5 ms·

It really sucks that these privacy policies Google requires everyone to have also have to be hosted on a normal website. This means the privacy policy can chang

by saurik 2y ago

It really sucks that these privacy policies Google requires everyone to have also have to be hosted on a normal website. This means the privacy policy can change on a whim, and it means you can't read them until after you have already sent your IP address to the developer (as part of connecting to their website).

metadat 2y ago
What is the value of the developer potentially knowing your IP address? They receive (1) a signal you were potentially interested and (2) can use GeoIP to learn your approximate location. This doesn't seem particularly valuable or egregious, what am I missing?
- saurik 2y ago
  Until after you read the privacy policy, you can't know what they intend to do with that information. As a trivial example, they might be handing IP address information to third-parties--hell: the website itself might be hosted by a third-party (or might be behind a CDN provided by a third-party) or use frameworks/fonts hosted by third-parties, even if it isn't as ostentatious as "the website this policy is hosted on has a tracking pixel / login button / ad on it from a third-party"--who can then correlate that IP address with accesses to other websites. Really, depending on your Internet provider, your IP address should be thought of as a direct personal identifier; in my case, I use a residential cable service, so my IP address only changes about once a year, making it trivial to correlate what I do across sites.
  - deleted 2y ago
    [deleted]
  - tonyhart7 2y ago
    Anything that connect internet that means you send IP addresses over to make request You think only website do this ???
    - kragen 2y ago
      you could send it to someone who you already trust, like google, instead of someone you are trying to decide on whether to trust or not
      - metadat 2y ago
        Do we really trust google? Why? Lol, as an entity it's proven it only cares about itself and making moar $$$$$$.
        kragen 2y ago
        the context of this discussion is people installing apps from the google play store (something i do not do myself), so, yes, those people do trust google and indeed have already informed it in a personally identifiable way that they are pondering installing the app. having google provide them with the privacy policy for the app would be a pure improvement
- forgotmypw17 2y ago
  In the security space, there are often modes that you can't think of ahead of time that become accessible through chaining a series of seemingly benign access modes. But here are some ideas: GeoIP location is a real threat, sometimes you can get very precise. Cross-referencing with other services is another threat. It can also help with other targeted attacks, like phishing and exploit attempts. It can aid ISP and other types of surveillance.
- nottorp 2y ago
  They may be using google analytics, for example.
jasonjayr 2y ago
They don't use a content-hash (or some other means) to detect changes?

by saurik 2y ago

metadat 2y ago

What is the value of the developer potentially knowing your IP address? They receive (1) a signal you were potentially interested and (2) can use GeoIP to learn your approximate location. This doesn't seem particularly valuable or egregious, what am I missing?

saurik 2y ago
Until after you read the privacy policy, you can't know what they intend to do with that information. As a trivial example, they might be handing IP address information to third-parties--hell: the website itself might be hosted by a third-party (or might be behind a CDN provided by a third-party) or use frameworks/fonts hosted by third-parties, even if it isn't as ostentatious as "the website this policy is hosted on has a tracking pixel / login button / ad on it from a third-party"--who can then correlate that IP address with accesses to other websites. Really, depending on your Internet provider, your IP address should be thought of as a direct personal identifier; in my case, I use a residential cable service, so my IP address only changes about once a year, making it trivial to correlate what I do across sites.
- deleted 2y ago
  [deleted]
- tonyhart7 2y ago
  Anything that connect internet that means you send IP addresses over to make request You think only website do this ???
  - kragen 2y ago
    you could send it to someone who you already trust, like google, instead of someone you are trying to decide on whether to trust or not
    - metadat 2y ago
      Do we really trust google? Why? Lol, as an entity it's proven it only cares about itself and making moar $$$$$$.
      - kragen 2y ago
        the context of this discussion is people installing apps from the google play store (something i do not do myself), so, yes, those people do trust google and indeed have already informed it in a personally identifiable way that they are pondering installing the app. having google provide them with the privacy policy for the app would be a pure improvement
forgotmypw17 2y ago
In the security space, there are often modes that you can't think of ahead of time that become accessible through chaining a series of seemingly benign access modes. But here are some ideas: GeoIP location is a real threat, sometimes you can get very precise. Cross-referencing with other services is another threat. It can also help with other targeted attacks, like phishing and exploit attempts. It can aid ISP and other types of surveillance.
nottorp 2y ago
They may be using google analytics, for example.

jasonjayr 2y ago

They don't use a content-hash (or some other means) to detect changes?