12 ms·
Sensor Tower owns ad blocker and VPN apps that collect user data
- chimen 7y agoMost of them are using your connection to sell access to residential proxies: oxylabs (NordVPN), luminati (Holla) etc.
- altdatathrow 7y agoThey do far more than simply install backdoors for residential proxy networks. They also capture and resell your entire http(s) request history via their mitm. That's every single HTTP request every single app on your phone makes. It's a gold mine of information. They also sell profiles of exactly which apps you have installed on your phone, how often you're using each, and geolocation data if they get that permission. Avast recently shutdown their subsidiary Jumpshot [1] who was doing similar. They were intercepting desktop traffic through their anti-virus software and browser plugins, and then selling your complete browsing history on a per-user (don't worry it was "anonymized" /s) to anyone willing to pay. Mostly to corporations, marketing platforms, and hedge funds. Sensor Tower is doing the precisely the same thing for the same audience. [1] https://www.vice.com/en_us/article/wxejbb/avast-antivirus-is-shutting-down-jumpshot-data-collection-arm-effective-immediately https://www.vice.com/en_us/article/wxejbb/avast-antivirus-is...
- TedDoesntTalk 7y agoGood related article, in case anyone still thinks well of NordVPN: https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 https://medium.com/@derek./how-is-nordvpn-unblocking-disney-...
- Dylan16807 7y agoThat article isn't good at all. It jumps to conclusions that are not at all justified.
- lonelappde 7y agoHow about this? https://medium.com/@xianghangmi/resident-evil-understanding-residential-ip-proxy-as-a-dark-service-dea9010a0e29 https://medium.com/@xianghangmi/resident-evil-understanding-...
- Dylan16807 7y ago> oxylabs (NordVPN), luminati (Holla) Wow that's misleading. Oxylabs and Luminati are both residential proxy networks. Hola is a VPN that sells access to Luminati. NordVPN is a VPN that does not sell access to anyone. It is not sending anyone else's data through your connection. There's an accusation that it shares ownership with Oxylabs, and that's about it. NordVPN might be buying, not selling, residential proxy access from someone, but it's very unclear if that's true and either way doesn't have a negative impact on their customers.
- lonelappde 7y agoOh Nord's not bad because pay other people to break into other people's computers but but respect their own customers' privacy? https://medium.com/@xianghangmi/resident-evil-understanding-residential-ip-proxy-as-a-dark-service-dea9010a0e29 https://medium.com/@xianghangmi/resident-evil-understanding-...
- Dylan16807 7y agoAssuming they do so, the comment I replied to is still extremely misleading. But do you have any actual evidence they do so? Having some IPs that show up as residential isn't good enough. That article doesn't call out any specific VPNs.
- 01CGAT 7y agoA snippet from the article on the residential IP's: "Furthermore, we conducted realtime device fingerprinting when we captured each IP address. And we have successfully identified the device type and vendor information for 547,497 IP addresses. What surprised us is that 237,029 of them turned out to be IoT systems, such as web camera, DVR, and printer."
- chimen 7y agoVery misleading yes: https://luminati.io/static/patent/2019-12-31_NordVPN_Complaint.pdf?md5=910323-d3e66363 https://luminati.io/static/patent/2019-12-31_NordVPN_Complai...
- matheusmoreira 7y agoProprietary ad blockers cannot be trusted. It is better to use something like AdAway and Firefox with uBlock Origin.
- chimen 7y agoEven that setup fails: https://blog.dnsadblock.com/you-are-still-being-tracked-even-with-ad-blockers-installed/ https://blog.dnsadblock.com/you-are-still-being-tracked-even...
- mrob 7y agoAlready fixed in uBlock Origin: https://github.com/gorhill/uBlock/releases/tag/1.25.0 https://github.com/gorhill/uBlock/releases/tag/1.25.0
- GoblinSlayer 7y agoLooks like sites use first party trackers too for some reason, see the pixel at the end of another posted article: https://www.the-tls.co.uk/articles/the-opt-out-illusion/ https://www.the-tls.co.uk/articles/the-opt-out-illusion/ (it's fully packed with trackers though).
- nabeelms 7y agoThat issue was fixed in the latest release of uBlock Origin. That's why it required the additional permissions for DNS.
- jsjddbbwj 7y agoAnd what's good for iOS? I've tried Firefox Focus, but you can't customise what lists it uses, and the lists it comes with are not that good.
- 01CGAT 7y agoFor WifiMask VPN I use the following to block ads & malware: https://github.com/Trellmor/bind-adblock https://github.com/Trellmor/bind-adblock
- saagarjha 7y ago> Armando Orozco, an Android analyst for Malwarebytes, said giving root privileges to an app exposes a user to significant risk. Root certificate ≠ root privileges
- userbinator 7y agoThis is basically a MITM proxy, which I'd say is really essential for true adblocking and content filtering, especially on the locked-down mobile platforms and with the rise of HTTPS. The question is then who runs the proxy and whether you trust them. I've been doing the same with Proxomitron for years, although in that case I run the proxy, I certainly trust myself, and --- I'm not sure about whether these apps even have such a feature --- I can modify how/what it filters/blocks at any time.
- saagarjha 7y agoIt should be entirely possible to run the MITM proxy completely on-device, in which case you don't need to trust anything.
- judge2020 7y agoThis is generally possible (With how Wireguard-based VPNs currently work) but Apple would much rather you use the Safari content blocker API for defining rules.
- 3fe9a03ccd14ca5 7y agoI can never trust anything downloaded from the App Store to MITM my traffic, so I’ll take the safari content blocker.
- cortesoft 7y agoHow do you block the app from phoning home with the data? You have to trust it not to do that.
- rubyn00bie 7y agoThis is literally, one among many reasons (ha!), why I use Firefox. Every other browser vendor is a for-profit entity, and as such will limit good ad-blocking measures as Safari and Chrome have done recently with their new "security" policies. This is also why I don't use a VPN I don't run (or certainly not one that hasn't been audited with a good reputation), and I certainly would never fucking dream of using a free VPN unless all the traffic over it is absolutely worthless. ... How many of these things install root certs where even after you've canceled your subscription you're still accepting their bullshit? On the other hand, this could make for a hilarious experiment using adversarial neural networks to troll the assholes mining data from the VPNs.
- lstamour 7y ago> ... How many of these things install root certs where even after you've canceled your subscription you're still accepting their bullshit? It does seem like a bit of a flaw that removing the app on iOS doesn't automatically remove the profile such apps install: https://support.apple.com/en-au/HT205347 https://support.apple.com/en-au/HT205347 I'm pretty sure Apple will remove the VPN profile, which is why leaving a root certificate seems dangerous for users who don't know what they're for. There can, of course, be legitimate uses for this tech. https://www.charlesproxy.com/documentation/ios/ https://www.charlesproxy.com/documentation/ios/ or maybe opting out of certificate transparency reports, but they do seem like edge cases.
- dwaite 7y ago> It does seem like a bit of a flaw that removing the app on iOS doesn't automatically remove the profile such apps install AFAIK only system apps can install profiles. These apps work by getting the user to install a separate profile via Safari. > I'm pretty sure Apple will remove the VPN profile, which is why leaving a root certificate seems dangerous for users who don't know what they're for. If these aren't enterprise profiles then Apple may not have an easy mechanism to block them (other than blocking their semantics). Apple has a ton of variants of profiles, I keep expecting them to deprecate swaths of types/installation methods to help this be more understandable.
- risyachka 7y agoSensor tower is a mobile intelligence tool. Correct me if I am missing something, but what is a big deal here? And when you use free apps, obviously they sell your data (or with a high chance), they are not charities. But in return, you get hassle-free ad-blocking or VPN. It looks like a fair deal to me. Or you can find a good one that will be expensive, or do it yourself (paying the same or more, just with your time). And there is a huge difference between what they can do and what they actually do. In coffee shops and other places, surveillance systems can be used to steal your passwords and logins etc. But I strongly suspect each and everyone has entered their personal details while been recorded bt the surveillance system for many times. Or just in public place where someone can see, etc.
- deleted 7y ago[deleted]
- Krasnol 7y agoHow about the huge difference of knowing that you give away your data and not knowing? There is nothing "fair" about it and just the fact that they are now gone from the stores should...I don't know...maybe make you think about that a bit? PS: just because there are worse situations, doesn't make this a good one.
- risyachka 7y agoI meant general practice done legally, e.g. stating this in their policy and showing when you run the app for the first time that it will sell their not personal data in exchange for free service. The concept is fair as some are willing to pay with money, some are ok to pay with their data. Hiding the fact that you will sell data obviously deserves the punishment.
- Krasnol 7y agoAnd that's the big deal here.
- tlogan 7y agoI 100% agree with you - but people tend to ignore "privacy" if something is free. I was just talking with a colleague of mine who is in this "privacy is important" camp. But he is using mail tracker from hunter.io (since it is free). It was really hard to explain him that that company which allows you to "Find the email address of any professional" is giving mail tracker for free in order to collect more data (to their defense they clearly say in their privacy policy and you can opt-out of the "sale" of personal information).
- Alex_P13 7y agoThat's Awful. Top 20 Dashboard Template Fast of all, you have to choose an excellent Dashboard template to manage your business through the website. https://www.electronthemes.com/top-20-dashboard-template/ https://www.electronthemes.com/top-20-dashboard-template/
- justlexi93 7y agoI guess that's one way to get gacha games' player stats.
- etaioinshrdlu 7y agoHaha, I quietly called them out few years ago: https://news.ycombinator.com/item?id=17823292 https://news.ycombinator.com/item?id=17823292 Their CEO is one shady dude. Evasive. Knew his company was sitting on a shady foundation and just kept it going. Large companies buy Sensor Tower's data.
- TeMPOraL 7y agoCome to think of it, isn't the name pretty revealing? You don't build a sensor tower to block and hide information, you build one to collect data.
- stronglikedan 7y agoMay as well have called it Eye of Sauron.
- etaioinshrdlu 7y agoAhh but the users of the VPNs apps have no idea that Sensor Tower is behind the app and collecting and selling their data. It might be in the terms of service and briefly shown to them, but in the literal, practical sense, the users actually do not know! It is without their knowledge.
- AznHisoka 7y agoSimilarWeb is another company with millions of funding that is sitting on a shady foundation as well.
- jsilence 7y agoAnyone in Europe suing based on GDPR regulations?
- chopin 7y agoUnfortunately, GDPR doesn't give you the right to sue. Enforcement is only possible via (hollowed out) data protection agencies.
- mlthoughts2018 7y ago> “ Apple and Google restrict root certificate privileges due to the security risk to users. Sensor Tower’s apps bypass the restrictions by prompting users to install a certificate through an external website after an app is downloaded.” Seems like it will be open and shut case, quickly banning the apps and hopefully Sensor Tower entirely, especially given the other details of the article explaining they’ve already banned apps from Sensor Tower for previous violations.
- AznHisoka 7y agoif they ban their apps, would the certificate still be installed in your phone if you installed it previously?
- cik 7y agoI've built more than one VPN network over the years - and I don't use the ones I built. My philosophy has always been that I can't trust the network after I no longer own it - and if the code isn't open. The hard reality is that you have no way of knowing what's being logged if you don't have full access to the servers. I've always pushed for leaving VPN servers on operating systems running in read-only, on read-only disks, and open to the world (i.e customers who log in). It's one of the best forms of real transparency that I can think of. Funny, I never won that one.
- eternalban 7y agoWhy not start your own virtuous VPN company.
- cik 7y agoIt's not a business I'm interested in running.
- adwi 7y agoWhat is current best-practice ad blocker for iOS Safari? AdGuard? Ad-Blocker Pro? I’ve tried Firefox but besides their tracker blocking ads are still prevalent.
- tlogan 7y agoDoes this break "California Consumer Privacy Act" of 2020? As far as I now, companies are now legally obligated to give California residents the opportunity to see how their personal information is being tracked, how it's being sold, and how to opt out.