3 ms·

Between that and CityMapper being part of the Gravy leak, things look pretty bleak for UK third party transit apps.

by pluc 2y ago

gruez 2y ago
>CityMapper being part of the Gravy leak You should take that leak with a huge grain of salt because the alleged list of apps stealing your location contains hundreds of apps that doesn't even contain location permissions.
- pluc 2y ago
  Yeah, that's what they all say. Tinder and Spotify were both named specifically and both denied it. I don't trust any of them so I'm assuming they're lying, you do what you want.
  - gruez 2y ago
    Why do you trust an unverified "leak" over statements made by multi-billion dollar multinationals? Sure, corporations can lie, but so can such leaks. Extraordinary claims require extraordinary evidence. If the leak is alleging something impossible (ie. stealing location data despite not having location permissions in manifest), then I'd need far more evidence than some csv list.
    - blitzar 2y ago
      Trust me, I wouldn’t lie to you for a billion dollars. I might have been caught lying before about these things but this time it’s different.
    - imchillyb 2y ago
      Not OP, but… I trust a leak from someone with no financial gain from the leak. I do not trust multi nationals worth several million, billion, trillion, to state truth. I expect them to lie until caught by a federal entity and fined. Guess how many times multi nationals lied to the public last year alone. Now you answer: “Why do you put any trust in what statements a corp releases?!”
      - gruez 2y ago
        >I trust a leak from someone with no financial gain from the leak. >I do not trust multi nationals worth several million, billion, trillion, to state truth. I expect them to lie until caught by a federal entity and fined. >Guess how many times multi nationals lied to the public last year alone. And what about the leak itself? "You really think someone would do that, just go on the internet and tell lies?" Here's an anonymous "leak" I found that says whatsapp is backdoored and sends your chats to the CCP: https://pastebin.com/uE4m694M https://pastebin.com/uE4m694M . Are you going to believe it? If asked for comment, Meta is probably going to deny it, but obviously they're going to be lying for the reasons you mentioned. >Now you answer: “Why do you put any trust in what statements a corp releases?!” "Trust" isn't binary, it's a spectrum. I don't put much trust in corp releases, but I still trust them far more than an unverified source. Even if you put zero weight on "statements a corp releases", you can inspect the AOSP source code yourself and see that it shouldn't be possible for apps to steal your location data when it doesn't have location permissions, and therefore a list claiming that such apps are stealing your location data should be treated with extreme skepticism.
    - nonrandomstring 2y ago
      > Why do you trust an unverified "leak" over statements made by multi-billion dollar multinationals? Less incentives to lie. Edit: I had a think, and what I picked up on was the idea that sheer concentration of money might stand in as a signal for trust, and so whether somone with more money would naturally be more honest or dishonest than someone with less, is really more of an interesting question.
  - braiamp 2y ago
    Is not whenever they deny it or not, your device can attest to it. Both Google and Apple have no qualms screwing up with third parties in their apps. Also, apps have been datamined up the wazoo, if a company claims not to do something and does it, someone would have already howled about it.
- d1sxeyes 2y ago
  This is a bit of an incorrect read on what this leak is. Gravy gathers location data about people from multiple sources but not directly from consumers. Gravy’s customers buy this data. As far as I understand, this is a list of locations and apps used by a person, but without much context. A typical response to this has been something like this: > Grindr has never worked with or provided data to Gravy Analytics. We do not share data with data aggregators or brokers and have not shared geolocation with ad partners for many years. Transparency is at the core of our privacy program, therefore the third parties and service providers we work with are listed here on our website. Note how carefully written this is to imply they don’t share any data at all, but they stop short of saying “we don’t share any data with ad partners”, just geolocation data. But for companies like Gravy, their whole business is about getting data. So it’s not at all implausible (or even unlikely) that this represents an event where a user opened Grindr (conceivably sold to Gravy by one of Grindr’s ad partners following an impression), and the same individual’s location was determined by some other method (for example, IP address geolookup, or bought from a company which IS supplying data to Gravy directly and has location permissions). Take the leak with a grain of salt, sure, but it’s looking reasonably genuine to me.
  - kmeisthax 2y ago
    > We (...) have not shared geolocation data with ad partners for many years Mobile operating systems don't have good (if any) support for opening things in subprocesses with restricted permissions from the rest of the app. So if Grindr loads an ad, that ad runs with Grindr's permissions. Same for any analytics code that ad uses. So if Grindr gets geolocation, even temporarily, so does every ad partner they have, whether they like it or not. And the thing is, ads are a bottomless pit of third-party JavaScript. Nobody trusts nobody in the ad space, so everyone wants their own trackers doing their own client-side data collection. So Grindr doesn't have to know anything about Gravy Analytics, they just have to have an ad partner decide to use them and bam, they're compromised.
    - gruez 2y ago
      >Mobile operating systems don't have good (if any) support for opening things in subprocesses with restricted permissions from the rest of the app. [...] >And the thing is, ads are a bottomless pit of third-party JavaScript. [...] If it's actually javascript, attempting to grab location would result in a weird location prompt[1] that shows even if you granted the app location permission. It's still conceivable for a random SDK to go rogue and exfiltrate location data, but it's unlikely that an ad in a webview would be able to. [1] https://stackoverflow.com/questions/39665367/how-to-prevent-wkwebview-to-repeatedly-ask-for-permission-to-access-location https://stackoverflow.com/questions/39665367/how-to-prevent-...

Between that and CityMapper being part of the Gravy leak, things look pretty bleak for UK third party transit apps.

by pluc 2y ago

Between that and CityMapper being part of the Gravy leak, things look pretty bleak for UK third party transit apps.

>CityMapper being part of the Gravy leak You should take that leak with a huge grain of salt because the alleged list of apps stealing your location contains hundreds of apps that doesn't even contain location permissions.

pluc 2y ago
Yeah, that's what they all say. Tinder and Spotify were both named specifically and both denied it. I don't trust any of them so I'm assuming they're lying, you do what you want.
- gruez 2y ago
  Why do you trust an unverified "leak" over statements made by multi-billion dollar multinationals? Sure, corporations can lie, but so can such leaks. Extraordinary claims require extraordinary evidence. If the leak is alleging something impossible (ie. stealing location data despite not having location permissions in manifest), then I'd need far more evidence than some csv list.
  - blitzar 2y ago
    Trust me, I wouldn’t lie to you for a billion dollars. I might have been caught lying before about these things but this time it’s different.
  - imchillyb 2y ago
    Not OP, but… I trust a leak from someone with no financial gain from the leak. I do not trust multi nationals worth several million, billion, trillion, to state truth. I expect them to lie until caught by a federal entity and fined. Guess how many times multi nationals lied to the public last year alone. Now you answer: “Why do you put any trust in what statements a corp releases?!”
    - gruez 2y ago
      >I trust a leak from someone with no financial gain from the leak. >I do not trust multi nationals worth several million, billion, trillion, to state truth. I expect them to lie until caught by a federal entity and fined. >Guess how many times multi nationals lied to the public last year alone. And what about the leak itself? "You really think someone would do that, just go on the internet and tell lies?" Here's an anonymous "leak" I found that says whatsapp is backdoored and sends your chats to the CCP: https://pastebin.com/uE4m694M https://pastebin.com/uE4m694M . Are you going to believe it? If asked for comment, Meta is probably going to deny it, but obviously they're going to be lying for the reasons you mentioned. >Now you answer: “Why do you put any trust in what statements a corp releases?!” "Trust" isn't binary, it's a spectrum. I don't put much trust in corp releases, but I still trust them far more than an unverified source. Even if you put zero weight on "statements a corp releases", you can inspect the AOSP source code yourself and see that it shouldn't be possible for apps to steal your location data when it doesn't have location permissions, and therefore a list claiming that such apps are stealing your location data should be treated with extreme skepticism.
  - nonrandomstring 2y ago
    > Why do you trust an unverified "leak" over statements made by multi-billion dollar multinationals? Less incentives to lie. Edit: I had a think, and what I picked up on was the idea that sheer concentration of money might stand in as a signal for trust, and so whether somone with more money would naturally be more honest or dishonest than someone with less, is really more of an interesting question.
- braiamp 2y ago
  Is not whenever they deny it or not, your device can attest to it. Both Google and Apple have no qualms screwing up with third parties in their apps. Also, apps have been datamined up the wazoo, if a company claims not to do something and does it, someone would have already howled about it.
d1sxeyes 2y ago
This is a bit of an incorrect read on what this leak is. Gravy gathers location data about people from multiple sources but not directly from consumers. Gravy’s customers buy this data. As far as I understand, this is a list of locations and apps used by a person, but without much context. A typical response to this has been something like this: > Grindr has never worked with or provided data to Gravy Analytics. We do not share data with data aggregators or brokers and have not shared geolocation with ad partners for many years. Transparency is at the core of our privacy program, therefore the third parties and service providers we work with are listed here on our website. Note how carefully written this is to imply they don’t share any data at all, but they stop short of saying “we don’t share any data with ad partners”, just geolocation data. But for companies like Gravy, their whole business is about getting data. So it’s not at all implausible (or even unlikely) that this represents an event where a user opened Grindr (conceivably sold to Gravy by one of Grindr’s ad partners following an impression), and the same individual’s location was determined by some other method (for example, IP address geolookup, or bought from a company which IS supplying data to Gravy directly and has location permissions). Take the leak with a grain of salt, sure, but it’s looking reasonably genuine to me.
- kmeisthax 2y ago
  > We (...) have not shared geolocation data with ad partners for many years Mobile operating systems don't have good (if any) support for opening things in subprocesses with restricted permissions from the rest of the app. So if Grindr loads an ad, that ad runs with Grindr's permissions. Same for any analytics code that ad uses. So if Grindr gets geolocation, even temporarily, so does every ad partner they have, whether they like it or not. And the thing is, ads are a bottomless pit of third-party JavaScript. Nobody trusts nobody in the ad space, so everyone wants their own trackers doing their own client-side data collection. So Grindr doesn't have to know anything about Gravy Analytics, they just have to have an ad partner decide to use them and bam, they're compromised.
  - gruez 2y ago
    >Mobile operating systems don't have good (if any) support for opening things in subprocesses with restricted permissions from the rest of the app. [...] >And the thing is, ads are a bottomless pit of third-party JavaScript. [...] If it's actually javascript, attempting to grab location would result in a weird location prompt[1] that shows even if you granted the app location permission. It's still conceivable for a random SDK to go rogue and exfiltrate location data, but it's unlikely that an ad in a webview would be able to. [1] https://stackoverflow.com/questions/39665367/how-to-prevent-wkwebview-to-repeatedly-ask-for-permission-to-access-location https://stackoverflow.com/questions/39665367/how-to-prevent-...