8 ms·

author here to answer any questions or discuss an app

by timsh 1y ago

jrmg 1y ago
On the question of “why do they collect all this data” - brightness, battery life, headphone usage, volume etc: It’s not just because the data is valuable in itself, it’s also to ‘fingerprint’ the device across IPFA boundaries and in the face of things like NAT and VPNs. There are so many disparate data points that are different across different devices that two apps reporting an identical or near-identical set in a short timeframe are likely on the same device.
Teever 1y ago
Are you aware of any sousveillance projects with the goal of identifying and monitoring the people responsible for this tracking?
alphan0n 1y ago
Good stuff. You might find more interesting data by implementing Frida [0] into your process to snoop on encrypted traffic normally not visible due to pinned certificates. [0] https://frida.re/docs/home/ https://frida.re/docs/home/
- sunbum 1y ago
  And more specifically just use the maintained scripts from HTTP Toolkit. https://github.com/httptoolkit/frida-interception-and-unpinning https://github.com/httptoolkit/frida-interception-and-unpinn...
  - alphan0n 1y ago
    Excellent, thank you. There’s a lot to Frida. HTTP Toolkit only mentions using jailbroken iOS devices, but you can also use unjailbroken devices running v13+ via injection [0] [0] https://frida.re/docs/ios/ https://frida.re/docs/ios/
elric 1y ago
How the hell is any of this tracking legal?
- lrvick 1y ago
  Because you and almost everyone else agreed to the Terms of Service where you consented to let them stalk you until they can make an accurate enough simulation of you to sell increased chances to change your behavior to the highest bidder. You can stop at any time. Cancel your cell phone subscription and turn off your phone. It is a perfectly valid choice.
  - elric 1y ago
    Uninformed consent is not consent. And while you may enjoy your life without a mobile subscription, many would not.
    - djeastm 1y ago
      >Uninformed consent is not consent. True, but a Terms of Service document is the vehicle by which you are informed and consenting. If you're not willing to read the information you're choosing to remain uninformed.
      - wuiheerfoj 1y ago
        When it takes multiple lifetimes to read the Terms of Service for everything a normal person uses to get through daily life, it’s not a case of willingness
        lrvick 1y ago
        I read every legal contract I agree to. It is crazy not to. If it is too long and hard to read, there is a reason for that and you can just opt out.
    - lrvick 1y ago
      I do think apps should force people to actually scroll through ToS at a normal reading speed or tldr the horrible things they will do to you front and center like we forced the tobacco industry to do. Most of humanity enjoyed their lives without pocket internet until the last couple decades. Saying people cannot be happy without that is like saying they cannot be happy without smoking. This Apple or Google phone culture is a false dichotomy. I run a b2b tech company in silicon valley, and have endless technical hobbies and do not need Apple or Google products or a cell carrier to be happy. It is always possible to choose tech that you own and control. It just takes a bit more research because the open ecosystems lack marketing budgets.
anotherpaul 1y ago
I haven't gone through setting it up (yet) but I imagine there should be differences between EU and US versions of the apps. Is that something you expect to and if so, are you recording that info in your survey? Or am I just naive here?
- timsh 1y ago
  The difference should be only at the consent level, eg you might see less or more “Accept All” buttons with different design or different ToS linked. I don’t believe there’s a real difference on the code or even SDK level based on geo.
- qwertox 1y ago
  Doesn't California have partially stricter laws than the EU?
uticus 1y ago
solid observations and good analysis! so, seems too obvious, are you truly in pioneer territory - nobody else is doing what you've done here?
- timsh 1y ago
  I mean, there should be something! Maybe not with this exact list of apps, but the code should be similar to other "how-to-record-traffic" guides.
feydaykyn 1y ago
Many thanks for your eyes opening article! Hopefully you have a third article on the making testing whether common privacy technics are effective ?
- deleted 1y ago
  [deleted]

author here to answer any questions or discuss an app

by timsh 1y ago

author here to answer any questions or discuss an app

jrmg 1y ago

On the question of “why do they collect all this data” - brightness, battery life, headphone usage, volume etc: It’s not just because the data is valuable in itself, it’s also to ‘fingerprint’ the device across IPFA boundaries and in the face of things like NAT and VPNs. There are so many disparate data points that are different across different devices that two apps reporting an identical or near-identical set in a short timeframe are likely on the same device.

Teever 1y ago

Are you aware of any sousveillance projects with the goal of identifying and monitoring the people responsible for this tracking?

alphan0n 1y ago

Good stuff. You might find more interesting data by implementing Frida [0] into your process to snoop on encrypted traffic normally not visible due to pinned certificates. [0] https://frida.re/docs/home/ https://frida.re/docs/home/

sunbum 1y ago
And more specifically just use the maintained scripts from HTTP Toolkit. https://github.com/httptoolkit/frida-interception-and-unpinning https://github.com/httptoolkit/frida-interception-and-unpinn...
- alphan0n 1y ago
  Excellent, thank you. There’s a lot to Frida. HTTP Toolkit only mentions using jailbroken iOS devices, but you can also use unjailbroken devices running v13+ via injection [0] [0] https://frida.re/docs/ios/ https://frida.re/docs/ios/

elric 1y ago

How the hell is any of this tracking legal?

lrvick 1y ago
Because you and almost everyone else agreed to the Terms of Service where you consented to let them stalk you until they can make an accurate enough simulation of you to sell increased chances to change your behavior to the highest bidder. You can stop at any time. Cancel your cell phone subscription and turn off your phone. It is a perfectly valid choice.
- elric 1y ago
  Uninformed consent is not consent. And while you may enjoy your life without a mobile subscription, many would not.
  - djeastm 1y ago
    >Uninformed consent is not consent. True, but a Terms of Service document is the vehicle by which you are informed and consenting. If you're not willing to read the information you're choosing to remain uninformed.
    - wuiheerfoj 1y ago
      When it takes multiple lifetimes to read the Terms of Service for everything a normal person uses to get through daily life, it’s not a case of willingness
      - lrvick 1y ago
        I read every legal contract I agree to. It is crazy not to. If it is too long and hard to read, there is a reason for that and you can just opt out.
  - lrvick 1y ago
    I do think apps should force people to actually scroll through ToS at a normal reading speed or tldr the horrible things they will do to you front and center like we forced the tobacco industry to do. Most of humanity enjoyed their lives without pocket internet until the last couple decades. Saying people cannot be happy without that is like saying they cannot be happy without smoking. This Apple or Google phone culture is a false dichotomy. I run a b2b tech company in silicon valley, and have endless technical hobbies and do not need Apple or Google products or a cell carrier to be happy. It is always possible to choose tech that you own and control. It just takes a bit more research because the open ecosystems lack marketing budgets.

anotherpaul 1y ago

I haven't gone through setting it up (yet) but I imagine there should be differences between EU and US versions of the apps. Is that something you expect to and if so, are you recording that info in your survey? Or am I just naive here?

timsh 1y ago
The difference should be only at the consent level, eg you might see less or more “Accept All” buttons with different design or different ToS linked. I don’t believe there’s a real difference on the code or even SDK level based on geo.
qwertox 1y ago
Doesn't California have partially stricter laws than the EU?

uticus 1y ago

solid observations and good analysis! so, seems too obvious, are you truly in pioneer territory - nobody else is doing what you've done here?

timsh 1y ago
I mean, there should be something! Maybe not with this exact list of apps, but the code should be similar to other "how-to-record-traffic" guides.

feydaykyn 1y ago

Many thanks for your eyes opening article! Hopefully you have a third article on the making testing whether common privacy technics are effective ?

deleted 1y ago
[deleted]