Hacker News Reader

Comment by jareklupinski | Hacker News Reader

> The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps.

is there a list

View on HN

Don't use apps. Use your browser and an ad blocker.

A significant amount of the internet for normies today is app-first, where there may be no web version, or the web version lacks much of the core functionality of the service. Instagram led the way with this before Covid already, but the practice then spread widely.

The savvy crowd on HN hopefully already knows how to protect ourselves, but we can't really expect the mass public to do so. Especially when some younger people today are losing awareness of the very concept of the browser as they use dedicated apps for all their internet use.

Sucks to suck.

If a service is sub-par in the browser I don't use it. Be ThE cHaNgE yOu WaNt To SeE. I hate that sentence but it kinda applies here.

I have tried for years but it just doesn't make a difference if enough people in the world don't care loudly enough.

Banks are relying on Play Integrity protection as well as SMS-based 2FA, neither of which are both safe and private.

browser based applications can still gain access to this data, using very similar workflows. E.g. a weather app rendered on a browser is still going to request your location, and can fingerprint that browser to build a user profile. I'm not sure your solution is a solution at all.

Unless you have friends, of course, and want to keep in touch. (Not a problem for me).

Exodus has a list of applications with known spyware libraries: https://reports.exodus-privacy.eu.org/en/reports/list/. The homepage has search and also lets you re-analyze applications if there's no report or it's out of date.

There will be false negatives for first-party spyware and sufficiently-obfuscated vendored libraries, but from my experience this is exceedingly rare.

> https://reports.exodus-privacy.eu.org/en/reports/253268/

Solitaire

ah beans

In Android apps need to request location permission. You can reject it and/or uninstall those which request it.

Most apps will only be able to request location while running in the foreground.

Weather apps are unusual for having a reason to request background location access and so you should treat them with particular suspicion.

In Android apps need to request location permission. You can reject it and/or uninstall those which request it.

Within the same profile, apps can communicate through local IPC though. Wouldn't surprise me if some SDKs use this to coordinate exfiltration of data between apps. I mean, tracking companies have even used localhost sockets to improve tracking: https://localmess.github.io/

We sorely need IPC scopes.

> Weather apps are unusual for having a reason to request background location access

Not really. I can just set the location in settings.

I regret that we've moved away from a world where you could easily tell your device throw a privacy-preserving bone to pesky apps. ("Sure, you've got location access, but it'll only show my house, you don't get to see where else I go.")

Instead our ownership and agency has been sacrificed on the altar of "but BigCo doesn't like it because users can lie."

You kind of can, but it means rooting the phone after which you can't run banking apps etc.

Personally I am okay with my bank app doing this but I'm probably in a minority here.

A compromise might be that only certain special classes of apps can get the "don't lie to me" status, where a bank's app has to prove it's a little different than some "tired of our website try our app" thing or the average shovelware.

Reply on news.ycombinator.com