6 ms·

Of course it is. Because that's what "consumer tech" has turned into. An excuse to lie to end users as much as you can possibly get away with, to collect as m

by Syonyk 3y ago

Of course it is. Because that's what "consumer tech" has turned into. An excuse to lie to end users as much as you can possibly get away with, to collect as much information from them as you possibly can, gatekept by companies who do not care in the slightest about any of those, unless it makes bad press for them, at which point they "promise to try harder to not get caught doing this in the future." And they don't even try to hide it. It's just that nobody looks. > Note: Since the BM2 does not use HTTPS, there is no need to even install a certificate. What this means is that anyone can independently identify that their latitude and longitude co-ordinates are being sent on either iOS or Android with no modifications to their phone. "Anyone can independently verify." And also, anyone on the network connection between you and the server can help themselves to this data.

malux85 3y ago
What do we do about it? The obvious answer is just stop buying this junk, but how would anyone know? I'm curious, have you (or anyone else) seen novel solutions to this problem? Is this even solvable? Ideas everyone!
- hedora 3y ago
  Establish financial liability for products that engage in opt-out data collection. The liability should be shared by the manufacturers and by any resellers (especially including Amazon in the US). Make sure the financial liability is at least the maximum of 100x the value of the data and 10x the revenue the suite of bundled products generate.
  - genocidicbunny 3y ago
    Also, criminal liability for everyone involved. Put every single employee and exec of these companies in jail for 10-20 years, with the first one to tattle on the employer getting a pardon.
    - Syonyk 3y ago
      And suddenly, a new style of ad: "Work from home! Be your own CEO! For a mere $5000, we set up your company, brand our products, and you get all the credit! No technical skills needed, just a bank account to receive your monthly income!"
      - genocidicbunny 3y ago
        We can go ahead and extend the criminal liability up and down the ownership chain too.
  - blibble 3y ago
    this is more or less the main idea of the GDPR it attempted to turn people's personal data from a balance sheet asset into a liability with varying success
- hsbauauvhabzb 3y ago
  Regulation is the only way to solve this issue, and regulation requires the people in power to care, where currently almost none in non European countries do.
- Syonyk 3y ago
  > The obvious answer is just stop buying this junk, but how would anyone know? You don't have to know. You can safely guess. Assume anything "connected" is shouting as much as it possibly can, upstream, at all points in time. It's a cell phone app? You have location services turned on? It's streaming your position. Also, whatever else it can grab. Basically, if you've granted a permission to an app, assume it's streaming that attribute upstream, and keep things limited. And, at all costs, prefer offline only devices. It took me a while to find some air quality sensors for my home that weren't online and App-based - but they're literally standalone displays that sniff the air and report out PM2.5/PM10/CO2/etc. I can't access them with an app, I have to walk past and look. So be it. For voltage of batteries, ffs, just use a voltmeter, or, if you care about always seeing it, install a little bulkhead voltmeter. I do this on all sorts of projects (most recently a "power toolbox" I use for stuff - battery, inverter, solar charger, USB ports, and a little voltmeter that shows pack voltage when it's powered on). And then leave your little pocket snoops behind on a regular basis. I've gone back to carrying a regular watch on my wrist, or, when I'm feeling spicy, a pocket watch. And no cell phone, or a turned off cell phone in my backpack or something. > Is this even solvable? No. Because (a) most people don't care, in terms of actions they're willing to take. This app in question has had hundreds of thousands of downloads, so clearly the devices are popular enough. Saying "I care about my privacy!" is one thing, but actually living without 30,000 apps installed on your phone (shoulder surf when people are scrolling their screens in public places - I've watched people on an airplane with a iPad Pro Max or whatever have literally 20-30 screens full of icons) is pretty uncommon. and slightly inconvenient. And, (b), politicians are largely in the pay of tech companies, or at least believe the lies about how they're bringing people together and will self regulate and... whatever. The solutions are simply to opt out, or start using more aggressively hostile-to-profile things. Waves from Qubes-OS in a disposable VM I don't have any other good ideas. The tech ecosystem has rotted, and I don't see any redemption for it. I work in tech, and I've been engineering my life to require less and less computer use, and I genuinely look forward to putting down a computer for the last time.
- RajT88 3y ago
  Clone their products so cheaply that you can undercut them on price and still make money. Of course that requires said person to also resist the temptation of data harvesting. Which few seem to be able to.
  - lolinder 3y ago
    You can't clone them cheaply without the subsidy the data provides. These products are usually cheaper than they should be because the manufacturer knows they can get value out of the data sale.
    - briHass 3y ago
      Not this one, though. It's actually surprisingly expensive for what it is. One could build this with an ESP32 and a couple of jellybean parts to regulate the voltage to what the chip needs and create a voltage divider. Even with a case, it's less than $15 BOM. You'd have to write the phone app, but that would be as complex as you wanted.
- javajosh 3y ago
  This looks like fraud by Amap and negligence by Google (and Apple). The 100k users have cause for a class action. However the upfront cost of such a thing is prohibitive. There is also the possibility that this is a national security issue. Exfiltrating location data to China for 100k Americans, probably including government and military employees, violates the law. But again, it's all about the cost. Also ambivalence (as others have pointed out).
  - XorNot 3y ago
    The issue is that once again the permissions model as implemented on phones is complete garbage. Showing a list of permissions with "accept" as the only option is brain dead. Google easily has the money and engineering resources to provide a complete fix to this issue (multiple spoofing options, deny options etc.) but of course they don't want to - because Google's business is advertising and advertisers want your location data. And your frequently visited locations. And wifi networks. And probably brand names of whatever is on your network. We desperately, desperately need to get open-source considered as a national security agenda item. We need hardware vendors forced to publish full interface specifications. We probably need to require firmware blobs to be open source and tell Nvidia and AMD to stop breaking the law (i.e. they both suspect they'd be done for copyright/patent law if they had to publish their source code so they don't).
- megablast 3y ago
  Wait for Europe to do something. That’s all we can do. Us government will do nothing.
- deleted 3y ago
  [deleted]
x1sec 3y ago
This is very true. I make an effort to point out that MITM proxy now supports Wireguard [1] to tunnel traffic out from the handset. It literally should take no more then 5 minutes from download to packet inspection. Of course if TLS is used by the mobile app then on iOS it's a few more minutes of setup time. Unfortunately with Android, installing your own certificate in the trust store is no longer trivial. As you point out though, the application doesn't even use TLS for sending the GPS data. In part two [2] of the blog post series, the Alibaba's AMap SDK uses both TLS and custom encryption and this took me quite a few days to figure out the Wifi and cell data collection - so it's not always so trivial. Either way, I recommend to everyone to at least do a basic 'desk check' on the apps they install. You never know what you will find. [1] https://mitmproxy.org/posts/wireguard-mode/ https://mitmproxy.org/posts/wireguard-mode/ [2] https://doubleagent.net/2023/05/22/a-car-battery-monitor-tracking-your-location-part2 https://doubleagent.net/2023/05/22/a-car-battery-monitor-tra...
- varenc 3y ago
  Sadly certificate pinning is becoming pretty common in my experience. Most of the "big apps" do it. That means that even if you trust your own CA you still can't MITM the traffic. On iOS you need to jailbreak a device to override cert pinning. Funny how mechanisms that increase security also remove some of the freedom and visibility we have into our own deviecs.
  - x1sec 3y ago
    Most defiantly. iOS is a different kettle of fish. Same challenges are present with performing forensics on an iPhone! The top commercial forensic toolkits will try to jailbreak the handset if possible to pull off artifacts. Good luck on newer hardware with the latest iOS versions. [1] On the topic of iOS forensics, you can still get quite many useful artifacts from iOS backups with Mobile Verification Toolkit [2] being quite exceptional. I have had less success with iOS backups and the popular iLEAPP forensics software [3]. [1] https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-now-official-bootloader-level-extraction-for-76-devices/ https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-... [2] https://docs.mvt.re/en/latest/ https://docs.mvt.re/en/latest/ [3] https://github.com/abrignoni/iLEAPP https://github.com/abrignoni/iLEAPP
deleted 3y ago
[deleted]
jklinger410 3y ago
Great observations. I hope everyone who shares these thoughts is voting for socialist candidates in their home countries. This is what unregulated capitalism looks like.
- Zambyte 3y ago
  This is the result of "intellectual property" laws (which exist entirely outside of capitalism) being used by design. It's no surprise that when people have access to your computer and you are not legally allowed to know what they are doing with it, they abuse you.
- lamontcg 3y ago
  I donated actual hard earned currency to my socialist candidate. Predictably futile, but I can state that none of this shit is my fault or what I wanted.
- CyberDildonics 3y ago
  If unregulated capitalism is the problem, shouldn't people be voting for regulated capitalism?
  - jklinger410 3y ago
    That's socialism
- CWuestefeld 3y ago
  Excellent. With luck, we'll be able to transform the Western countries into bastions of privacy and individual freedom like China and North Korea.
titzer 3y ago
Stallman was right. You absolutely cannot trust closed source to protect the privacy of your data. Reject all platforms that are not fully open, and reject all devices that come with any amount of closed software or firmware. Reading some damn "location privacy policy" is not going to cut it. Such policies are written by lawyers who lie by omission all the time. E.g. as soon as location data is "anonymized" the policy no longer applies. Which is of course a steaming lie. Location information cannot be effectively anonymized without basically nullifying its utility. Guess where that car parks? In one of two general locations for > 18 hours a day, usually. Gee, I wonder who that is. Even with 100m of noise, it's uniquely identifying of you. Don't even think about mobile phones that are accurate to the meter, tricked out with WiFi, accelerometers, and barometers. They are wireframe god mode tracking devices given the accuracy of sensors these days. What a nightmare to have these in everyone's hands and run by big tech.
- kwhitefoot 3y ago
  > reject all devices that come with any amount of closed software or firmware. Implementing that policy would mean not owning a mobile phone, a car, a television, microwave, or washing machine, etc.
  - TaylorAlexander 3y ago
    I would love to see a world where all of those things use open source software and hardware. It would take a long time to make it a reality, but I see a path to that where more people are out there today making successful open source hardware systems and learning the parameters of how to fund them and financially maintain development.
    - HKH2 3y ago
      I would too. Some of us have trouble trying to justify buying a System76 laptop etc; the anti-abuse options are usually more expensive. (Edit: PinePhones are cheaper than I thought.)
      - 3y ago
KMnO4 3y ago
I mean… If you’re on the network presumably you already know the location?
proxiful-wash 3y ago
No its not. This is state level treason. It needs to stop. Sorry if this hurts anyones feelings.
- smoldesu 3y ago
  The state knows, they buy the laundered version of this data from Palantir and the like.
throw10920 3y ago
This kind of generic emotionally-charged flamebait is appropriate for Reddit or the YouTube comment section, not Hacker News. There's no useful information in this comment, and it doesn't inform others or satisfy intellectual curiosity - it's just there to stoke up anger.

by Syonyk 3y ago

malux85 3y ago

What do we do about it? The obvious answer is just stop buying this junk, but how would anyone know? I'm curious, have you (or anyone else) seen novel solutions to this problem? Is this even solvable? Ideas everyone!

hedora 3y ago
Establish financial liability for products that engage in opt-out data collection. The liability should be shared by the manufacturers and by any resellers (especially including Amazon in the US). Make sure the financial liability is at least the maximum of 100x the value of the data and 10x the revenue the suite of bundled products generate.
- genocidicbunny 3y ago
  Also, criminal liability for everyone involved. Put every single employee and exec of these companies in jail for 10-20 years, with the first one to tattle on the employer getting a pardon.
  - Syonyk 3y ago
    And suddenly, a new style of ad: "Work from home! Be your own CEO! For a mere $5000, we set up your company, brand our products, and you get all the credit! No technical skills needed, just a bank account to receive your monthly income!"
    - genocidicbunny 3y ago
      We can go ahead and extend the criminal liability up and down the ownership chain too.
- blibble 3y ago
  this is more or less the main idea of the GDPR it attempted to turn people's personal data from a balance sheet asset into a liability with varying success
hsbauauvhabzb 3y ago
Regulation is the only way to solve this issue, and regulation requires the people in power to care, where currently almost none in non European countries do.
Syonyk 3y ago
> The obvious answer is just stop buying this junk, but how would anyone know? You don't have to know. You can safely guess. Assume anything "connected" is shouting as much as it possibly can, upstream, at all points in time. It's a cell phone app? You have location services turned on? It's streaming your position. Also, whatever else it can grab. Basically, if you've granted a permission to an app, assume it's streaming that attribute upstream, and keep things limited. And, at all costs, prefer offline only devices. It took me a while to find some air quality sensors for my home that weren't online and App-based - but they're literally standalone displays that sniff the air and report out PM2.5/PM10/CO2/etc. I can't access them with an app, I have to walk past and look. So be it. For voltage of batteries, ffs, just use a voltmeter, or, if you care about always seeing it, install a little bulkhead voltmeter. I do this on all sorts of projects (most recently a "power toolbox" I use for stuff - battery, inverter, solar charger, USB ports, and a little voltmeter that shows pack voltage when it's powered on). And then leave your little pocket snoops behind on a regular basis. I've gone back to carrying a regular watch on my wrist, or, when I'm feeling spicy, a pocket watch. And no cell phone, or a turned off cell phone in my backpack or something. > Is this even solvable? No. Because (a) most people don't care, in terms of actions they're willing to take. This app in question has had hundreds of thousands of downloads, so clearly the devices are popular enough. Saying "I care about my privacy!" is one thing, but actually living without 30,000 apps installed on your phone (shoulder surf when people are scrolling their screens in public places - I've watched people on an airplane with a iPad Pro Max or whatever have literally 20-30 screens full of icons) is pretty uncommon. and slightly inconvenient. And, (b), politicians are largely in the pay of tech companies, or at least believe the lies about how they're bringing people together and will self regulate and... whatever. The solutions are simply to opt out, or start using more aggressively hostile-to-profile things. Waves from Qubes-OS in a disposable VM I don't have any other good ideas. The tech ecosystem has rotted, and I don't see any redemption for it. I work in tech, and I've been engineering my life to require less and less computer use, and I genuinely look forward to putting down a computer for the last time.
RajT88 3y ago
Clone their products so cheaply that you can undercut them on price and still make money. Of course that requires said person to also resist the temptation of data harvesting. Which few seem to be able to.
- lolinder 3y ago
  You can't clone them cheaply without the subsidy the data provides. These products are usually cheaper than they should be because the manufacturer knows they can get value out of the data sale.
  - briHass 3y ago
    Not this one, though. It's actually surprisingly expensive for what it is. One could build this with an ESP32 and a couple of jellybean parts to regulate the voltage to what the chip needs and create a voltage divider. Even with a case, it's less than $15 BOM. You'd have to write the phone app, but that would be as complex as you wanted.
javajosh 3y ago
This looks like fraud by Amap and negligence by Google (and Apple). The 100k users have cause for a class action. However the upfront cost of such a thing is prohibitive. There is also the possibility that this is a national security issue. Exfiltrating location data to China for 100k Americans, probably including government and military employees, violates the law. But again, it's all about the cost. Also ambivalence (as others have pointed out).
- XorNot 3y ago
  The issue is that once again the permissions model as implemented on phones is complete garbage. Showing a list of permissions with "accept" as the only option is brain dead. Google easily has the money and engineering resources to provide a complete fix to this issue (multiple spoofing options, deny options etc.) but of course they don't want to - because Google's business is advertising and advertisers want your location data. And your frequently visited locations. And wifi networks. And probably brand names of whatever is on your network. We desperately, desperately need to get open-source considered as a national security agenda item. We need hardware vendors forced to publish full interface specifications. We probably need to require firmware blobs to be open source and tell Nvidia and AMD to stop breaking the law (i.e. they both suspect they'd be done for copyright/patent law if they had to publish their source code so they don't).
megablast 3y ago
Wait for Europe to do something. That’s all we can do. Us government will do nothing.
deleted 3y ago
[deleted]

x1sec 3y ago

This is very true. I make an effort to point out that MITM proxy now supports Wireguard [1] to tunnel traffic out from the handset. It literally should take no more then 5 minutes from download to packet inspection. Of course if TLS is used by the mobile app then on iOS it's a few more minutes of setup time. Unfortunately with Android, installing your own certificate in the trust store is no longer trivial. As you point out though, the application doesn't even use TLS for sending the GPS data. In part two [2] of the blog post series, the Alibaba's AMap SDK uses both TLS and custom encryption and this took me quite a few days to figure out the Wifi and cell data collection - so it's not always so trivial. Either way, I recommend to everyone to at least do a basic 'desk check' on the apps they install. You never know what you will find. [1] https://mitmproxy.org/posts/wireguard-mode/ https://mitmproxy.org/posts/wireguard-mode/ [2] https://doubleagent.net/2023/05/22/a-car-battery-monitor-tracking-your-location-part2 https://doubleagent.net/2023/05/22/a-car-battery-monitor-tra...

varenc 3y ago
Sadly certificate pinning is becoming pretty common in my experience. Most of the "big apps" do it. That means that even if you trust your own CA you still can't MITM the traffic. On iOS you need to jailbreak a device to override cert pinning. Funny how mechanisms that increase security also remove some of the freedom and visibility we have into our own deviecs.
- x1sec 3y ago
  Most defiantly. iOS is a different kettle of fish. Same challenges are present with performing forensics on an iPhone! The top commercial forensic toolkits will try to jailbreak the handset if possible to pull off artifacts. Good luck on newer hardware with the latest iOS versions. [1] On the topic of iOS forensics, you can still get quite many useful artifacts from iOS backups with Mobile Verification Toolkit [2] being quite exceptional. I have had less success with iOS backups and the popular iLEAPP forensics software [3]. [1] https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-now-official-bootloader-level-extraction-for-76-devices/ https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-... [2] https://docs.mvt.re/en/latest/ https://docs.mvt.re/en/latest/ [3] https://github.com/abrignoni/iLEAPP https://github.com/abrignoni/iLEAPP

deleted 3y ago

[deleted]

jklinger410 3y ago

Great observations. I hope everyone who shares these thoughts is voting for socialist candidates in their home countries. This is what unregulated capitalism looks like.

Zambyte 3y ago
This is the result of "intellectual property" laws (which exist entirely outside of capitalism) being used by design. It's no surprise that when people have access to your computer and you are not legally allowed to know what they are doing with it, they abuse you.
lamontcg 3y ago
I donated actual hard earned currency to my socialist candidate. Predictably futile, but I can state that none of this shit is my fault or what I wanted.
CyberDildonics 3y ago
If unregulated capitalism is the problem, shouldn't people be voting for regulated capitalism?
- jklinger410 3y ago
  That's socialism
CWuestefeld 3y ago
Excellent. With luck, we'll be able to transform the Western countries into bastions of privacy and individual freedom like China and North Korea.

titzer 3y ago

Stallman was right. You absolutely cannot trust closed source to protect the privacy of your data. Reject all platforms that are not fully open, and reject all devices that come with any amount of closed software or firmware. Reading some damn "location privacy policy" is not going to cut it. Such policies are written by lawyers who lie by omission all the time. E.g. as soon as location data is "anonymized" the policy no longer applies. Which is of course a steaming lie. Location information cannot be effectively anonymized without basically nullifying its utility. Guess where that car parks? In one of two general locations for > 18 hours a day, usually. Gee, I wonder who that is. Even with 100m of noise, it's uniquely identifying of you. Don't even think about mobile phones that are accurate to the meter, tricked out with WiFi, accelerometers, and barometers. They are wireframe god mode tracking devices given the accuracy of sensors these days. What a nightmare to have these in everyone's hands and run by big tech.

kwhitefoot 3y ago
> reject all devices that come with any amount of closed software or firmware. Implementing that policy would mean not owning a mobile phone, a car, a television, microwave, or washing machine, etc.
- TaylorAlexander 3y ago
  I would love to see a world where all of those things use open source software and hardware. It would take a long time to make it a reality, but I see a path to that where more people are out there today making successful open source hardware systems and learning the parameters of how to fund them and financially maintain development.
  - HKH2 3y ago
    I would too. Some of us have trouble trying to justify buying a System76 laptop etc; the anti-abuse options are usually more expensive. (Edit: PinePhones are cheaper than I thought.)
    - 3y ago

KMnO4 3y ago

I mean… If you’re on the network presumably you already know the location?

proxiful-wash 3y ago

No its not. This is state level treason. It needs to stop. Sorry if this hurts anyones feelings.

smoldesu 3y ago
The state knows, they buy the laundered version of this data from Palantir and the like.

throw10920 3y ago

This kind of generic emotionally-charged flamebait is appropriate for Reddit or the YouTube comment section, not Hacker News. There's no useful information in this comment, and it doesn't inform others or satisfy intellectual curiosity - it's just there to stoke up anger.