their app. They disclose it in their privacy policies that no one reads, but that's certainly not informed consent.
- panpanna 7y ago
  Not sure about iOS but on Android these types of countermeasures have been available for a few years. See for example Orlis, ART, xprivacy, libradar and AdDroid for some pointers. (TBH, this should not be needed in the first place if Google did their job)
  - la_barba 7y ago
    Yeah iOS doesn't allow those kinds of apps. That's one thing I'm jealous of from Android.
    - panpanna 7y ago
      Well, Android has both the most and the least secure phones out there :)
chillacy 7y ago
People are perfectly capable of writing their own first party analytics framework. Or at least the part that uploads the data.
deminature 7y ago
Banning third party tracking frameworks means banning Fabric, Facebook, Twitter and other major SDKs. I'm skeptical Apple would take such a drastic step. Taking on the responsibility of providing these functions through a first party API is also a massive undertaking, which I'm not sure Apple would agree to.
- munk-a 7y ago
  It would be absolutely beautiful if they did - they could even just cut some CDN network a check every month to host common assets in a privacy aware manner or do it themselves. It really wouldn't cost all that much. Web 4.0 integrated everywhere always-web is not at all consumer friendly - advertisers need to be downgraded to something that's suffered or rejected instead of supported.
munk-a 7y ago
I really doubt it will cause any sort of action, third party advertising is so deeply ingrained into iOS that there's some wonderfully terrible built in support - I remember helping to hook up an advertising ID share with a third party a bit ago in my employment history.
threeseed 7y ago
This makes no sense whatsoever. If you ban third parties framework then all that is going to happen is that those third party companies will just give you an API and standard schema and ask you to post the data to them. The value is in the dashboards not in the SDK. And then what you want Apple to block all HTTP POST requests too ?
untog 7y ago
I'm sorry, what? Ban all frameworks? That's absurd. How would they even know? You could just copy and paste the source code from a third-party framework into your own codebase.
- tinus_hn 7y ago
  It wasn’t enforceable but frameworks used to be banned on iOS. Note by the way that most third party frameworks of course don’t give you the source code.
beenBoutIT 7y ago
If Apple had a better app portfolio they could just get rid of third party apps entirely and have people use progressive web apps in place of app store apps. Right now most apps have websites that provide almost the exact same experience as the native app without as many privileges. Uber is a great example https://m.uber.com/looking https://m.uber.com/looking

deleted 7y ago

[deleted]

beenBoutIT 7y ago

'What happens on your iPhone stays on your iPhone'; everything except SMS, MMS, email, phone calls, video calls and web browsing. Makes more sense for a place like Las Vegas.

olliej 7y ago
uhhhh You mean everything that involves sending data to other people involves ... sending things to other people? Or do you propose the SMS, MMS, email, phone calls, video calls, and web browsing should not actually be available?
- beenBoutIT 7y ago
  Exactly, the primary purpose of the iPhone is to send things to other people.
  - zaphod4prez 7y ago
    ... people with to whom I choose to send things. I do not choose (or rather, I wish I could choose not to) send a ton of detailed information about my phone. my location, etc. to a bunch of unknown companies and people. I feel like I must be misunderstanding your point?
    - beenBoutIT 7y ago
      Metadata makes it an impossible wish. The act of sending or receiving anything provides companies the detailed information(phone, location, etc.) that you're trying to keep secret. Carriers like Verizon/AT&T/T-Mobile also sell users location data outright.
    - olliej 7y ago
      I think I'm misunderstanding your point. If you send a message to someone, or open a website, then necessarily you interact with a directory service (a telephone company, the message client's directory, DNS, etc). For iMessage, apple's servers then route the message to the appropriate account, and their various documentation on this says they don't record anything more than necessary (I assume each account has a glorified mailbox in which the encrypted messages are stored - there is no part of iMessage that can be decrypted by someone other than the recipient, except the destination - in an ideal world the sender would be stripped once its in the mailbox). If you load a webpage over https then no party in the middle knows what resources you pulled - alas they know the host because DNS queries aren't encrypted, and even if they were the IP addresses aren't, so with enough data it might be possible to infer destination for pages in hosting sites. None of these include your location information - beyond IP based inferences. The only people who have your location without explicitly asking is the carrier, and only because they can see you bouncing around towers

elagost 7y ago

Even for companies who are supposedly privacy-forward, their defaults say otherwise. A brand-new iPhone has all these privacy settings that are off by default, and that are usually confusingly labeled and buried several settings screens deep. Nobody really turns them on outside of a very small bubble. Once companies have your trust, they can't help but break it if it'll earn them another few bucks. Yelp's a household name and doesn't seem like a bad actor, but that's proven false by this article. Furthermore, while they claim to have your best interests in mind, Apple (and Google) let companies perform this kind of shady behavior on their platforms that they completely control. If they let others get away with this, can you really trust that the "don't upload my photos to your servers" switch really does what it says it does? How do you know your phone isn't recording audio and taking photos to send off to a datacenter in the middle of the night? (To be fair, a lot of this data that's being sent out probably has something to do with background services designed to make the experience better. Weather Channel might be gathering location in the background for more up-to-the-minute forecasts. For things like cloud storage services, scraping your camera roll and uploading the photos is probably something you ask them to do.)

djrogers 7y ago
Care to be more specific? Sharing of location, contacts, photos, calendars, access to your camera, etc are all disabled for 3rd party apps by default, and must be enabled individually for each app. What are all these privacy settings you are referring to that are off by default?
- elagost 7y ago
  From what I understand (haven't set up an iPhone from default in a long time) but the 'limit ad tracking' is off by default, allowing apps to have background app refresh privileges is allowed for any app by default (you must manually disable for any offenders unless you want it off for everything), the privacy features in Safari are off by default, and Apple's own data-collection and location-collection is also on by default.
  - fhood 7y ago

ppeetteerr 7y ago

I don't know if there is much of a solution aside from blocking the domains not owned by an app publisher or not approved by apple (an ad tracker list, for instance). The best way to avoid being tracked is to use apps that you pay for, not apps that are free and make money with your data. You can also bookmark websites to your home screen instead of downloading apps, that way you don't grant apps the extra privileges. Finally, you can disable background app refresh.

dhimes 7y ago
I'm not convinced that the ones you pay for aren't tracking you too. As a non-app example, I pay for the Washington Post and uBlock Origin shows that I'm still food for doubleclick et al- even when I'm logged in.
rampant_ai 7y ago
> The best way to avoid being tracked is to use apps that you pay for, not apps that are free and make money with your data. Nearly all apps, paid or not, use 3rd party analytics tools to improve their engagement. If the app requires sensitive data to function, like your contacts, it's also available to the analytics tool. Even the app's developer might not be aware of what the tools they're using are collecting.
- olliej 7y ago
  If the app developer is not aware of what the code they ship is collecting from their customers, the app developer should not be including that code. More over: why are you using an analytics system that involves sending your user's data to an arbitrary third party? Someone who is using your app has agreed to a relationship with you, not with facebook, or google, or what have you.
  - rampant_ai 7y ago
    > why are you using an analytics system that involves sending your user's data to an arbitrary third party Self-hosted analytics frameworks exist, but unfortunately aren't as popular because of the setup involved.

ksec 7y ago

I don't have a problem with Tracking when I am using the App. That is fair ( to a certain extent ) What really annoys me is Background App Refresh, how much data is being sent that is causing Battery Drain and Data Cost on Mobile? May be we should have Background Apps that only allow them to receive data? Or do we have to turn off Background App Refresh completely.

olliej 7y ago
I have a problem. Why should facebook or google know everything about every different app I use? If I have a bunch of apps all of which use facebook analytics then facebook knows the collection of apps I am using, and presumably my account information. That would also allow them to link those apps to my browsing if I ever use the web page version of those apps. An app - especially one I've paid for - has no justification for then providing my device and account information to an arbitrary third party, especially when many of them are well known as abusers of consumer privacy.
beenBoutIT 7y ago
If you're using Android the easiest way is to simply go into 'App info' and then hit 'Force stop'. That turns the app off entirely until the next time you actually use the app. Clicking the app's launcher normally starts the app back up.
meissler 7y ago
Especially when my wireless bill has a data limit. One month theScore app somehow used 5gb of background data.
sosborn 7y ago
My strategy is no background refresh and judicious application of “no cellular data” for each app.
WAHa_06x36 7y ago
All current popular protocols work by both sending and receiving data, even when you only want to receive data. So there is no reasonable way to have a receive-only mode.

amatecha 7y ago

Yeah, this is why I actually read the privacy policy on every app I install now. I've done this for the past 6mo or so. At this point I basically don't purchase apps that store any of my information on their servers (unless of course it's fundamentally required for the service, such as Spotify or the like).

prophesi 7y ago
I'm a bit confused. Shouldn't there be equal concern for apps that _share_ data with third-parties? The first-party app doesn't need to store any of the information in that case; they just hand it off in-transit. And have you had any luck with installing apps with such criteria? I'm on a similar boat, and primarily use F-Droid apps.
- amatecha 7y ago
  Oh, yeah of course sharing data with 3rd parties is even more "nope" than just storing it themselves. The last app I looked at to consider purchasing, "Clear Todos", which was highly-reputed at some point? Their Privacy Policy link in App Store actually hits a 404 error page. To say the least, I almost never purchase anything from App Store these days. It's a pretty dire landscape, but I'm tired of "being the product", and I am willing to give up a lot of stuff to lessen how often my information is used/stored/profited from.
throwawaymath 7y ago
What do you do about the mobile apps which don't store your data themselves, but share it with various third parties?
mirimir 7y ago
> unless of course it's fundamentally required for the service, such as Spotify or the like Spotify does not need to track what you listen to, in order to stream music to you!
- amatecha 7y ago

gok 7y ago

> there was some startling behavior by a household name: Yelp. It was receiving a message that included my IP address -- once every five minutes. A message that included your IP address? As in...any message sent over IP?

mixmastamyk 7y ago
In the header or in the payload? The second is not typical and a clue something fishy might be going on.
- threeseed 7y ago
  The second is incredibly common almost the default. Most libraries will just collect as much info as they are able to, put it in JSON and ship it to some server. That includes your IP address.
  - IggleSniggle 7y ago
    Can you provide a source for this? I haven’t noticed this happening, although I believe the information is available in aggregate data. Of course, I also use uBlock etc so quite possible I simply haven’t noticed the trend.
    - karambir 7y ago
      Can confirm companies do this. I have helped build custom analytics solutions for android and iOS where apps dump literally anything and everything they can get data of. Product Managers are so inclined to scrape everything. I was surprised few years back when we could get device battery stats, nearby wifi ssids and even connected audio output device, if any. Later moved on to other roles.
      - ryantgtg 7y ago
        As an example of how simple it is to get this info, check out the readme on this really popular React Native component: https://github.com/react-native-community/react-native-device-info https://github.com/react-native-community/react-native-devic... I’m not implying it’s a creepy component. This component captures some really useful information, depending on your needs. But yeah, simple stuff. And to back up an earlier comment in this thread, IP address is part of the user agent payload. That’s exceptionally common data to see, through browsers and apps. It doesn’t take a fancy library to capture that info. I really wanted to be alarmed by this article, but I left with more questions than answers. And I’m guessing Amplitude is bummed by this press. They actually responded to say they don’t share data with 3rd parties, yet their name is peppered throughout the article, with implications that they are sneaky and nefarious.

heywire 7y ago

I'll reproduce my comment [0] here from a similar article earlier this year [1]. Note: I ended up setting up that pi-hole, and I see it blocking a ton of DNS lookups for these types of companies across my family's devices. > I think many people would be surprised by the amount of analytics data leaving their phone _all the time_. I recently was doing some work where I had my iPhone proxied through mitmproxy on my laptop, and was blown away by just how much data was being sent. Some apps were sending a request to one or more analytics firms every single time I touched a UI control. I would set up a pi-hole and VPN to block this stuff, but I'm sure the app developers will just start tunneling the requests through their own hosts. Maybe some day one of these open source phones will actually be viable. [0] https://news.ycombinator.com/item?id=19109243 https://news.ycombinator.com/item?id=19109243 [1] https://news.ycombinator.com/item?id=19109027 https://news.ycombinator.com/item?id=19109027

StreamBright 7y ago
Same here, I also started to work on a project to consolidate pi-hole into a single binary using Rust. I want to run it on my laptop and on my routers at home as well.
- SOLAR_FIELDS 7y ago
  Can you go into a little bit more detail about the reasoning behind this? I’m running a Pi-hole on raspberry pi as the single DNS server behind my whole home’s router. This means it blocks everything outbound in my house. Only thing it doesn’t block is when I’m on LTE/random WiFi access points, for which I’m considering routing all of my mobile devices via VPN through another instance of Pi-hole running on a digital ocean droplet. Beyond that what do running multiple instances of pi-hole do? Do you have multiple routers at home?
  - StreamBright 7y ago
    I travel a lot. I want to run something on my laptop so I do not need to VPN yet I have no ads.

pandemicsyn 7y ago

Kind of amusing reading this article on page that ublock origin reported as loading 38 trackers. Wonder what trackers the washingtonpost ios app itself uses.

andrei_says_ 7y ago
This comes up regularly in privacy discussions linking to articles in mainstream online publications. The editors and the writers of the articles are completely divorced from the decisions driving the technology and profitability of the publisher. It may be possible for writers to only publish articles in outlets which respect privacy at the expense of popularity but we're probably not hearing about those.
- nothrabannosir 7y ago
  Fair, but as long as nothing changes, let us not stop pointing out the irony merely because things remain crooked. The buck has to stop somewhere, and at the end of the day wapo is profiting from tracking on an article bemoaning tracking. They're free to do so, and being hypocrites doesn't make them wrong, but being not wrong also doesn't make them infallible. And if someone finally founds a privacy respecting publisher, what better place for them to advertise than a comment lamenting a competitor's failing? Let's keep that door open :)
  - andrei_says_ 7y ago
    I’m wondering if a writer could get away with pointing this irony in their article. Could be a powerful gesture acknowledging the status quo and their own position.
  - briandear 7y ago
    Interestingly, Apple News does respect privacy. The privacy approaches of Siri, Apple News, Apple Music, etc. ought not be overlooked.
  - dhimes 7y ago
    To your point, as I said in a thread yesterday, I get these trackers and I'm logged in to WaPo. I pay them $100/year and they still track me. How can we make them stop? It's going to take our legislature, because this free market thing isn't going to do it.

lalos 7y ago

Anybody know of an easy way to block all Facebook SDK usage from iOS? The simplest that comes to mind would be through a custom DNS server, but even if you don't log in using FB SDK on apps they still ping back in someway or another to generate your shadow profile.

DavideNL 7y ago
I hate that Apple's walled garden forbids us to use a proper firewall on iOS... Anyways, a not so easy alternative is to install a Vpn Server like Algo and block all Facebook ips with ipset on the Vpn server. You can obtain all Facebook ips from their ASN number: whois -h whois.radb.net '!gAS32934' | tr ' ' '\n' | awk '!/[[:alpha:]]/' > facebookips.txt https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...
- tareqak 7y ago
  Thanks a lot for this command. Maybe I can use it blackhole all of that using my pi-hole server at home since I don't use any products or services from Facebook or its subsidiaries.
- WAHa_06x36 7y ago
  You may hate that you can't do that, but do you really hate that scam companies can't install their own spying firewalls? Because they would. A lot.
nvr219 7y ago
At home I block all Facebook with pihole. Not 100% protection but it’s a start.

jammygit 7y ago

I used to run disconnect pro on my s8, which I believe is the app mentioned in this article. I recall that it tried to send a message to google play services every 2 minutes 24/7, no matter what. It creeped me out, so I’ve switched to an iPhone recently. Aside: I hope the librem does well it’s first release

amelius 7y ago

This makes me wonder, what is the difference between apps and websites, really?

saagarjha 7y ago
Apps are harder to tweak to where they don’t track you.

cfarm 7y ago

For the desktop web Duckduckgo has a plugin that shows you all the trackers that are on a webpage and lets you block them. They also have a mobile web app that you can use as your default web search on mobile. https://duckduckgo.com/app https://duckduckgo.com/app

layoutIfNeeded 7y ago

Please Apple do something about this, so I can stop sabotaging my career as an iOS developer by regularly arguing against tracking to my superiors.

_bxg1 7y ago

Wow. I'd diligently turned off background location for virtually everything, but I had no idea so many apps did background refresh by default. Your IP address is nearly as good as your GPS coordinates. (Edit: Maybe one's IP address on a cellular connection doesn't matter as much as I thought. I just did a check and it didn't even get my city correct.) Possibly the most surprising thing is that, unlike all other permissions, iOS didn't ask me directly before enabling background refresh. That's disturbing. Also, while I sympathized with Apple outsourcing Maps' business info to Yelp, they really should hold their partners to a much higher standard given all of their privacy rhetoric.

tictok4 7y ago
> I'd diligently turned off background location for virtually everything First thing I did with my wife's Iphone. I imagine that with that disabled and permissions set correctly , an iphone leaks less than an android.
- ubermonkey 7y ago
  My understanding is that this is correct.
florakel 7y ago
For every app that I install I check if the app activated background app refresh. Most of the time it does not make any sense why an app would even need that, other than tracking me. Also disabling it for most apps is one of the best things you can do to extend your battery life. In Apple's defense it is a hard thing to ask the user whether or not they want to permit "background app refresh". Many users might not understand at all what this means. It is not as easy to understand as "allow app to send you notifications" or "allow app to use your location". Maybe Apple could force apps to request for each specific use case why they wants to be active in the background. Is it to enable basic functionality of the app or is it to track you? Would be great if the user could choose in which case to allow access and in which case not. Right now it is a blank check you give to each app and it is hard to tell whether the app abuses its permissions or not.

afniljl 7y ago

This is gonna be a black egg on Tim Cook's face given how often they keep touting privacy of the iOS system.

thewileyone 7y ago

So the virgin queen turns out to be an anal whore ... This news disturbs if you believe in fairy tales.

mirimir 7y ago
I'm reminded of the rule of thumb "if someone assures you that they're honest, they are probably lying".
- proxyswapi 7y ago
  So does this also applies to Apple with their promises around being honest about protecting user privacy?

mirimir 7y ago

OK from https://www.apple.com/privacy/ https://www.apple.com/privacy/ > At Apple, we believe privacy is a fundamental human right. > And so much of your personal information — information you have a right to keep private — lives on your Apple devices. > Your heart rate after a run. Which news stories you read first. Where you bought your last coffee. What websites you visit. Who you call, email, or message. > Every Apple product is designed from the ground up to protect that information. And to empower you to choose what you share and with whom. > We’ve proved time and again that great experiences don’t have to come at the expense of your privacy and security. Instead, they can support them. ... and ... > Your personal data belongs to you, not others. > Whether you’re taking a photo, asking Siri a question, or getting directions, you can do it knowing that Apple doesn’t gather your personal information to sell to advertisers or other organizations. So what? I guess that they didn't promise that apps would be doing all that bad stuff. Which is disgusting.

ve55 7y ago
What can one expect Apple to do, disallow apps that do extensive tracking, causing their users to not be able to use any social media whatsoever? They don't have any feasible option in that space. It is nice that they do something rather than nothing.
- IloveHN84 7y ago
  It would me removing Facebook, Twitter, WhatsApp, Instagram, Google & co. From AppStore. Then you'll land in the same ecosystem of WindowsPhone, which was declared dead form those app makers.
  - mirimir 7y ago
    Not if Google did the same.
- mirimir 7y ago
  I expect them to stop lying about protecting users' privacy.

mirimir 7y ago

Could someone please post an archive link?

ezequiel-garzon 7y ago

What is a legitimate use of background app refresh? I just turned it off expecting not to receive notifications, but that’s not the case.

sosborn 7y ago
The Major League Baseball app is a good example. It has a widget that can show scores. It can only do this if background refresh is on though so that it can keep the scores current when the app is not being actively used. For most apps and use cases, background refresh isn’t necessary because when you want see data in an app, you open the app and it can refresh it then. Personally, I have background refresh off for everything. It helps save battery too.
- ezequiel-garzon 7y ago
  Thank you. I’m surprised it’s not off by default. It’s off now!

spupy 7y ago

So what's the news here? That apps are sending information to tracking services? How is this iPhone specific?

baxtr 7y ago
Well, to be fair, Apple is pushing privacy as differentiator quite hard. So, it is ok if they get scrutinized more for things that don’t run well on their platform. I just checked: ALL my iPhone apps have background sync on. For what?
throwayEngineer 7y ago
Apple claims to be pro privacy, it's one of their last differentiators. But if this falls, it's an overpriced cheap Android IMO
ubermonkey 7y ago
It isn't. It's a good article in the sense that it points out bad app behavior, but a bad one in that it suggests this is an iPhone problem, not a mobile problem.

HeraldEmbar 7y ago

Privacy is not gone. We could set up laws and enforce them. We already do this for medical data (HIPAA). There's no reason we can't do this for other categories of personal data, such as what you buy and where you go. Europe does this with its GDPR. It can be done, but we need a government that doesn't prioritize interests of corporation-people over those of human people.

cerberusss 7y ago
But isn't GDPR already here? And these apps are still tracking us with unbridled enthusiasm.

telaelit 7y ago

As an iOS developer, it’s insane to me that this isn’t common knowledge.

throwayEngineer 7y ago
Apple's propaganda factory gives the illusion of privacy. Also, sorry about having to do iOS dev, F

scoutt 7y ago

Is there any link to the actual research data, used methodology, etc., to support these claims? Not that I don't believe the claims (I'm biased to think that it may be possible), but just want to know if I can run the study myself, or be ran by someone more capable than me on security matters; sharing results. Or should I think this article was crafted for us to download just another app (Privacy Pro SmartVPN)?

GaurVimen 7y ago

And don’t forget, we pay Apple and Google for the privilege of being tracked and having our “data” shared. Smile: the surveillance is nearly complete!

Vizarddesky 7y ago

App companies claim that the "data it collects for clients is kept private and not sold" If you believe that, I can get you a great price for the scrap iron from the Eiffel Tower.

dsgarnier 7y ago

For the past month of so I’ve been trying to determine what’s been enabling my iPhones Bluetooth or WiFi function - something is intentionally doing this. For example, if I turn off WiFi or Bluetooth at bedtime I find it enabled in the morning! If I go somewhere the WiFi or Bluetooth may enable. WTF? (No I’m not having a senior moment here...) “What in my iOS environment has recent changed?” I deliberately don’t upgrade my iOS apps because of new or unusual improvements I discover. Or better yet what recent Apps have been asking for Bluetooth access? MyRadar and Walkmeter have requested access to Bluetooth “for location accuracy.” Really now? My walking location is going to improve their weather or my walking location? Or maybe I need to uninstall Washington Post or New York Times Apps to find the pattern here.