the way firms respond is very intriguing to me. for example, ASKfm indicates that they do this to improve user experience, yet the public website of one tracker (Huq) even has an earnings calculator and describes how they pay for your data. 
in fact Huq is probably the most direct about buying your location data from app developers. cannot get much clearer (huq.io/publishers/). I do not think these payments are addressed at all in responses from any companies.
“we are tracking where you shop using code packaged in this app but no longer use GPS for that” seems, to me, like an extraordinarily strange rebuttal.
this is super funny to me because we list the In Use and Always justifications for the affected version (we indexed all Info.plist filed for corroboration).
quick poll: does anyone think anything here would serve as “clear notice” to users?
quick poll: does anyone think anything here would serve as “clear notice” to users?
if @HomesDotCom believes the code has been deactivated last year, this indicates something far worse: their app has been sending user locations to a third-party firm when the app is opened, without @HomesDotCom themselves being aware.
anyone with Bettercap/Burp can corroborate.
anyone with Bettercap/Burp can corroborate.
anyway, more to come in the future. just getting started.
some have been confused by the mitigations outlined at the start of guardianapp.com/ios-app-locati… so I will elaborate a bit.
while you cannot prevent things like IP address based tracking or cross-app tracking from same developer (via IDFV), if you use Limit Ad Tracking it will helps mitigate broader cross-app tracking as the trackers will be unable to get your unique “ad ID” (IDFA).
the Wi-Fi SSID idea is due to the ability of an app to obtain the name of the Wi-Fi router you are connected to. some trackers collect this alongside location, so if it is unique enough of a name, you could potentially be tracked even if you later turn off Location/GPS access.
the Bluetooth one may not always be possible, but trackers like Wireless Registry will actually slurp up data about Bluetooth devices around you. I think that is super creepy and turning off Bluetooth when not in use is probably the most surefire way to mitigate.
did not have time to include this in the report, but here is a fun game: install MapQuest app and check out what it sends to 'receiver.lcoe.oath.com' (Oath) throughout all hours of the day.
for those interested, I answered some questions and added additional info here and there throughout this HN thread.
news.ycombinator.com/item?id=179385…
news.ycombinator.com/item?id=179385…
