8 ms·

Smartphones and the location data marketplace

112 points by edward 7y ago

deleted 7y ago
[deleted]
wizzwizz4 7y ago
This is a good explanation suitable for the layperson. Though there are a few confusing bits, like: > And every app is potentially leaking data to five or 10 other apps. it's overall absolutely very good, relatively excellent.
iwantagrinder 7y ago
If you're reading this and work in a role that helps companies turn profit from these practices, fuck you.
- kjhrwerklj 7y ago
  If you invest in these companies, fuck you. Edit: thanks for the flagging, I was just testing the theory that you can say "fuck you" to the engineers who work on this, as OP did, but not to the investors who put money in and incentives it. Thanks for proving me correct.
- dang 7y ago
  Please don't post unsubstantive comments here. We want curious conversation, not denunciatory rhetoric, and the latter destroys the former. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
dantheman 7y ago
I don't understand why this reporting doesn't include the phone companies? They have far more data.
- jmccorm 7y ago
  Much of the public's understanding of cell phone tracking has centered around the cell provider, the telephone network, and big players like Facebook and Google. They're missing a big piece. The NYT is shedding light on this missing piece. This article puts the spotlight on yet another group of companies and another tracking mechanism. These companies are small, virtually unknown to the public, and they're providing SDKs which others are building real and useful mobile apps upon. One example given was an otherwise legitimate weather app which pulls your location to provide local weather data. You grant the app access to your location information because it has a reason to have it, and it does something useful with the data. The article introduces the public to what you probably already knew. Those SDKs can (and do) ingest that same location data for their own purposes. In the article, they find that the SDK provides your fine location data to a location services company (Cuebiq) for a total of twenty times over the course of an eight minute walk. Most users have no idea this is going on behind the scenes. They just see the weather app. The article isn't attempting to dismiss other forms of tracking. It is trying to better introduce a new form of tracking that most people poorly understand, if at all.
amelius 7y ago
We need to legally ban online targeted advertising, as it causes far more problems than it solves. I'm sure the internet will do fine with a less intrusive monetization scheme.
- dantheman 7y ago
  What harm?
  - doyoureallytnot 7y ago
    The collection, purchase, sale, and distribution of sensitive user information without the users consent.
    - dantheman 7y ago
      If it had a bigger clearer warning - like the cookie banner, then there'd be no harm?
  - LaundroMat 7y ago
    Of the top of my head: * Journalism no longer prioritizing truth, but eyeballs/clicks. * Immense user frustration * Waste of bandwidth (energy costs, etc) I bet there are many more.
    - dantheman 7y ago
      Even without targeted advertising journalism would still use advertising, they'd just make way less money.
      - newnewpdro 7y ago
        I agree with your first part, but the second part isn't true if it were prohibited to do targeted advertising for everyone. It's an arms race, you only earn less without targeting when your competitors are targeting. When all advertising is equally poorly targeted, everyone's getting their fair share of the available advertising dollars.
tcd 7y ago
The irony as this page blocks many attempts to send my information to known data rapers. You're part of the problem nytimes, how about you start setting the gold standard and show the world you're better than others? Oh wait, that data is too valuable to your business isn't it? Can't wait to hear their so called "solutions".
- dewey 7y ago
  At least in this case they mention that explicitly at the end of the article: "Like other media companies, The Times collects data on its visitors when they read stories like this one. For more detail please see our privacy policy and our publisher's description of The Times's practices and continued steps to increase transparency and protections."
rolph 7y ago
we need to create an app development regime that does not "trojanize" apps or pirate any derivative data. In my eyes the mobile industry as a whole has voluntarily succumbed to a supply chain attack
javajosh 7y ago
Yeah, apps are bad, but what concerns me (well, scares me to my bones, actually) is the prospect of malware below the app level. The operating system, drivers, and hardware are all ripe for abuse at an unimaginable scale. The "baseband" blob in particular seems like a holy grail of invasive surveillance. And, theoretically, there's a huge opportunity for the manufacturer of the PCB and every chip on it, to add what is logically a blob - a region of the chip that is mostly dormant, but reacts to some signal and come's alive. And we cannot verify that these features don't exist because they are too small! I mean, if I was China I'd be actively pursuing inserting this kind of trojan horse in everything. Yeah, you'd only get to use it once at scale, but that's all it would take. And you'd probably get away with targeted use for a long time before anyone discovered it. This, that is, national security, is the best reason to pass "right to repair" laws, and build out replacement hardware and software options that are verifiably open. Heck, if I was with NSA I'd be pushing hard to fund that kind of work with NSA money.
- amelius 7y ago
  > Heck, if I was with NSA I'd be pushing hard to fund that kind of work with NSA money. But what if the NSA had their own backdoors installed in hardware made by US firms?
  - javajosh 7y ago
    AFAIK very few PCB- or chip-level electronics are made in the USA. And this kind of insertion would best be done at the last possible moment, at the factory. So if you don't have the physical factories, you don't get this opportunity. No doubt the NSA (or any national intelligence agency) would want this, but you can't have it unless you have the physical fabs. So, being practical engineers, if I was the NSA I'd make deals with telecom's to 'assist' with writing the baseband. But the irony is that the device manufacturer could easily disable this backdoor in favor of their own. Oops! :)
    - amelius 7y ago
      > But the irony is that the device manufacturer could easily disable this backdoor in favor of their own. I'm not sure it works that way. Perhaps the NSA could force certain US companies to specifically design and install backdoors, and require these backdoors to be always active. (One of my possibly ungrounded/paranoid fears is that they do this with Intel ME).
dang 7y ago
Related recent thread: https://news.ycombinator.com/item?id=21833718 https://news.ycombinator.com/item?id=21833718 Since the article title is baity, we changed it in accordance with the HN guidelines (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). If anyone suggests a better title, we can change it again.
- pdkl95 7y ago
  I think the article's original title should stand. While some people might consider it "baity", I would describe "Smartphones Are Spies" as an accurate description of reality and the content of the article. The article is making an a public accusation: a lot of spying is happening, and they are naming some of the (in their opinion) responsible parties. Changing that to a title that only indicates the general subject of the discussion ("location data marketplace") obscures the article's thesis: "Your smartphone is probably sending your precise location to companies right now." (which is just a more detailed way of saying "smartphones are spies") [regardless, it's your house, use whatever titles you want]
  - dang 7y ago
    As I said, I'm happy to change it to something better if anyone suggests it, but "Smartphones are spies" is obviously sensational and this thread is already filling up with low-quality comments. The definition of a better title on HN, btw, is: more accurate and neutral, and preferably using representative language from the article.
- kjhrwerklj 7y ago
  What exactly of "Smartphones Are Spies. Here’s Whom They Report To." is clickbait? Nice way to deflect blame, just how many location tracking companies is YC invested in?
  - dang 7y ago
    Sensational words like "spies" in titles trigger poorer-quality discussion. Taking those out is routine HN moderation. When we change a title for that reason, we always try to replace it with representative language from the article itself. "Deflecting blame" doesn't enter into it (what does that even mean in this case?) and the answer to your cheap shot about YC is zero, as far as I know. HN is a leading place for discussing privacy and surveillance; it has been for years; this article is obviously on topic here. We just want to avoid shitty internet threads. This one is already filling with "fuck you", "data rapers", and other pearls.
kjhrwerklj 7y ago
Wow, the flagging is strong with this article. Prediction: the whole article will be flagged soon. Too much heat on VCs.
- dang 7y ago
  This article isn't being flagged. This and related topics are perennially popular on HN. Some comments have been flagged, correctly, because they break the site guidelines. Would you please stop it with the trollish comments now? You've already posted five to this thread. That's over the top.
chiefalchemist 7y ago
The book Dragnet Nation, from ~5 yrs ag, did a great job (then) on this subject. That along with Chaos Monkeys help escalate my fear and paranoia. Anyone I engage on the subject? They're oblivious. https://www.amazon.com/Dragnet-Nation-Security-Relentless-Surveillance/dp/B01LTHXKEU https://www.amazon.com/Dragnet-Nation-Security-Relentless-Su...
8bitsrule 7y ago
Good job. That 'location pings' animation looks chilling. Very appropriate.

112 points by edward 7y ago

deleted 7y ago

[deleted]

This is a good explanation suitable for the layperson. Though there are a few confusing bits, like: > And every app is potentially leaking data to five or 10 other apps. it's overall absolutely very good, relatively excellent.

iwantagrinder 7y ago

If you're reading this and work in a role that helps companies turn profit from these practices, fuck you.

kjhrwerklj 7y ago
If you invest in these companies, fuck you. Edit: thanks for the flagging, I was just testing the theory that you can say "fuck you" to the engineers who work on this, as OP did, but not to the investors who put money in and incentives it. Thanks for proving me correct.
dang 7y ago
Please don't post unsubstantive comments here. We want curious conversation, not denunciatory rhetoric, and the latter destroys the former. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

dantheman 7y ago

I don't understand why this reporting doesn't include the phone companies? They have far more data.

jmccorm 7y ago
Much of the public's understanding of cell phone tracking has centered around the cell provider, the telephone network, and big players like Facebook and Google. They're missing a big piece. The NYT is shedding light on this missing piece. This article puts the spotlight on yet another group of companies and another tracking mechanism. These companies are small, virtually unknown to the public, and they're providing SDKs which others are building real and useful mobile apps upon. One example given was an otherwise legitimate weather app which pulls your location to provide local weather data. You grant the app access to your location information because it has a reason to have it, and it does something useful with the data. The article introduces the public to what you probably already knew. Those SDKs can (and do) ingest that same location data for their own purposes. In the article, they find that the SDK provides your fine location data to a location services company (Cuebiq) for a total of twenty times over the course of an eight minute walk. Most users have no idea this is going on behind the scenes. They just see the weather app. The article isn't attempting to dismiss other forms of tracking. It is trying to better introduce a new form of tracking that most people poorly understand, if at all.

amelius 7y ago

We need to legally ban online targeted advertising, as it causes far more problems than it solves. I'm sure the internet will do fine with a less intrusive monetization scheme.

dantheman 7y ago
What harm?
- doyoureallytnot 7y ago
  The collection, purchase, sale, and distribution of sensitive user information without the users consent.
  - dantheman 7y ago
    If it had a bigger clearer warning - like the cookie banner, then there'd be no harm?
- LaundroMat 7y ago
  Of the top of my head: * Journalism no longer prioritizing truth, but eyeballs/clicks. * Immense user frustration * Waste of bandwidth (energy costs, etc) I bet there are many more.
  - dantheman 7y ago
    Even without targeted advertising journalism would still use advertising, they'd just make way less money.
    - newnewpdro 7y ago
      I agree with your first part, but the second part isn't true if it were prohibited to do targeted advertising for everyone. It's an arms race, you only earn less without targeting when your competitors are targeting. When all advertising is equally poorly targeted, everyone's getting their fair share of the available advertising dollars.

tcd 7y ago

The irony as this page blocks many attempts to send my information to known data rapers. You're part of the problem nytimes, how about you start setting the gold standard and show the world you're better than others? Oh wait, that data is too valuable to your business isn't it? Can't wait to hear their so called "solutions".

dewey 7y ago
At least in this case they mention that explicitly at the end of the article: "Like other media companies, The Times collects data on its visitors when they read stories like this one. For more detail please see our privacy policy and our publisher's description of The Times's practices and continued steps to increase transparency and protections."

rolph 7y ago

we need to create an app development regime that does not "trojanize" apps or pirate any derivative data. In my eyes the mobile industry as a whole has voluntarily succumbed to a supply chain attack

javajosh 7y ago

Yeah, apps are bad, but what concerns me (well, scares me to my bones, actually) is the prospect of malware below the app level. The operating system, drivers, and hardware are all ripe for abuse at an unimaginable scale. The "baseband" blob in particular seems like a holy grail of invasive surveillance. And, theoretically, there's a huge opportunity for the manufacturer of the PCB and every chip on it, to add what is logically a blob - a region of the chip that is mostly dormant, but reacts to some signal and come's alive. And we cannot verify that these features don't exist because they are too small! I mean, if I was China I'd be actively pursuing inserting this kind of trojan horse in everything. Yeah, you'd only get to use it once at scale, but that's all it would take. And you'd probably get away with targeted use for a long time before anyone discovered it. This, that is, national security, is the best reason to pass "right to repair" laws, and build out replacement hardware and software options that are verifiably open. Heck, if I was with NSA I'd be pushing hard to fund that kind of work with NSA money.

amelius 7y ago
> Heck, if I was with NSA I'd be pushing hard to fund that kind of work with NSA money. But what if the NSA had their own backdoors installed in hardware made by US firms?
- javajosh 7y ago
  AFAIK very few PCB- or chip-level electronics are made in the USA. And this kind of insertion would best be done at the last possible moment, at the factory. So if you don't have the physical factories, you don't get this opportunity. No doubt the NSA (or any national intelligence agency) would want this, but you can't have it unless you have the physical fabs. So, being practical engineers, if I was the NSA I'd make deals with telecom's to 'assist' with writing the baseband. But the irony is that the device manufacturer could easily disable this backdoor in favor of their own. Oops! :)
  - amelius 7y ago
    > But the irony is that the device manufacturer could easily disable this backdoor in favor of their own. I'm not sure it works that way. Perhaps the NSA could force certain US companies to specifically design and install backdoors, and require these backdoors to be always active. (One of my possibly ungrounded/paranoid fears is that they do this with Intel ME).

dang 7y ago

Related recent thread: https://news.ycombinator.com/item?id=21833718 https://news.ycombinator.com/item?id=21833718 Since the article title is baity, we changed it in accordance with the HN guidelines (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). If anyone suggests a better title, we can change it again.

pdkl95 7y ago
I think the article's original title should stand. While some people might consider it "baity", I would describe "Smartphones Are Spies" as an accurate description of reality and the content of the article. The article is making an a public accusation: a lot of spying is happening, and they are naming some of the (in their opinion) responsible parties. Changing that to a title that only indicates the general subject of the discussion ("location data marketplace") obscures the article's thesis: "Your smartphone is probably sending your precise location to companies right now." (which is just a more detailed way of saying "smartphones are spies") [regardless, it's your house, use whatever titles you want]
- dang 7y ago
  As I said, I'm happy to change it to something better if anyone suggests it, but "Smartphones are spies" is obviously sensational and this thread is already filling up with low-quality comments. The definition of a better title on HN, btw, is: more accurate and neutral, and preferably using representative language from the article.
kjhrwerklj 7y ago
What exactly of "Smartphones Are Spies. Here’s Whom They Report To." is clickbait? Nice way to deflect blame, just how many location tracking companies is YC invested in?
- dang 7y ago
  Sensational words like "spies" in titles trigger poorer-quality discussion. Taking those out is routine HN moderation. When we change a title for that reason, we always try to replace it with representative language from the article itself. "Deflecting blame" doesn't enter into it (what does that even mean in this case?) and the answer to your cheap shot about YC is zero, as far as I know. HN is a leading place for discussing privacy and surveillance; it has been for years; this article is obviously on topic here. We just want to avoid shitty internet threads. This one is already filling with "fuck you", "data rapers", and other pearls.

kjhrwerklj 7y ago

Wow, the flagging is strong with this article. Prediction: the whole article will be flagged soon. Too much heat on VCs.

dang 7y ago
This article isn't being flagged. This and related topics are perennially popular on HN. Some comments have been flagged, correctly, because they break the site guidelines. Would you please stop it with the trollish comments now? You've already posted five to this thread. That's over the top.

chiefalchemist 7y ago

The book Dragnet Nation, from ~5 yrs ag, did a great job (then) on this subject. That along with Chaos Monkeys help escalate my fear and paranoia. Anyone I engage on the subject? They're oblivious. https://www.amazon.com/Dragnet-Nation-Security-Relentless-Surveillance/dp/B01LTHXKEU https://www.amazon.com/Dragnet-Nation-Security-Relentless-Su...

8bitsrule 7y ago

Good job. That 'location pings' animation looks chilling. Very appropriate.