23 ms·

Everyone knows your location: tracking myself down through in-app ads

• ta988 2y ago
  Shame on all of the people working on those systems. Legit companies trying to make the world better struggle to find competent people.
  • dylan604 2y ago
    Ugh. Eye roll on the whole “make the world better”. So few SV products remotely make the world better. The purpose of the vast majority is to make money at all costs. I also disagree with what most people claim is making the world better. All in all, I think social media is a net negative for the world for any good that might be found. Every SV thing after that is just chasing the recketship to the moon dream.
    • RajT88 2y ago
      I believe this was parodied multiple times in season 1 of Silicon Valley.
      • dylan604 2y ago
        That scene in the pilot with the way over enthusiastic founder on stage with Kid Rock was pretty much when I knew I would <3 that show
      • nicbou 2y ago
        Direct link to the scene: https://www.youtube.com/watch?v=B8C5sjjhsso https://www.youtube.com/watch?v=B8C5sjjhsso
      • spencerflem 2y ago
        One of my favorite seasons of TV <3
    • unification_fan 2y ago
      > So few SV products remotely make the world better Because devs have to eat in order to survive?
      • 9283409232 2y ago
        You don't need to work on adtech or work at Meta to survive. Don't pretend that it has nothing to do with the lavish salaries.
      • dylan604 2y ago
        Right, because SV is epitomized for the struggling dev as much as Haight Ashbury is known for struggling artists.
      • layer8 2y ago
        Ah, yes, the profession that most struggles to make ends meet.
  • quacked 2y ago
    I think a big part of the ability of these shady companies pulling the brightest minds away from more clearly beneficial fields is that important flavors of ideology necessary to motivate people to take less lucrative work have been stripped from "business". There's a lot fewer appeals to art, history, cultural stewardship, or empire-building present in things like transportation, medicine, construction, etc. than there were in the past. Any flavor of "for the glory of God/the nation/the People/the Art" etc. is pretty effectively stripped out of American business, and I think that's the only kind of thing that would motivate someone who could make $250k in Adware to make $100k in something else. People are now very well-trained to look out for their own bottom line, and take jobs accordingly.
    • rolph 2y ago
      i believe there are somewhat fewer practicing freemasons in those places of layte.
    • quantified 2y ago
      Doing things because they increase some non-monetary value has fallen out of fashion for sure. A colleague of mine recently shared, in a group social setting, a sense of disappointment that his daughter was studying to be a doctor. I was, as far as I could tell, the only one to note that there is practical utility to having doctors. But the "be part of our mission" was shown to be hollow over and over too. First and foremost, you as an enployee are making the investors and CEO rich. The mission is usually exploiting the employee, even when it's not exploiting the world. Employees have recognized the real social ethic (money over everything) and are just playing the same game. Which is sad. Ideally the people who see these choices would make alternative choices that will leave their grandchildren better off in the world. It has taken only a generation for the "greed is good" mentality to drop us into this fetid soup.
      • quacked 2y ago
        I think the phrase you called out--"be a part of our mission"--that most corporations (and, mimicking them, government agencies) regurgitate is itself the approach to socialization that causes people to feel less inclined to work for any non-profit reason. "Part of OUR mission" redefines the company as the entity to be loyal to, rather than casting the company as part of society itself. You can't replace constructs that tend to inspire people to heroism and selflessness with a corporate avatar and expect the fabric of society to remain similarly motivated. It does make a set few people a hell of a lot of money in the short term, though.
  • 9283409232 2y ago
    What companies?
    • throwaway847739 2y ago
      I have the same question. It did not seem easy for me to find a job where we are at least not writing malware (according to my judgement). But it's far from making the world better :|
    • yread 2y ago
      I work in cancer research. Some companies are there just for greed as well but at least the end product could be helpful
  • deleted 2y ago
    [deleted]
• Yeul 2y ago
  I read an interesting newspaper article about how the police confiscated a hired gun's iPhone and found that he ran a search on the city his victim lived in. It is these little digital breadcrumbs that makes life easy for the prosecution. Seriously if you are going to do illegal things never ever buy a smartphone.
  • gruez 2y ago
    >the police confiscated a hired gun's iPhone and found that he ran a search on the city his victim lived in. It's far more likely they just looked at his browser history rather than doing some skullduggery with databrokers or whatever.
• HelloUsername 2y ago
  Related? NSA Warns iPhone and Android Users–Disable Location Tracking https://news.ycombinator.com/item?id=42713536 https://news.ycombinator.com/item?id=42713536 Hackers Claim Breach of Location Data Giant, Threaten to Leak Data https://news.ycombinator.com/item?id=42627336 https://news.ycombinator.com/item?id=42627336
  • deleted 2y ago
    [deleted]
  • apples_oranges 2y ago
    Logged in to upvote this
  • dylan604 2y ago
    It’s funny how in recent headlines the NSA & FBI have been saying to use secure messaging app. Yet the FBI is infamous for claiming the need for back doors into these encrypted apps. What are we to think of the opposing views? Are they really being benevolent for the citizens, or do they no longer need the back door, or do they have a back door whether intentional or not?
    • not2b 2y ago
      It seems that they have changed their minds about surveillance back doors, after some devastating attacks, where Chinese state actors (among others) used back doors created for compliance with warrants to get in. But that was the pre-Trump NSA and FBI. Now the Chinese and the Russians just need to get some DOGE volunteer to give them whatever they want, since Elon now has root on all the government payment systems and is too undisciplined to do things in a secure way.
    • nonrandomstring 2y ago
      The world is changing fast and reasons for actions may be more complex and interesting than you assume. Were they ever _not_ benevolent to US citizens as a whole, even if misguided? There may be last-ditch attempts to extend benevolence to US citizens as a takeover looms. If leaks from the Office of Personnel Management are to be believed, then right now US government is in the process of a soft coup, being dismantled along lines of political loyalty. I expect those working in intelligence and law enforcement who support democracy see the writing on the wall and will act sooner or later. Reliable end to end encryption is an important tool for citizens of a nation that may need to organise in a hurry. We might see new Edward Snowden type revelations of programmes, naming key people or giving clear advice not to trust certain US based entities or services. Civil servants may act professionally as non-politically as they can, but in the end, if only to protect their jobs, they're going to come down on the side of democracy.
• monlockandkey 2y ago
  How did were the apps able to collect geolocation even though location services were disabled?
  • baggy_trough 2y ago
    Probably from IP address geolocation.
    • abound 2y ago
      Indeed, the article notes that the lat/long wasn't "GPS exact", more like "postal code exact".
    • xenic 2y ago
      Doing that on the client side sounds pointless though, if you are already transmitting the ip.
      • baggy_trough 2y ago
        It might be for consistency between vendors.
• inahga 2y ago
  There are quite a few interesting tracking flows out there. My rent is paid through a company called Bilt. I discovered that when I shop at Walgreens now, Bilt sends me an email containing the full receipt of what I bought like so: > Hey [inahga], > > You shopped at Walgreens on 12/1/24 and earned Bilt Points with your > Neighborhood Pharmacy benefit. > > Items eligible for rewards > TOSTITOS HINT OF LIME RSTC 11OZ > $3.50 > > +3 pts > TOSTITOS RSTC 12OZ > $3.50 > > +3 pts > Other items* > EXCLUDED ITEMS > $0.07 > > *May include rewards-ineligible items and/or prescriptions. Ostensibly (hopefully) it would exclude sensitive items, plan B, condoms, etc... I'm curious how this data flows from Walgreens to my rent company, but maybe I'd rather not know and just use cash/certified check from now on.
  • andrewfromx 2y ago
    "Bilt Members can earn points on Walgreens purchases made using any card linked to their Bilt account." https://support.biltrewards.com/hc/en-us/articles/29011878427533-Neighborhood-Benefit-Pharmacy https://support.biltrewards.com/hc/en-us/articles/2901187842... There's that FSA/HSA benefit section at the bottom which explicitly states that Bilt receives item-level data: https://www.biltrewards.com/terms/walgreens https://www.biltrewards.com/terms/walgreens
    • gruez 2y ago
      That just sounds like a standard cross-merchant loyalty program? I don't think there are many examples in the US, but once you realize it's a loyalty program you really shouldn't be surprised that they're tracking your purchase history. That's basically the entire premise.
      • mistrial9 2y ago
        > it's a loyalty program calling something loyalty does not make it "loyalty" ..
        • gruez 2y ago
• psanford 2y ago
  Don't use mobile apps that could just be websites.
  • dylan604 2y ago
    Extended to add don’t use websites without blockers. If they are willing to track via app, why would we think they would not track via browser?
    • nicbou 2y ago
      The browser has less access to your system, and usually only if you give a specific website permission to use these features. Mobile operating systems are slowly changing that though.
      • scarface_74 2y ago
        Have you looked at the latest JS standards?
        • amatecha 2y ago
          (and if you haven't... check out the APIs available to the developers/owners of all the websites you browse: https://developer.mozilla.org/en-US/docs/Web/API https://developer.mozilla.org/en-US/docs/Web/API )
          • hollowturtle 2y ago
            what should imply checking available web apis? the comments is correct, browser can't access your location without explicit confirmation from the user, the same apply for other web apis, or at least mention a bunch of them which you know don't apply instead of linkin MDN
            • amatecha 2y ago
              The more APIs available for JS to interact with, the more granular and detailed browser fingerprinting can be. For example, how your browser renders WebGL can differ depending on what graphics card (and drivers) you have. The resulting values can be read back and stored to create a detailed fingerprint of who you are -- this could potentially be done by Google Fonts or AdSense or any number of the countless ad and analytics frameworks loaded on basically all websites. Good overview about how fingerprinting works: https://www.privacyaffairs.com/browser-fingerprinting/ https://www.privacyaffairs.com/browser-fingerprinting/ Browse the source in the following directory to see a plethora of examples of how web APIs are used to fingerprint users -- and this is just one publicly-accessible library we can easily review the source code of (proprietary, obfuscated ones likely use additional methods): https://github.com/fingerprintjs/fingerprintjs/tree/master/src/sources https://github.com/fingerprintjs/fingerprintjs/tree/master/s... One example used in multiple places in the above repo is "matchMedia"[0] which was a Web API method added a while ago (well, many years ago) to give a programmatic result of whether a given CSS media query matches or not. This can be used to detect, for example, user preferences like whether the display is HDR-capable[1], or the Accessibility setting "reduce motion" is enabled[2]. [0] https://developer.mozilla.org/en-US/docs/Web/API/Window/matchMedia https://developer.mozilla.org/en-US/docs/Web/API/Window/matc... [1] https://github.com/fingerprintjs/fingerprintjs/blob/master/src/sources/hdr.ts https://github.com/fingerprintjs/fingerprintjs/blob/master/s... [2] https://github.com/fingerprintjs/fingerprintjs/blob/master/src/sources/reduced_motion.ts https://github.com/fingerprintjs/fingerprintjs/blob/master/s...
• gruez 2y ago
  >If it was LTE, I bet the lat/lon would be much more precise. False. Apps don't have access to cellid information unless they also have location permissions, in which case they can just request your location directly. >the free apps you install and use collect your precise location with timestamp [...] This is alarmist and contradictory given that the author admits a few paragraphs up that the "location shared was not very precise". It might be possible for the app to request precise location via location services, but the app doesn't request such permissions (at least on android, you can't check for requested permissions on iOS without installing the app and running it), so such apps are most definitely limited to "not very precise" locations. >At the same time, there is so much data in the requests that I'd expect ad exchanges to find some loophole ID that would allow cross-app tracking without the need for IDFA. At least in theory they're not supposed to do that, but it'd be hard to enforce. "If a user resets the Advertising Identifier, then You agree not to combine, correlate, link or otherwise associate, either directly or indirectly, the prior Advertising Identifier and any derived information with the reset Advertising Identifier. " https://developer.apple.com/support/terms/apple-developer-program-license-agreement/ https://developer.apple.com/support/terms/apple-developer-pr...
  • anon7000 2y ago
    Eh. Zip code level location + timestamp is still pretty invasive, even if, pedantically, that’s not very precise. We should compare if there a differences in the data sent in countries with better data privacy laws.
    • eli 2y ago
      "Precise" has a specific meaning for iOS Location Services and this ain't it. Presumably it's just doing IP geolocation which could be the same post code, or it could be the wrong city entirely. I'd expect it to be much worse on LTE than WiFi.
    • gruez 2y ago
      >Eh. Zip code level location + timestamp is still pretty invasive, even if, pedantically, that’s not very precise. That's basically sent to multiple parties (ISPs, transit providers, CDNs, analytics/advertising/diagnostics/security vendors) everytime you visit a website. If this counts as "invasive" to you, you shouldn't be connected to the internet at all, much less buying a tracking device (a smartphone) and installing random ad-supported apps on it.
• jmward01 2y ago
  A long time ago I had the idea to create an 'accountability server'. The high level idea was for it to generate unique credentials so that you could track to the source who sold your info. There are some ways to do that now, but I wonder if it is time to start exploring that idea again. If you exposed it as a VPN/proxy+app that ran on a server in your home, so that you could collect your own data and provide unique credentials on account creation, then I wonder how much that combination could figure out. Since it could act as a man in the middle it potentially could annotate credential source and see the ads and potentially track them to source. "This male enhancement pill ad is linked to your tire purchase." There is a lot of hand waving here, but I wonder if something like this could be built. The first step to stopping things like this is showing people who did it to them.
  • gruez 2y ago
    Wouldn't this require access to bid side data? The OP mentions it's pretty easy to get, but any company using this to expose advertisers is going to get their access cut off pretty fast. As the saying goes, "snitches get stitches".
    • jmward01 2y ago
      My thought here is that there is likely a lot of leaked data on ads themselves, that is one of the reasons why you would need the VPN/proxy. Additionally you could (potentially) create fake browser fingerprint credentials on the fly to feed sites and have the VPN/proxy track the ads that show up for those credentials. (other credentials like email and the like could also be created by the app for you) You don't see the bid data, but you may be able to control the tracking that spurs it and you can see the results of it so a setup like this could likely make some inferences. I don't know this industry well and the tech here has long sense eclipsed me so I really don't know what is possible but I imagine there are possibilities with this setup.
  • aorloff 2y ago
    There's no question about who the players involved are. https://developers.google.com/authorized-buyers/rtb/openrtb-guide https://developers.google.com/authorized-buyers/rtb/openrtb-...
• jiri 2y ago
  What does happen if I turn off location/gps? I guess that location has to be quite imprecise.
  • spencerflem 2y ago
    Stores have WiFi hotspots with very short range to track you that way while you're in the isle.
    • daneel_w 2y ago
      Only if you don't turn WiFi off. To my understanding even the "soft off" option present in iOS stops the phone from beaconing, and just listens in order to collect data for building augmented location services. I don't know what the Androids do. These days both of them also offer randomized MAC address to curtail such tracking.
      • spencerflem 2y ago
        right, they were saying it's enough just to turn off location though. tho tbh if i really cared, no phone/battery out/faraday cage is still the gold standard
  • elmomle 2y ago
    With GPS off, location can triangulated from cell tower usage to within 3/4 of a square mile (smaller uncertainty in urban areas where cell towers are closer together). I'd heard before that some data brokers do this, but in this article the writer mentions reverse DNS lookup on IP addresses, which they mention is less precise (ZIP-code level).
    • spencerflem 2y ago
      5G is far more precise as well
    • adrr 2y ago
      It’s not that accurate. E911 location was a few miles off.
• password4321 2y ago
  Is WiFi access point geolocation by SSID or MAC address? Do mobile OS's require additional permissions for apps to get either of these data points?
  • gruez 2y ago
    >Do mobile OS's require additional permissions for apps to get either of these data points? Yes on both iOS and Android as far as I can remember.
    • Aachen 2y ago
      Android for sure, since version 8 I'm certain but probably even 5 or 4.x (so 10+ years ago) Always annoys me when I want to use a WiFi scanner to determine the range of an access point in different locations for example and it needs me to turn on location access first before it can get WiFi data. The open source app doesn't have an Internet connection so there's no way for it to send back data to the mothership even if it had an SSID database baked into the apk. For me, and traditionally, the location switch is to turn on or off energy-hungry GPS hardware, not gatekeep when I trust apps to collect my location. I can set those to "only while in use", deny their Internet access, or just not install them if I don't trust them with the location permission
  • radicality 2y ago
    iOS definitely requires Precise location permission allowed for the app to see your WiFi name / ssid and other WiFi around you
    • matthewdgreen 2y ago
      But all it takes is one app with that permission to tie you to all the others. And there are always apps that need your location at some point to provide useful data. At this point I’m not sure there’s any single app I trust.
      • ignoramous 2y ago
• theptip 2y ago
  > Why do they need to know my screen brightness, memory amount, current volume and if I'm wearing headphones? This is clearly adding entropy to de-anonymize users between apps, rather than to add specificity to ad bids.
  • gruez 2y ago
    Everything listed changes way too often to be useful for tracking. My guess is that it's for anti-fraud purposes. Someone setting up fake devices and/or device farms is likely to get similar values, which means they can be detected via ML or whatever.
    • Groxx 2y ago
      > screen brightness, memory amount, current volume and if I'm wearing headphones None of those are likely to change when you navigate from one website to another, with tracking/ads disabled, which is what they want to be able to track. Otherwise they'd just use their cookies. One device visits a site where you sell ads. A minute later, an unknown device with identical battery, volume, headphone, brightness, model number, browser version, and boot time to the second arrives on another site you run ads on. There's a pretty good chance they're related, because the odds of all those being the same plus those two sites and recent timings involved is rather low: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ Plus it doesn't have to be perfect. It just has to be good enough in bulk to sell.
  • jmward01 2y ago
    It would be amazing if you could build and send fake profiles of this information to create fake browser fingerprints and help track the trackers. Similarly, creating a lot of random noise here may help hide the true signal, or at least make their job a lot harder.
    • nickburns 2y ago
      Unfortunately fingerprinting prevention/resistance tactics become a readily identifiable signal unto themselves. I.e., the 'random noise' becomes fingerprintable if not widely utilized. Everyone would need to be generating the same 'random noise' for any such tactics to be truly effective.
• ksec 2y ago
  May be Steve Jobs was right all along. We dont need Smartphone with App Store. Either 1st Party Apps and Everything else should be on Browser or Apps that uses Browser Engine.
  • voytec 2y ago
    What? [0] [0] Steve Jobs introduces App Store - https://www.youtube.com/watch?v=eU3X6Fu5JiE https://www.youtube.com/watch?v=eU3X6Fu5JiE
    • collinvandyck76 2y ago
      Probably referring to Jobs' initial stance that HTML5 is more than sufficient for "apps". Of course, he acquiesced and eventually added the App Store.
  • deleted 2y ago
    [deleted]
  • nabaraz 2y ago
    Steve jobs embraced web apps as much as he could.[0]. But people weren't willing to give up desktop apps. [0] https://web.archive.org/web/20070809174426/http://www.apple.com/pr/library/2007/06/11iphone.html?sr=hotnews.rss https://web.archive.org/web/20070809174426/http://www.apple....
  • RedComet 2y ago
    Websites tend to have more ads and tracking than native apps, and they're still getting your ip address.
• amelius 2y ago
  > was shocked by the amount and types of data sent with the bids to ad exchanges. Can this data fall into the hands of "evil" state actors, and why is Congress OK with that and not with tiktok?
  • noonething 2y ago
    yes and China/make money.
  • eli 2y ago
    Blaming China is easy and has bipartisan appeal while actual data privacy regulations are hard and do not.
  • Argonaut998 2y ago
    Are the police evil state actors? They purchase location data from private companies to target protesters[1] [1]https://www.eff.org/deeplinks/2022/08/how-law-enforcement-around-country-buys-cell-phone-location-data-wholesale https://www.eff.org/deeplinks/2022/08/how-law-enforcement-ar...
  • pas 2y ago
    Congress is pretty ok with whatever Trump says, we have always been at war/peace with TikTokia.
  • coldpie 2y ago
    Zuck's lobbyists pay better than China's.
• noman-land 2y ago
  This is honestly a masterpiece.
• TZubiri 2y ago
  That you can get an approximate address based on an IP address is not very new, and is in fact a feature baked into the very IP protocol.
• motohagiography 2y ago
  great writeup. keep forensic faraday bags around.
• deleted 2y ago
  [deleted]
• sureglymop 2y ago
  A while ago a co worker told me "why would you care about your privacy? all my data is already out there anyway and what can even be done with it anyway". What would be the ideal response to such an absurd comment? At the time I found it hard to answer because she surprised me with that opinion. Edit to note: the explanation should be compatible with a professional context. I don't want to scare my co workers or appear crazy/paranoid.
  • deleted 2y ago
    [deleted]
  • noman-land 2y ago
    Seriously, anyone who ever says they have nothing to hide, show them this story. "A Redding Police Department officer in 2021 was charged with six misdemeanors after being accused of accessing CLETS to set up a traffic stop for his fiancée's ex-husband, resulting in the man's car being towed and impounded, the local outlet A News Cafe reported. Court records show the officer was fired, but he was ultimately acquitted by a jury in the criminal case. He now works for a different police department 30 miles away." California Law Enforcement Misused State Databases More Than 7,000 Times in 2023 https://www.eff.org/deeplinks/2025/01/california-police-misused-state-databases-more-7000-times-2023 https://www.eff.org/deeplinks/2025/01/california-police-misu...
  • gvkoo 2y ago
    There are a few examples I use when I hear such ignorant statements: 1. Not caring about privacy cuz you’ve got nothing to hide is like saying you don’t care about freedom of speech cuz you’ve got nothing to say. 2. If you don’t care about privacy, why don’t you poop with an open door, for everyone to observe?
    • fragmede 2y ago
      Because I don't want to rest of the house to smell? A different argument that appeals to some is that you might not have something to hide, but what about the people who do? For the greater good of society, whistleblowers are needed to expose malfeasance by the corrupt and it's going to make it much harder for any of them to come forwards if their reward is literally exile to Russia. If you're in support of a slow slide into dystopia, go ahead and argue against all privacy. Whether a given situation rises to that level is an different but adjacent topic, but appealing to something some people can believe in, such as not letting the rich and powerful get away with being utterly corrupt in their dealings is a way to find common ground, with some. not everyone cares about that though, but it's an additional argument for privacy.
• volume 2y ago
  neat details shared, might check out later. Does this apply to Brave browser?
• sunnybeetroot 2y ago
  Whilst I trust that the author did in fact look at the data of each request eventually, the screenshot they provided of Charles could not have been of the exact requests they intercepted given Charles is indicating that those are not yet SSL proxied (except for the 2 GET requests). EDIT: please ignore, author did it differently to what I expected.
  • timsh 2y ago
    I decrypted them all by installing Charles SSL cert on the iphone. This is why the requests seem not SSL proxied.
    • sunnybeetroot 2y ago
      My apologies, thank you for clarifying and thank you for the brilliant article. Have updated my comment.
    • wkat4242 2y ago
      This technique doesn't work anymore on android because you can no longer add certificates to the system store and apps are free to choose to accept the user store CAs or not. That was changed in Android 7. For "security" they say. Security of Googles business model I'm sure.
• everdrive 2y ago
  I'm really happy to see this level of detail and research. So many privacy-related articles either wholly lack in technical skill, or hysterically cannot differentiate between different levels of privacy concerns and risks. People commonly point to Mozilla's research regarding vehicle's privacy policies. (https://foundation.mozilla.org/en/blog/privacy-nightmare-on-wheels-every-car-brand-reviewed-by-mozilla-including-ford-volkswagen-and-toyota-flunks-privacy-test/ https://foundation.mozilla.org/en/blog/privacy-nightmare-on-...) But that research only states what the car company's lawyers felt they must include in their privacy policies. These policies imply (and I'm sure, correctly imply) that your conversations will be recorded when you're in the vehicle. But, they never drill down into the real technical details. For instance ..... are car companies recording you the whole time and streaming ALL of your audio from ALL of your driving? Are they just recording you at a random samples? Are they ONLY recording you when you're issuing voice commands, and the lawyers are simply hedging their bets regarding what sort of data _might_ come through accidentally during those instances? Once they record you, where is the data stored, and for how long? Is it sent to 3rd parties, etc? Which of these systems can be disabled, and via what means? Does disabling these systems disable any other functionality of the vehicle, or void its warranty? Lastly, does your insurance shoot up if you have a car without one of these systems? etc ... The list of questions could go almost indefinitely, and presumably, would vary strongly across manufacturers. So much of the privacy news out there is nothing but scary and often not very substantiated worst case scenarios. Without the details and means to improve privacy, all these stories can do is spread cynicism. I'm really glad to see this level of discourse for the author.
  • jjeaff 2y ago
    I'll answer the, "Does disabling it void your warranty?" question. The answer is almost always "no". Unless the modification you make to something actually directly or indirectly caused damage to it, companies in the US cannot "void the warranty".
    • lesuorac 2y ago
      I'm sure the company will argue the warranty is voided akin to how trucks have "not liable for damage from rocks" or w/e (they are). IIRC, this is under the Magnuson-Moss act but I didn't find it when skimming wikipedia. https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty...
• lilsoso 2y ago
  Would be interesting to know how much data leaks on a new iPhone with some of the iOS privacy settings enabled and a handful of popular apps installed (WhatsApp, Instagram, Google Maps, Uber, etc). And then if you use a commercial VPN with DNS ad-blocking enabled, how much more does this help?
  • ignoramous 2y ago
    Going by TFA, not much.
• diimdeep 2y ago
  All these companies operate from within USA jurisdiction, that should send the world clear message. Snowden in one of interviews talks about exactly this kind of tracking with Amazon example (ts 01:18:00) https://x.com/JohnStossel/status/1885382675810181612 https://x.com/JohnStossel/status/1885382675810181612 Basically, all these companies, ad networks, data brokers, big tech with absence of basic privacy laws (not to be confused with 4th amendment that binds Fed and State gov only, but does not restraint companies) act with wilful conspiracy with US government regulators, washing each other hand like a monopoly. This data gets enriched and collided and is perpetually on a permanent record. https://en.wikipedia.org/wiki/Permanent_Record_(autobiography) https://en.wikipedia.org/wiki/Permanent_Record_(autobiograph... So next time you talk about totalitarian regimes around the world look in the window.
• ktimespi 2y ago
  Minor nitpick, but aren't ads sold to the highest bidder?
• AyyEye 2y ago
  > There's no "personal information" here, but honestly this amount of data shared with an arbitrary list of 3rd parties is scary. Why do they need to know my screen brightness, memory amount, current volume and if I'm wearing headphones? Screen brightness, boot time, memory, and network operator could probably fingerprint any device all by itself.
  • maximilianthe1 2y ago
    A lot of people have "autobrightness" on. I'd think brightness doesn't help much here
    • landr0id 2y ago
      Kind of a joke, but it could be useful for determining if they should serve light-mode or dark-mode ads. But I suppose they could just detect if dark/light mode are enabled.
      • saagarjha 2y ago
        Why would you serve dark-mode ads? Clearly you would pick the brightest option all the time.
    • sky2224 2y ago
      Automatic brightness probably helps honestly. It could help confirm whether someone is in fact in an area that has high levels of lighting around them (e.g., in a store, at a beach on a sunny day, etc.) Everything little piece of data that is gathered and used can help even if it isn't immediately apparent. Now I could be wrong on this, but I feel like advertisers don't need to know something is true about a user, they just need to be confident something is true about a user and that's where data points like screen brightness can be of help to them.
• afarah1 2y ago
  NetGuard with DROP OUTBOUND policy once again proves helpful. The only app that shows ads that I have on my phone is a PDF scanner, and I don't allow it internet access.
  • switch007 2y ago
    GrapheneOS also allows you to toggle the Network permission of any app
• timsh 2y ago
  wow @apokryptein thanks for posting my article here... I'm shocked it's #1 rn. if anyone has any questions regarding the post - I'm here to answer & talk!
  • pas 2y ago
    how the MAID/IDfV gets into the PII-ID databases? It seems that part is completely missing. (Or I missed it.) So for example can/do airlines sell it? Or telecom/utility companies, when you use their app?
    • timsh 2y ago
      I don’t know the answer to this, which is why I didn’t mention it in the post. However, I could speculate that these data-broker companies scrape leaked [hacked and stolen] data from various panels and then match records on their end. kinda OSINT for bad reasons.
  • forgingahead 2y ago
    Great article, thanks for taking the time to research and write it all up! Definitely learned some new things from it.
  • kswzzl 2y ago
    [dead]
  • Dhruv_Gheewala 2y ago
    Wow, such a beautiful article you have written. Usually, I’m not into reading much but after very long I’ve completed a full article with such interest. Thanks for it !!
• amarcheschi 2y ago
  Another "funny" thing regarding Microsoft xandr I sent them my uid2 and they still say they can't link to an identity and don't have a match in their database
• lysace 2y ago
  I wonder: to which extent are purchased/brokered app real-time location data feeds used by various intelligence services to target missile strikes in war zones? In e.g. Ukraine/Russia.
  • ActorNightly 2y ago
    The leaked tools that NSA used, like XKEYSCORE, used publicly available data collection methods, including purchasing advertiser lists, to cross correlate all the data and form a profile. So anybody could do this stuff.
    • deleted 2y ago
      [deleted]
  • supertrope 2y ago
    https://taskandpurpose.com/news/russia-ukraine-cell-phones-track-combat/ https://taskandpurpose.com/news/russia-ukraine-cell-phones-t... Not riding off ad geolocation but hijacking a UA app: https://www.crowdstrike.com/wp-content/brochures/FancyBearTracksUkrainianArtillery.pdf https://www.crowdstrike.com/wp-content/brochures/FancyBearTr...
• beders 2y ago
  I'm surprised people think they have any kind of privacy - especially when using free services. They are not free. You pay with whatever data can be extracted from your devices and behavior. Also, there's a looong list of companies who know the location of your mobile device, starting from the cell phone tower operator to Apple/Google and many in between.
  • pas 2y ago
    The article does not explain how PII gets into the databases, and the critical link the IDfV... how do databases connect it to people's name/address? It gets leaked if the app I use gets my name/address, like Uber, right?
  • AlgebraFox 2y ago
    True. But even paid apps have access to these data and can collect it without our knowledge. A genius called Stallman proposed solution decades ago. Free software aka. open source software. But outside of tech community, open source is not a known term. Maybe we should market it wherever possible, if we want true privacy and freedom.
• xyst 2y ago
  Apple’s “privacy protections” are nothing more than marketing. “Ask app not to track” is a wash and privacy theater at best. One of the reasons I still run ad blocking on _all_ websites and at the network layer. Sorry “content creators” but you need to get your revenue from elsewhere (ie, sponsored content). Now I want a phone that scrambles all of this data on a per app (or phone) basis. Malicious app wants this data? Sure you can have it. But you will get randomized values for every bit of information — resolution, lat/lon, brightness, battery level (user can set range of 90-100%), ….
• anurag 2y ago
  I'm a very happy paying customer of NextDNS (https://nextdns.io https://nextdns.io) which blocks known adware and tracking hosts across all mobile and desktop platforms.
  • nickburns 2y ago
    Which does absolutely nothing if your device or the app in question is permitted or otherwise not prevented from making DNS-over-HTTPS (or, less commonly because of its discrete port, DNS-over-TLS) queries.
    • madeofpalk 2y ago
      Don't all the ad-blocking DNS providers also support DNS-over-HTTPS now as well? I use it with AdGuard Home, and I saw PiHole supports it as well.
      • nickburns 2y ago
        I'm referring to devices and apps that are 'hard-coded' to query specific DoH servers/providers, therefore bypassing and regardless of any user-configured DNS server/s. And because DoH operates on outbound TCP/443, the lookups are indistinguishable from any other 'web' traffic. Even some of the most popular desktop web browsers are configured to utilize DoH by default nowadays. The most that a network administrator can do to prevent this is configure firewall IP blocklists of known DoH servers and NAT all outbound 53 (and 853) traffic to a desired resolver (like a local Pi-hole instance, for example).
        • ignoramous 2y ago
          > The most that a network administrator can do to prevent this is configure firewall IP blocklists of known DoH servers ... A firewall (which must also host a resolver) can choose to block requests to IPs it hasn't resolved domain names for. This is something I implemented for an Android firewall app I co-develop; it works nicely enough.
• mdasen 2y ago
  This is a wonderful write up. The part that isn't clear to me is how they're getting the geolocation data if location services are turned off. Are they just going off geo-ip lookups? If you grant access to Bluetooth or finding devices on your local network, they can get more information to track your location. Absent that, how would they get better than geo-ip?
  • secondcoming 2y ago
    https://www.maxmind.com/en/home https://www.maxmind.com/en/home
• petee 2y ago
  They say the leaked list is 2000 apps, but the linked spreadsheet has over 12000... And are these getting pulled from the store due to privacy violations? I'd assume Google would be aware at this point?
• araes 2y ago
  Parts I found relevant: - It was a clean state of a somewhat old phone (iPhone 11, factory defaults + new apple id) - A single (old) app was installed (Stack by KetchApp, 10-12 years old) - Was sending out an update a second pretty much instantly (5 kB - ~300 KB every second) - Within a minute: IP, Lat / Lon, country, phone model, carrier / network operator, vendor, OS version, connection type (wifi), headphone status (?), volume setting (?), screen brightness setting (?), battery status (?), CPU count, system RAM, free RAM allocation, free hard drive capacity, system boot time (?) Might as well just screen grab the Task Manager equivalent and hand it to them. Have better, quicker data about my own current RAM allocation and free hard space than I do. It hands them when the system booted for an ad? The headphone, volume, brightness, and battery was just "what" kind of headshake about invasiveness. Somebody'd hand wave they need it (we want it, we want it). They obviously don't. Edit: It's almost Remote Desktop, on an iPhone. Realtime (~1 Hz) RAM / ROM allocation. Not sure how many Apple user even know how to check their realtime RAM / ROM allocation. The free hard drive space especially is just asking for botnet downloads. Edit: Right, and ... disabling tracking doesn't mean anything because numerous updates blatantly ignore the setting ("uc": "1", // User consent for tracking = True;) and it's just a flag while they still send your vendor specific customer identifier anyways. Really interesting article, and great investigation, just disturbing how much on an effectively clean phone.
  • mschuster91 2y ago
    > The headphone, volume, brightness, and battery was just "what" kind of headshake about invasiveness. Somebody'd hand wave they need it (we want it, we want it). They obviously don't. Well the why the ad industry wants it is clear: fingerprinting and segmentation. Someone consistently low on battery? Push them ads for powerbanks.
    • araes 2y ago
      This is actually part of what I find so wrong about this entire idea. With all this fine granularity, it seems like ads would be incredibly relevant. Specifically about what you need with something that might actually result in a click-through to purchase a product. Especially if they get real-time updates on my hard-drive status and battery state. I don't remember the last time I got an ad that was actually relevant. Pretty sure the last ad that was even clicked on was one of those little windmills that swirls crazily, cause it seemed like it might make a cool lawn ornament. Turned out it was tiny. Years of online purchases, and they don't even suggest stuff I want. It just seems like an excuse.
• qingcharles 2y ago
  One big privacy issue is that there is no sane way to protect your contact details from being sold, regardless of what you do. As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd. And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketplace, find an exec and buy their details for pennies and call them up on their cellphone. (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans)
  • hughesjj 2y ago
    > CashApp terminated my account for this shenanigans Did you call to complain about the termination?
    • qingcharles 2y ago
      What's funny is that the exec I got on the phone was super supportive and helpful and was genuinely amused to hear from me and hear what was happening. He put me in touch with their "Executive Support Team" and it was after this that I guess someone realized they didn't like the route I had taken. I feel somewhat vindicated after this announcement (though it does nothing to bring my account back): https://www.engadget.com/cybersecurity/cfpb-fines-block-175m-over-cash-apps-lax-fraud-controls-210749768.html https://www.engadget.com/cybersecurity/cfpb-fines-block-175m... > Accessing any kind of customer service for Cash App was a challenge, too, according to the CFPB. Block included a customer service number on Cash App cards and in the app's Terms of Service, but calling it would it ultimately lead users to "a pre-recorded message directing consumers to contact customer support through the app."
  • nehal3m 2y ago
    Assuming these marketplaces operate within the bounds of the law, would it break HN’s ToS to post them? I’d be interested in pursuing the same strategy.
    • gruez 2y ago
• z02d 2y ago
  There was a nice talk on the recent Chaos Communication Congress (from Chaos Computer Club): https://media.ccc.de/v/38c3-databroker-files-wie-uns-apps-und-datenhndler-der-massenberwachung-ausliefern https://media.ccc.de/v/38c3-databroker-files-wie-uns-apps-un... (English audio available)
• zzo38computer 2y ago
  Even just to look at the picture near the top (which is also repeated near the bottom), if you do not allow the app to track you that only disables one of the items of the information and not all of them. This is explained later in the document, that it is not explained very well to end users. I agree that it could be explained better. Perhaps, "Allow app to track your activity..." can have a option to display a more elaborate description, explaining that it only affects the Advertising Tracking ID (and what that means) and has no effect on other methods of tracking. And, looking further in the document, we can see there is more. Some of them, such as IP address and timestamp it is reasonable to use for programs that access the internet (although it should be possible for the user to set up a proxy and/or adjust the clock in order to change these things, the server would still use its own timestamp anyways). Available memory also makes sense to be readable (although ideally, the user should be allowed to limit the amount of memory available to specific programs, in order that there is enough memory remaining for other programs; the reported total memory should then include only the memory available to this program and not to all programs), and the same should be true of the number of CPU cores and the amount of available disk space. Others probably should not normally be known by most programs (but some are usefulf or some kind of programs), and even when they are, the operating system ought to allow users to reprogram what information is available and what filters, logging, etc will be used. The presence of wired headphones probably should not be accessible by software, and the redirection should be handled by hardware. Perhaps an exception makes sense if the settings need to be different, e.g. mono vs stereo, although even then, programs should only see those settings (and only if they have audio output), and the user should be allowed to override them due to preferences (e.g. some users might want mono even if connected to external speakers or headphones; on my computer sometimes only one speaker works and sometimes both, so it is useful to me to be able to switch to mono). Furthermore, there is the consideration, if the advertisers/spies are stealing your power and network bandwidth and quota in order to do these things; then, that is theft.
  • ec109685 2y ago
    There is more to it when a user disallows an app to track your activity. From Apple and enforced in their review guidelines: “The app is also not permitted to track your activity using other information that identifies you or your device, like your email address.”
• EveOffline 2y ago
  Very interesting and disturbing research, definitely a wake up call for me. Does anyone know/can anyone recommend me software that can block these sorts of requests from going through? I know of pihole which blocks adds but does it also filter out these sorts of things?
  • ActorNightly 2y ago
    You need to have a wifi only android phone, rooted, no google apps, and uninstall anything that talks to the internet. That includes analyzing network traffic, open ports, and so on. I did this with a Kali Nethunter distro back in the day for "reasons", privacy not being one of them. This makes the phone very hard to use for regular things.
  • daqhris 2y ago
    "no-root firewalls" to control data flows on devices (sorry for not publicly naming my preferred one).
• simonw 2y ago
  Anyone understand why an apparently accurate latitude/longitude showed up in one of those traces despite location services not being enabled for the app in question?
  • withinboredom 2y ago
    Probably Mozilla location services (which I happily block) which does pretty accurate passive location tracking.
  • ec109685 2y ago
    A previous request maybe mapped their IP back to the geo, and that data was used subsequently, maybe?
  • ActorNightly 2y ago
    Phones send out probe requests to get a list of open wifis. If you have a static access point, with a known geo location, software can be running on that point to remember a mac address of the phone from a probe and store it. Thus enabling real time tracking. Im like 60% sure this is how they figured out who the Bomber was in Austin TX.
    • rpigab 2y ago
      This is also why some Chinese apps put everything inside a single app and request every permission there is, then track you through Wifi SSIDs seen by your device.
      • megous 2y ago
        Almost no mobile apps need to know the mac addresses of anything, let alone SSID/BSSID. Why would OS give this info up to some app?
        • rpigab 2y ago
          Apps that have to link hardware via Wifi sometimes do, they take complete control over wifi in order to create a wireless access point and make the device connect to it during setup. I think Nikon camera remote control does this, also Meta Horizon, with Meta Quest VR headset, IIRC. There's also Wifi ranging feature, but it shouldn't need to expose SSIDs to the app, I don't know the API, it should be limited to giving a precise location: https://www.androidheadlines.com/2024/11/android-15-wi-fi-ranging.html https://www.androidheadlines.com/2024/11/android-15-wi-fi-ra...
• krupan 2y ago
  Anyone working on this tech used for tracking people should feel bad.
• OtomotO 2y ago
  No they don't, because: I have location services disabled 99% of the time And I often leave the house without my smartphone (when walking or bicycling), much to the dismay of my better half... I am sorry, I forget!
• pyromaker 2y ago
  I don't think there is a hope when it comes to our privacy and ads and our data being sold - none. Even if I'm somewhat off the grid or low in activities, the indirect way of targeting me still exists, by my family members, friends, people associated with me. I surrender.
  • secondcoming 2y ago
    There is hope. The upcoming US State privacy laws are resulting in IP addresses having the last octet blanked out, and IDFA's zeroed out, at least for SSPs and DSPs. Companies such as Apple and Google will still have this info since they control the OS.
• parkersweb 2y ago
  This makes me wonder - is there not a ‘Little Snitch’ equivalent for iOS?
• BubbleRings 2y ago
  I clicked the link at the beginning of your article, that led to the Google sheet with the list of apps. That list had 12,373 lines, not “over 2,000”, fyi. And while most of the apps looked like small time games that I have never downloaded and would probably not download, I saw included there “Microsoft Office 365”. Interesting.
  • timsh 2y ago
    agreed, however there are duplicates in that list + same app for ios / android. if I’m not mistaking I did a simple unique count on it (or catch the 2000 number from 404media post)
  • thadk 2y ago
    Here's my messy list of all the apps I recognized in that Google Sheet: meetup, tinder, crunchyroll zynga/wordswithfriends, Microsoft Outlook com.microsoft.office.outlook, Weather channel, Microsoft 365 (Office) com.microsoft.office.officehubrow Opera Mini browser beta com.opera.mini.native.beta, BuzzFeed - Quizzes & News com.buzzfeed.android Tetris® Block Puzzle com.playstudios.tetris4 Sonic the Hedgehog™ Classic com.sega.sonic1px Grindr Flipboard: The Social Magazine Flightradar24 | Flight Tracker Bejeweled Blitz com.ea.BejeweledBlitz_row FarmVille 3 – Farm Animals Plants vs Zombies™ 2 com.ea.game.pvz2_row SimCity BuildIt 913292932 Tetris® 1491074310 Opera Mini: Fast Web Browser com.opera.mini.native TuneIn Radio: Music & Sports 418987775 Yahoo Mail – Organized Email com.yahoo.mobile.client.android.mail Angry Birds 2 com.rovio.baba Skip-Bo 1538912205 CamScanner - PDF Scanner App com.intsig.camscanner Rakuten Viber Messenger com.viber.voip Candy Crush Saga 553834731
• LegitShady 2y ago
  most of the modern internet just seems to be the greatest inescapable surveillance system in all of human history.
• bvrlt 2y ago
  How is the MAID <> IDFA link constructed?
  • timsh 2y ago
    MAID = IDFA on ios + GAID on Android [https://www.start.io/glossary/mobile-ad-id-maid/ https://www.start.io/glossary/mobile-ad-id-maid/]
    • fmkamchatka 2y ago
      I think he meant MAID <> PII
• atum47 2y ago
  Reddit app has no permissions on my phone, but the feed suggests communities based on my location never the less. I've been traveling for the last two months, every city I've been has been suggested
  • scarface_74 2y ago
    It’s just an IP look up. I travel a lot and you can tell where certain podcast episodes were downloaded based on dynamic ad insertion
  • nedt 2y ago
    Just check https://ipinfo.io/ https://ipinfo.io/ to see how close your IP points to your location. For most targeted content the city is good enough. And honestly if I'm one of 1 million people it's ok.
• aucisson_masque 2y ago
  I paid for pcapdroid, it's a network monitoring app that use the vpn protocol on Android to monitor every packet sent, register which app made the request, to whom, dates and so on. In it's paid feature, you can select app to block internet connection or you can select country, ip and host. After browsing my internet logs, it shocked me to see some app I had absolutely no idea were spying so much. Xiaomi home ? Yeah I knew Xiaomi app would be spyware. But Spotify for instance, how could I guess it sends every few hours data to remote server including Facebook ones. Until I find replacement for Spotify, but most music streaming app do spy on its user (and I don't mean just learning what music you like), I can still block all the graph.facebook.com tracking.eu.miui.com Google ads.gdoubleclick.net and so on. It's open source but firewall is paid feature, i highly recommend it if you're on Android. https://f-droid.org/fr/packages/com.emanuelef.remote_capture/ https://f-droid.org/fr/packages/com.emanuelef.remote_capture... There is even the possibility to decrypt packet and analyze them although it require root, i did it on another phone and yeah it's similar to what the author found. Every single bit of data, ip adress, since how long the phone is on, the wifi connections, when did I unlock the phone and so on. Every data taken individually is not important to me but this stream of little data constantly going God knows where is creepy as fuck.
  • adeon 2y ago
    If you have the equipment (e.g. a spare Linux computer and WiFi router) and know-how, you can set up something like mitmproxy (looks very similar feature set to the Android App, but likely requires more effort to set up) to your home network. That's what I did some weeks ago, and then basically the same exercise you did (just my whole network instead of just phone), looking what's going on. And yeah...it's not good. Even if I trust some companies to be trustworthy, I can't possibly vet a gazillion entities getting telemetry requests, and not all of them can have their shit together, security, privacy or ethics-wise. It made me ditch some Microsoft software, but overall escaping spying feels like a lost battle, unless you go do spartan Richard Stallman-like computing (IIRC he had pretty hardcore stance over the software he'll use).
    • aucisson_masque 2y ago
• itissid 2y ago
  I think one thing people are discussing a lot here about Privacy around contacts and sharing. Limiting access to contacts , completely or partially, is the wrong way to design such systems. There are two problems with this approach: 1. Having permission to contacts is NOT a capability. Running a function on it that is by design not leak PII is infinitely more valuable and a capability. 2. Asking users to grant permission is broken by design: You are giving a very bad multiple choice to the user: `(a)Creepy? (b). LessCreepy (c). Don't Use App` Instead if we only granted operation rights and hid the actual information instead it would be so much better. We need a separation of data from the function to empower apps to give better choices to users.
• mickgardner 2y ago
  I find it fascinating reading hacker news, full of IT folk who simultaneously build software that enables and profits from the advertising and personal information selling & tracking industry - are also the same people who complain the loudest about it. Unbelievable.
  • deleted 2y ago
    [deleted]
  • wkat4242 2y ago
    Probably because people like us have more visibility on the huge scope and consequences of this kind of privacy invasion. Most people don't actually see this with their own eyes. They probably know it's happening in the back of their heads but it's not 'real' to them. It's very real when you know you could technically run a report of all your users that also have grindr installed. I'm sure most of us would prefer not to work somewhere that does it but we need to eat too.. And we have no input in this. For example recently I was given a presentation on a new IoT product at work. Immediately I asked why we're not supporting open standards stuff like matter as a protocol. And I was told that'll never fly with marketing because they want to have all the customers to have eyes on their app for their 'metrics' and upselling. I told them fine but I'm definitely not using this crap myself. But it was shrugged off. We are too few for them to care about. And it makes us very unpopular in the company too. So it's a risky thing to do that doesn't help anyway. The "don't fight them but join them and change from within" idea is a fallacy.
  • Capricorn2481 2y ago
    That seems like trying to tie two separate groups together. Most people are not working on software remotely adjacent to this.
  • conductr 2y ago
    There’s no code of conduct or rule book that anyone should follow so ethics is determined at the individual level. That quickly turns to, either I build it for them or the next guy will. Resistance is futile type thing. Most other types of engineering have published rules and standards and industry credentialing including ethics tied into it and loss of credentials for an ethics violation would be career ending in many cases.
• throwaway_2898 2y ago
  Posting here from an anonymized account about Meta. No one probably recalls that meta stopped most of their background location services(Remember Nearby Friends) on the main application ~2021-2022[1]. It was just not even worth a repeat NYT story with this much money on infra to collect locations. But, this is basically after they figured how to do "good enough" location targetting using IP and a bunch of this info this guy talked about. You don't actually need a lat, long, just the 1 mile radius/city area is good enough to run ads and they have ALL of that. This was why meta's revenue dropped so much after apple's move, they could not fall back to collecting precise location. This is the last game in town. You shut this down, meta's precise targetting will suffer gravely, ads will become flakey. One last thing. You may ask, who are the businesses that need precise lat longs? are like this one[2]. These businesses are like whack-a-mole. They saturate the app market steal data get money and shit down when someone yells and in a few months and comeback again, rebranded and come back as another app. They exist not just to collect data but to act as an arbiter on who get eyeballs on IRL activities to influence behavior at the (Top of the funnel) TOFu. In the Worst. Possible. Way. [1] https://techcrunch.co/2022/05/09/facebook-to-shutter-its-nearby-friends-service-having-lost-the-friend-finding-market/ https://techcrunch.co/2022/05/09/facebook-to-shutter-its-nea... [2] https://www.joinpogo.com/ https://www.joinpogo.com/
• itissid 2y ago
  does incogni work to erase your data and prevent these SSP/DSPs from never collecting your data?
• jetbalsa 2y ago
  I was just screwing around today with data like this. I was making it to have as a exhibit at a up coming event at my university https://bsky.app/profile/balsa.info/post/3lh7z776lbk2w https://bsky.app/profile/balsa.info/post/3lh7z776lbk2w You connect to a special WiFi SSID and compares your traffic to known tracking/ad domains (Pi-Hole Lists mostly) and the "food" is the packets being sent to those servers. its crude and has some high false positive rates, but it does have a chilling effect for me when exploring what data is going where
• sjtgraham 2y ago
  > There's no "personal information" here, but honestly this amount of data shared with an arbitrary list of 3rd parties is scary. Why do they need to know my screen brightness, memory amount, current volume and if I'm wearing headphones? > I know the "right" answer - to help companies target their audience better! For example, if you're promoting a mobile app that is 1 GB of size, and the user only has 500 MB of space left - don't show him the ad, right? Author jumps to the incorrect conclusion here. The answer is fingerprinting.
  • timsh 2y ago
    The “right” answer is not the one I end up with but rather the version sold by the vendor. this is what Apple and Google would say.
    • j16sdiz 2y ago
      I think they are pretty clear if you read the documentation. Accessing to the exact value of these always need some privacy-related privilege on ios and android. Without those privilege, all you can get is an approximate.
  • natdempk 2y ago
    Yeah my mind also immediately jumped to fingerprinting. Somewhat required for anti-fraud to some extent, but also obviously used for more than that.
  • debugnik 2y ago
    The mention of a "right" answer, quotes and all, makes it clear they understand this argument is a farce, doesn't it?
• adeon 2y ago
  Starting earlier this year I've set up a mitmproxy a lot on my entire home network, and often have it on for all traffic at times. I put up an old NAS and I'm abusing it as a mitmproxy tool for my home. There would be so much to write about what I've seen. I've thought of making a blog post. I use mitmproxy to check on sketchy apps and to learn in general. The information sent out is fascinating. I knew extensive telemetry is pretty norm these days, but it's another thing to see it with your own eyes. My exercise has also made the typical "yes, we collect data/telemetry, but it's deanonymized/secured/etc. and deleted after X days so no worries" sound very hollow; even if a company goes in good faith by their own rules, how am I supposed to trust the other 1000 companies who also do data collection. If someone hacked my mitmproxy itself and downloaded all the payloads it collected, they would probably know me better than I do. Random examples on top of my head from mitmproxy (when I say "chatty" I mean they talk a lot to server somewhere): I had GitHub CoPilot neovim plugin. I didn't realize how chatty it was until I did this (although I wasn't surprised either, obviously completions are sent out to a server, but it also has your usual telemetry+AB test experiment stuff). I had wanted to ditch that service for a long time so I finally did it after seeing with a local setup since open stuff has mostly caught up. Also it's not actually open source I think? I had no idea (I thought it would just be a simple wrapper to call into some APIs, but: no PRs, no issues, code has blobs of .wasm and .node: https://github.com/github/copilot.vim https://github.com/github/copilot.vim) Firefox telemetry, if it's turned on, is a bit concerningly detailed to me. I think I might be completely identifiable on some of the payloads if someone decided to really take a go at analyzing the payloads I send. Also I find it funny that one of the JSON fields says "telemetry is off". Telemetry is actually on on the menu (I leave it on purpose to see stuff like this); just in the JSON for some reason it says off. I'm not sure if that telemetry is meant to be non-identifiable though in the first place. Unity-made software (also mentioned in the article) send out a Unity piece at start-up that looks similar to the article, although I didn't take a deeper look myself. Author mentioned the battery: I also noticed that a lot of mobile apps are interested in the battery level. I didn't connect the pieces why but the article mentions Uber 4% battery surcharge, and now it makes a bit more sense. One app that has at least once been on HN at high scores starts sending out analytics before you've consented to any terms and conditions. One of the fields is your computer hostname (one of my computers has my real name in my hostname...it does not anymore). Usually web pages have "by downloading you accept terms and conditions" but this one only presented that text after you launch app before you get to the main portion. I never clicked it (still haven't), but I allowed the app mellow on background to snoop on its behavior. Video games: The ones I've tried seen mostly don't do anything too interesting. But I haven't tried any crappy mobile games for example. One unity game on the laptop, Bloons TD 6 sends out analytics at every menu click and a finished game sends a summary and is the "chattiest" game so far, although seems limited to what the game actually needs to do (it has an.online aspect). The payloads had more detailed info on my game stats though, they should add those to the game UI ;) Apple updates don't work through mitmproxy (won't trust the certificates). Neither do many mobile apps (none of the banking ones did, now I know what a mitm attack would look like to my bank app). Some requests have a boatload of HTTP headers. I've thought of writing a mitmproxy module to make a top 10 list. I think some Google services might be at the top that I've seen. (I think Google also has developed new HTTP tech, is it so that they can more efficiently set even more cookies? ;) I think anything Microsoft-tied may be chattiest programs overall on my laptop. But I haven't done stats or anything like that. Aside from mitmproxy, I'm learning security/cryptography (managed to find real world vulnerabilities although frankly very boring ones so far...), Ghidra, started learning some low-level seccomp() stuff, qemu user emulation, things in that nature to get some skills in this space. Still need to learn: legal side of things (ToSes like to say 'no reverse engineering'), how to not get into trouble if you reverse engineer something someone didn't like. I've not dared to report some things, and to not poke some APIs or even mention them because I don't know enough yet how to cover my ass. Modern computing privacy and security is a mess. I've worked a good part of my career at a DSP company (it would be in the box that says "Criteo" on it on the author's article). So I have some idea what companies in that space have as data.
• nipperkinfeet 2y ago
  I am using AdGuard DNS and its absolutely sickening how many ads and trackers it is blocking on a daily basis. Just on my smartphone alone.
• kjellsbells 2y ago
  I don't understand how this isn't considered an incredible national security issue, e.g., what stops an actor buying data for high value targets known to use certain apps, like the President or Prime Minister of a country?
• rsync 2y ago
  How much money is tied back to, or generated from, wifi AP SSID databases for geolocation ? Because wow that would be simple to spoof and chaff and spam. It's dinnertime here but if I had a few minutes I could make (my own house) appear indistinguishable from (Chase Center) from the perspective of SSID landscape. It would cost nothing and is trivially easy. Even if they pair MAC addresses that's not a big hurdle. I'll bet relative signal strengths are not measured. It might be a good flushing action[1]. [1] https://kozubik.com/items/FlushingAction/ https://kozubik.com/items/FlushingAction/
  • vv_ 2y ago
    Google's Geolocation Services used to charge 4$ for 1000 requests to their Cellular/Wi-Fi Geolocationing Service. Essentially you send a list of Wi-Fi MAC addresses and their associated RSSI values and get back a latitude and longitude with an accuracy metric. It was surprisingly good, when GPS wasn't available (sub 50 meters accuracy).
• vanillax 2y ago
  This is wild.
• wkat4242 2y ago
  From TFA: > This is the worst thing about these data trades that happen constantly around the world - each small part of it is (or seems) legit. It's the bigger picture that makes them look ugly. No it doesn't seem legit to me at all. Any of it.
• bigs 2y ago
  This write up is fantastic
• ggm 2y ago
  The thing I found I grokked, and think is important from this article is that private browsing doesn't end this information flow. It only marks the JSON data blob as "asked not to be identified or collated" and its substantively an honour system. There are penalties (lawsuit against google for misleading people on the fact data was still collected) but the walls to breach here are low, given that non-PII can be crossmatched, to confirm "who you are" in some sense. There is no such thing as "private" browsing inside the factory installed browser, with factory installed DNS, and any kind of location data, or other cross-collating information along with your IP. The loss of privacy may be contextual and somewhat statistical, but it would be wrong to assume you weren't identified. What it does do, is let you see how bidding mechanisms in services like flights and hotels will change bid when the same location as you comes to request service and doesn't have the prior search cookie state. Thats useful I guess. "find things at a different pricepoint" cookie monster mode?
  • ErigmolCt 2y ago
    "Private browsing" is just a polite request for companies to pretend they didn’t see you before
    • dangus 2y ago
      “Private browsing” is just private mostly in the sense of your local device, as in, your browsing history and cookies aren’t saved to disk. That still has some use as cookies are more direct tracking than fingerprinting (e.g., keeping you logged in, or a Google analytics script seeing that you’re a logged in Google user with a real identity provided to Google). “Ask app not to track” turns off Apple’s own device identifier, but doesn’t stop other types of identifiers from existing, as the article described by the way it showed how ad networks make their own device identifiers collected by various apps.
      • ErigmolCt 2y ago
        Most people assume "private" means something more
• Uptrenda 2y ago
  What do you think a design would look like for the web and internet where users actually have privacy on it?
• sedatk 2y ago
  It's a bit ironic that Privacy Badger extension finds 7 trackers on the article's page.
  • dlikren 2y ago
    It looks like these all come from the Reddit embed in the middle of the article. Default uBlock Origin settings blocks 13 urls (and more, due to Reddit's frequent pings), but disable 3rd-party frames brings it down to 1 url (since the original embed was blocked).
  • timsh 2y ago
    oops, here comes the price of a nice-looking Reddit embed. next time I’ll stick to a screenshot :) thanks!
    • sedatk 2y ago
      Great article regardless, thank you :)
• Khaine 2y ago
  This is why I am so against letting Web Browsers have access to so much device information. Every time, a web dev says they should be able to push notifications, or get battery information, or whatever, this is why they should be ignored.
• udev4096 2y ago
  Total bs. Do not give location permissions to untrusted apps. If the app insists on it, use mock GPS feature on android which will spoof your location. Can we all please stop exaggerating the slopiness of normies with their pretentious acts of being shocked after not being cautious about their privacy? Privacy is not by default, you have to put some effort into it
  • saagarjha 2y ago
    Maybe privacy should be by default.
• monksy 2y ago
  The people who reported about the Gravy analytics leak is 404media. They're an independent techincal media group that has been reporting on stories I haven't seen elsewhere. They're pretty awesome. I've personally paid-subscribed. (I'm not affilated with them, nor am I receiving comp to say this)
• nromiun 2y ago
  How many people only turn on GPS for maps? Aside from that all tracking methods are pretty inaccurate anyway.
• nomilk 2y ago
  > Advertising Tracking ID was actually set to 000000-0000... because I "Asked app not to track". > I checked this by manually disabling and enabling tracking option for the Stack app and comparing requests in both cases. > And that's the only difference between allowing and disallowing tracking This is revealing! I'd wondered about Apple's curious wording "Ask App not to track" leaves suspicious wriggle room - apps may not track by an id, but could easily 'fingerprint' users (given how much other data is sent), so even without a unique ID, enough data would be provided for them to know who you are 99% of the time. Amended Dead Privacy Theory: The Dead Internet Theory says most activity on the internet is by bots [0]. The Dead Privacy Theory says approximately all private data is not private; but rather is accessible on whim by any data scientist, SWE, analyst, or db admin with access to the database, and third parties. [0] https://en.wikipedia.org/wiki/Dead_Internet_theory https://en.wikipedia.org/wiki/Dead_Internet_theory
  • K0nserv 2y ago
    Apple sets Advertising Tracking ID to 00000-0000 because it's the only technical control they have. However, apps are also supposed to respect the signal with regards to other methods of cross-site/app tracking and disable fingerprinting mechanisms. See https://developer.apple.com/app-store/user-privacy-and-data-use/ https://developer.apple.com/app-store/user-privacy-and-data-... for details
    • alexvitkov 2y ago
      It's not the only technical control they have - every single datapoint an app can gather is ultimately provided from the OS. They could let you disable access to metrics that have proven to be useful for fingerprinting. They could also attempt block known tracking code - all games with IronSource ads will run the same tracker binary, byte for byte. There's a lot of things they could do, but don't, since in the mainstream they have a pretty good reputation when it comes to privacy.
    • diebeforei485 2y ago
      They have other controls. For example, a game does not need to know your precise battery level (respect the low power mode setting), or precise screen brightness (respect the dark mode setting), or precise storage or volume (appropriate is sufficient). They really don't need to know if you're using wired or bluetooth headphones, and can request a specific entitlement if they have a valid use for that information. 99% of games do not need precise location (some exceptions are pokemon go, etc). They can request and receive an entitlement.
• xyzal 2y ago
  I would like to bring attention to this project. They aim to function in an application firewall like manner and manage to block connections by category, classified by domain name. Android only though, and the 'full' version is available only on f-droid due to some anti-adblock-like Play store policy. https://trackercontrol.org/ https://trackercontrol.org/
• Jean-Papoulos 2y ago
  By "location", the OP means country. So not exactly a GPS point to 6 decimals... This is the second time I've seen a post with this problem here.
  • Einenlum 2y ago
    There's also, latitude, longitude and IP.
    • nedt 2y ago
      But that latitude and longitude might still be the middle of some city or country and not an exact location. It's not really clear how close it is.
• ErigmolCt 2y ago
  The fact that your "do not track" preference makes almost no difference in practice? Depressing but not surprising...
• pandemic_region 2y ago
  Related: has anyone else noticed the practice of using cheap commodity 'living room' appliances to get access to your data? A while ago I bought a ceiling light for my daughters' bedroom, brand unknown to me. It had a built-in speaker controlled via bluetooth, and dozens of light patterns and colors it could emit via a ring of small leds. My daughter was extactic looking at the youtube promo vid. Turned out that to use any of these features, you needed to install their app. Fine okay installing. Then the app demanded access to contacts and camera or it refused to connect to the ceiling light. Fine okay uninstalling the app and returning that crap.
• Arech 2y ago
  [emotions redacted] Long ago there was XPrivacy project for Android that allowed to granularly set permissions for each app & system service and ensure they won't get the real private data. It's no longer alive these days, I guess. Can someone share their experience with the alternatives for the modern latest Android?
• PatronBernard 2y ago
  > Moloco ads is a DSP network A digital signal processing network? A bit annoying to introduce an acronym without defining it. Great article otherwise.
• aprilfoo 2y ago
  It seems still possible to avoid being tracked (protections, filters, degoogle, etc), and the business is not very interested in the minority willing to trade off functionality, practicality and ease for privacy. For how long?
• black_puppydog 2y ago
  I realize this feels like a pipe dream, like a million miles away from our branch of reality in 2025, but I really think the entire online surveillance advertising industry needs to be burnt to the ground and (maybe, partially) rebuilt. Many of the problems we see nowadays are rooted in the fact that data is being collected and used to (supposedly) profitable ends. Sure, there may be the occasional honest actor in the industry, but they're so marginal and outcompeted by dishonest and shady ones that it really doesn't matter. IMHO the right move is to simply ban any collection that's not strictly necessary. Kind of like GDPR but without the "if the user agrees" exceptions. Reminds me of a regulation about artificial stone (?) being banned in Australia, not because it's impossible to use safely but because the regulator concluded that the entire supply chain is unwilling to and disincentivized from using the material safely, so the best move at this point was to ban it outright. Edit: found that article https://news.ycombinator.com/item?id=38634213 https://news.ycombinator.com/item?id=38634213
• Arch-TK 2y ago
  This is one of the many good reasons to avoid the google app store but most apps in general. Let it be known, having an app to do something which used to be doable by a website is to me a red flag. Although I refuse to install anything other than what I genuinely trust.
• Developer_Tom 2y ago
  Imo, the real takeaway here is that ad-tech isn’t just tracking people — it’s that it's becoming a decentralised surveillance network where no single entity takes any responsibility. Even with "Ask App Not to Track," your IP, geolocation, and device fingerprint still end up being leaked! It shows that tracking isn’t a feature anymore — it’s the business model.
• sharpshadow 2y ago
  Punish Unity and Facebook even more.
• welder 2y ago
  How do I dump a list of installed app identifiers to cross reference with the list of apps selling this data? [0] 0: https://docs.google.com/spreadsheets/d/1Ukgd0gIWd9gpV6bOx2pcSHsVO6yIUqbjnlM4ewjO6Cs/edit?gid=1257088277&ref=timsh.org#gid=1257088277 https://docs.google.com/spreadsheets/d/1Ukgd0gIWd9gpV6bOx2pc...
• wslh 2y ago
  Is it correct to assume that if you disable the GPS for apps the exact location is not sent or I am missing something?
• gfiorav 2y ago
  One of the big WTF moments I've had in the "web vs. device" Ad-related privacy journey was realizing that even if you create an "anonymous" account on an app in your phone, your device ID is shared and can be recognized by Ad vendors. Example: - You're using a known account on a Mac to search for a shelf to buy - You're using a anonymous account to browse Reddit on an iPhone And the shelf Ad pops up on the Reddit feed. Yep, as long as you logged in with a known account on both devices, they're now linked by device id. An all you do on those devices (regardless of the account) can be traced back to you. I read about this in "Chaos Monkeys" but it never really hit me until this experience.
  • mrguyorama 2y ago
    This is typically just done through IP address. That's why I get ads for my girlfriend's preferred eye cream brand despite the fact that we browse using different devices and the advertiser should have access to that data point.
• moominpapa 2y ago
  I really find this fascinating - great article. As an experiment if you like, can anyone identify anything about me from this post? And if not, why not? Would love to know.
• sheerun 2y ago
  At the same time "know your location" notification is less it seems to ask (ask lawyers), also portals
• buro9 2y ago
  Use NextDNS (https://nextdns.io https://nextdns.io) on your mobile phone as a Private DNS provider, and switch as many apps as allow it to be web apps, i.e. https://m.uber.com https://m.uber.com works just fine, and use Firefox on mobile and enable `about:config` via `chrome://geckoview/content/config.xhtml` , from there switch `beacon.enabled` to false. Far less requires an actual app than most people imagine. It's the apps that leak so much.
  • 1vuio0pswjnm7 2y ago
    Mobile phones suck as computers. NetGuard PCAP files are must read if using a mobile phone as a computer. One setup that works reasonably well is NetGuard --> Nebulo --> DNSdist on own router On phone, (a) set DNS in Wifi to localhost, i.e., disable service provider DNS (b) set VPN to Block all connections without VPN (c) set Netguard to forward port 53 to Nebulo (d) set Nebulo to run in non-VPN mode (e) set DNS configuration in Nebulo to DNSdist on router On router, point DNSdist at nsd or tinydns serving custom root zone containing all needed DNS data. Apps like NetGuard, Nebulo, PCAPdroid, etc. allow one to easily export the DNS data needed for the zone file. There is at least one leak in this setup. Nebulo's "Internal DNS server" can only be set to Cloudflare, Google or Quad9. In theory this should only be used to resolve the address of the DoH provider and nothing else. But not allowing the user to choose their own DNS data source and forcing the user to keep pinging (querying) Cloudflare, Google or Quad9 is poor design. Those addresses are unlikely to change anyway. Using a browser in place of other apps seems like good strategy but the browser "app" is far, far more complicated than many open source "apps" and much more difficult to control. Firefox is not only filled with telemetry, almost no one compiles it themselves, it has more settings than any normal user can keep track of and it is constantly changing. Layer upon layer of unneeded complexity.
• oldherl 2y ago
  I thought this was common knowledge among (at least) IT industry workers. It's been like this for a long time.
• afiodorov 2y ago
  I wonder if Apple will extend their iCloud+ private relay service to apps as a result of this.
• megous 2y ago
  With articles like these, I'm glad for my dumbphone. At least that sends data only to my mobile operator, hopefully.
• grues-dinner 2y ago
  When someone wants to install an app rather then go to a website that could do the same thing, they are advertising that they are up to something nefarious.
• mharig 2y ago
  [dead]
• TrapLord_Rhodo 2y ago
  how is this legal? This is apples problem and they need to be sued into oblivion. If i have location tracking turned off on my phone why is my phone still sending location data?
• oleyphoenix 2y ago
  "I would highly recommend Tomcyberghost@gmail.com I felt a strong connection with him and appreciate his knowledge, expertise and manner in which he worked with my former partner and I. He handled the challenging dynamics of our relationship, and through our work I was able to leave a relationship that was hurting and hindering me. I came to that conclusion not through any direct encouragement, but through doing the work."