7 ms·
T-Mobile has started selling your app data to advertisers
- car_analogy 4y ago> T-Mobile uses network-level tools to track the apps that people use on their phones How does this work? Does it use heuristics to associate traffic patterns or server IPs with apps? Or packet inspection for apps that don't encrypt traffic? > Should every tap on your phone be tracked and monetized? I would hope not. These articles always treat implementation details so infuriatingly casually. There's a vast gulf between analyzing traffic patterns, and installing spyware to report on "every tap", as this sentence implies.
- throwaway81523 4y ago> Does it use heuristics to associate traffic patterns or server IPs with apps? That's what it sounded like to me. > There's a vast gulf between analyzing traffic patterns, and installing spyware to report on "every tap", as this sentence implies. I didn't see an implication that every tap was currently being tracked. Only an inference that this is what the marketeers really want, and that allowing such desires to run rampant would be a bad thing. It still baffles me that people see massive surveillance as benign because they think the end result is merely relatively ignorable targeted advertisements.
- Sephr 4y ago> How does this work? I don't know myself, but it's possible that they are simply reading unencrypted SNI fields from TLS connections. SNI exposes the website hostnames that you connect to.
- throwaway-blaze 4y agoBingo.
- throwaway-blaze 4y agoThey have built a dictionary mapping the hostnames your phone talks to when certain apps are used (i.e. uber app talks to xxxx.uber.com). Altho there are millions of apps, they only need to have this dictionary for the "top" apps used by most people. Note they're not using DNS records, but rather the SNI portion of the HTTPS requests made by the phone.
- misterprime 4y agoFrom the article: "T-Mobile does not currently collect app data on iOS users, fearing it could run afoul of Apple's privacy rules. ...you can opt-out of T-Mobile's program using its official "Magenta Marketing Platform Choices" app."
- throwaway81523 4y agoLol, install a spyware app to opt out of their spyware? Something something Inception?
- BenjiWiebe 4y agoPresumably you only need to have it installed briefly to opt out.
- BudaDude 4y agoI wonder how Apple would react. There was rumors years ago that Apple wanted to start their own cell service and currently, the only thing they don't control on iPhones is the data connection. I can foresee a future Apple wanting to close that gap.
- ParksNet 4y agoApple has already reduced MNOs to 'big dumb pipes' [1]. Hard to see the motivation to take over a low-margin and mature business. Their motivation seems to be to gradually reduce in size, and eventually eliminate SIM cards - presumably just to free up internal volume. But they've been successful in forcing MNOs to do that anyway. [1] https://en.wikipedia.org/wiki/Dumb_pipe https://en.wikipedia.org/wiki/Dumb_pipe
- throwaway-blaze 4y agoThis has nothing to do with "running afoul of Apple's privacy rules". Apple has effectively killed the IDFA, so even if T-Mo built a profile of an iOS user, there's no "key" to be used later on to identify the user when they try to show an ad based on the data collected.
- rkagerer 4y agoThis sickens me.
- BudaDude 4y agoAfter we lost Net Neutrality, it was only a matter of time before this crap happened.
- _-david-_ 4y agoNet neutrality does not have to do with selling data?
- BudaDude 4y agohttps://nordvpn.com/blog/net-neutrality-pros-and-cons/ https://nordvpn.com/blog/net-neutrality-pros-and-cons/ > By the end of 2017, the FCC had revoked net neutrality and allowed internet providers to sell their users’ data without their permission
- _-david-_ 4y agoThanks. I didn't realize net neutrality included that in the US.
- kornhole 4y agoHere are mitigations: Run a VPN on your phone at all times. Use an alternate OS based on AOSP such as Graphene, Calyx, E, Lineage or Linux for the brave. These have no carrier bloatware/spyware. Transfer your phone number to VOIP. Then only occasionally use a burner SIM away from house.
- Dracophoenix 4y agoWhat about IMEI? Isn't that burned into the SoC? I don't think you can spoof those, can you?
- willcipriano 4y agoKevin Mitnick did, but I think he had a magical phone dev kit of some kind.
- kornhole 4y agoIf you run graphene, no apps can read the imei. SIM cards do, but that is why you should use a burner SIM rarely if at all.
- Denatonium 4y agoI know there's an opt out, but someone needs to create an app that connects to a TLS server while sending random SNI values. (I know from experience with their video streaming throttling that T-Mobile uses TLS SNI to categorize websites). This could probably be scripted using Termux, OpenSSL, and Tasker.
- idatum 4y agoRelated: I checked, again, the Android T-Mobile app and I'm still opted out in the Advertisements & analytics page. You should check this. Just when they announced (about a year ago?) they would default this to opted in, they changed my already explicit intention to opt out. Wow. Trust is hard to earn and...
- blagie 4y agoT-Mobile has no data security and gets hacked like every week. If you trust them with your data.... They are friendly and do have good customer service, though. And they cheat a little bit less than their competitors.