Hacker News

Ads in Popular Apps Give Police a Powerful Tool to Spy on Users

124 points by mgh2 ago | 35 comments

delichon |next [-]

Google appears to be overlooking their explicit ban on this.

  If your app handles personal and sensitive user data, then you must ... Not sell personal and sensitive user data.
The rule also applies to third-party code.

  If you include third party code (for example, an SDK) in your app, you must ensure that the third party code used in your app, and that third party's practices with respect to user data from your app, are compliant with Google Play Developer Program policies... For example, you must ensure that your SDK providers do not sell personal and sensitive user data from your app.
https://support.google.com/googleplay/android-developer/answ...

Isn't this abuse what we are supposed to be paying their 15% Play Store tax to stop?

benoau |root |parent |next [-]

World would be a much better place if Google and Apple enforced their chosen policies for apps, and Meta and Google enforced their chosen policies for ads, but then these companies would be very slightly poorer.

Vaushite |root |parent |next |previous [-]

The tax is 30% and the purpose of a system is what it does

gustavus |root |parent [-]

Come On, Obviously The Purpose Of A System Is Not What It Does

https://www.astralcodexten.com/p/come-on-obviously-the-purpo...

ozlikethewizard |root |parent |next [-]

"The purpose of the British government is to propose a controversial new sentencing policy, stand firm in the face of protests for a while, then cave in after slightly larger protests and agree not to pass the policy after all."

This might as well be the purpose of the British government.

Vaushite |root |parent |previous [-]

This guy just hasn't understood the phrase, he's picked several strawmen to argue against. Not literally everything a system does is its purpose, so you can't just pick the stupidest ones and use them to disprove the principle.

How about "the purpose of a system is not something it doesn't do" or "the purpose of a system is some of the things it does" but that's not as catchy.

loa_in_ |root |parent [-]

"You won't believe it's on purpose"

LoganDark |root |parent |previous [-]

This just means you can't get money for the personal and sensitive user data. It's wild that companies think that's the problem.

Webloc is getting this data for free. And then reselling it, but it's outside the scope of Google then.

hnburnsy |next |previous [-]

Keep minimal apps on your phone, use an old iPad at home for other apps with Apple being slightly better for privacy.

everdrive |next |previous [-]

There's no good reason to use your phone for any more than the bare minimum. Remove as many apps as possible. Treat it like a landline by just keeping in on a desk or something when you're at home.

infinite_spin |root |parent |next [-]

That's not the way I want to live. I want to enjoy technology and enjoy privacy, and since those aren't mutually exclusive, it's reasonable to expect both.

prism56 |root |parent |previous [-]

At least use the browser for every service you can that wants you to use an app. Bonus points if the adblocker is enabled.

jareklupinski |next |previous [-]

> The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps.

is there a list

nik282000 |root |parent |next [-]

Don't use apps. Use your browser and an ad blocker.

TFNA |root |parent [-]

A significant amount of the internet for normies today is app-first, where there may be no web version, or the web version lacks much of the core functionality of the service. Instagram led the way with this before Covid already, but the practice then spread widely.

The savvy crowd on HN hopefully already knows how to protect ourselves, but we can't really expect the mass public to do so. Especially when some younger people today are losing awareness of the very concept of the browser as they use dedicated apps for all their internet use.

nik282000 |root |parent [-]

Sucks to suck.

If a service is sub-par in the browser I don't use it. Be ThE cHaNgE yOu WaNt To SeE. I hate that sentence but it kinda applies here.

infinite_spin |root |parent |next [-]

browser based applications can still gain access to this data, using very similar workflows. E.g. a weather app rendered on a browser is still going to request your location, and can fingerprint that browser to build a user profile. I'm not sure your solution is a solution at all.

ranger_danger |root |parent |next |previous [-]

I have tried for years but it just doesn't make a difference if enough people in the world don't care loudly enough.

Banks are relying on Play Integrity protection as well as SMS-based 2FA, neither of which are both safe and private.

exe34 |root |parent |previous [-]

Unless you have friends, of course, and want to keep in touch. (Not a problem for me).

mzajc |root |parent |next |previous [-]

Exodus has a list of applications with known spyware libraries: https://reports.exodus-privacy.eu.org/en/reports/list/. The homepage has search and also lets you re-analyze applications if there's no report or it's out of date.

There will be false negatives for first-party spyware and sufficiently-obfuscated vendored libraries, but from my experience this is exceedingly rare.

fancyfredbot |root |parent |previous [-]

In Android apps need to request location permission. You can reject it and/or uninstall those which request it.

Most apps will only be able to request location while running in the foreground.

Weather apps are unusual for having a reason to request background location access and so you should treat them with particular suspicion.

microtonal |root |parent |next [-]

In Android apps need to request location permission. You can reject it and/or uninstall those which request it.

Within the same profile, apps can communicate through local IPC though. Wouldn't surprise me if some SDKs use this to coordinate exfiltration of data between apps. I mean, tracking companies have even used localhost sockets to improve tracking: https://localmess.github.io/

We sorely need IPC scopes.

BeetleB |root |parent |next |previous [-]

> Weather apps are unusual for having a reason to request background location access

Not really. I can just set the location in settings.

Terr_ |root |parent |previous [-]

I regret that we've moved away from a world where you could easily tell your device throw a privacy-preserving bone to pesky apps. ("Sure, you've got location access, but it'll only show my house, you don't get to see where else I go.")

Instead our ownership and agency has been sacrificed on the altar of "but BigCo doesn't like it because users can lie."

fancyfredbot |root |parent [-]

You kind of can, but it means rooting the phone after which you can't run banking apps etc.

Personally I am okay with my bank app doing this but I'm probably in a minority here.

Terr_ |root |parent [-]

A compromise might be that only certain special classes of apps can get the "don't lie to me" status, where a bank's app has to prove it's a little different than some "tired of our website try our app" thing or the average shovelware.

moscoe |next |previous [-]

This is why network-wide dns ad-blocking is necessary.

Setup a personal ad-blocking vps/vpn to route traffic through when away from home: https://trailofbits.github.io/algo/

microtonal |root |parent |next [-]

Perhaps necessary, but not enough. Trackers will just increasingly use hostnames that also have legitimate use. Part of the solution is not technical, it is important to have strong privacy laws and they should be aggressively enforced.

Also, people should have the tools to disable tracking SDKs Morphe-style. Unfortunately, for mainstream phones, this would require assistance from Google and Apple, who would never do that, because they would get sued for benefitting themselves over others (or they'd lose the valuable tracking they do themselves).

nullfield |root |parent |previous [-]

Are we back to trusting Ubuntu these days? Why can’t this support Debian, or…? (Yes I know see the FAQ)

hoppp |next |previous [-]

Code your own apps, run your own things.

microtonal |root |parent [-]

Sorry, but this is nonsense. People mostly use apps to use services. These services will just start to require remote attestation when people try to use them directly from their own apps (see e.g. how Volkswagen shut out Home Assistant, etc.).

This would only work for the small subset of apps that are mostly local (a timer, maybe a weather app if you can arrange API access, etc.).

Also, 99% of the population cannot code their own app or are not interested to do so. (Even with an LLM.)

hoppp |root |parent |next [-]

I use my own apps for a whole bunch of things, not everything of course.

Don't need to read into it more than what I wrote down.

yieldcrv |next |previous [-]

I’d rather give my info directly to the party at this point

Shouldn’t have bullied tiktok into selling for US users

RecycledEle |previous [-]

So I let a company know my location, and they turn the data over to the pigs.

Not good.