As soon as your cousin clicks "Yes, I would like to share the entire contents of my contacts with you" when they launch TikTok your name, phone number, email etc are all in the crowd.

And I buy this stuff. Every time I need customer service and I'm getting stonewalled I just go onto a marketplace, find an exec and buy their details for pennies and call them up on their cellphone. (this is usually successful, but can backfire badly -- CashApp terminated my account for this shenanigans)

People commonly point to Mozilla's research regarding vehicle's privacy policies. (https://foundation.mozilla.org/en/blog/privacy-nightmare-on-...) But that research only states what the car company's lawyers felt they must include in their privacy policies. These policies imply (and I'm sure, correctly imply) that your conversations will be recorded when you're in the vehicle. But, they never drill down into the real technical details. For instance ..... are car companies recording you the whole time and streaming ALL of your audio from ALL of your driving? Are they just recording you at a random samples? Are they ONLY recording you when you're issuing voice commands, and the lawyers are simply hedging their bets regarding what sort of data _might_ come through accidentally during those instances? Once they record you, where is the data stored, and for how long? Is it sent to 3rd parties, etc? Which of these systems can be disabled, and via what means? Does disabling these systems disable any other functionality of the vehicle, or void its warranty? Lastly, does your insurance shoot up if you have a car without one of these systems? etc ...

The list of questions could go almost indefinitely, and presumably, would vary strongly across manufacturers. So much of the privacy news out there is nothing but scary and often not very substantiated worst case scenarios. Without the details and means to improve privacy, all these stories can do is spread cynicism. I'm really glad to see this level of discourse for the author.

My rent is paid through a company called Bilt.

I discovered that when I shop at Walgreens now, Bilt sends me an email containing the full receipt of what I bought like so:

    > Hey [inahga],
    >
    > You shopped at Walgreens on 12/1/24 and earned Bilt Points with your
    > Neighborhood Pharmacy benefit.
    >
    > Items eligible for rewards
    > TOSTITOS HINT OF LIME RSTC 11OZ
    > $3.50
    > 
    > +3 pts
    > TOSTITOS RSTC 12OZ
    > $3.50
    >
    > +3 pts
    > Other items*
    > EXCLUDED ITEMS
    > $0.07
    >
    > *May include rewards-ineligible items and/or prescriptions.

I'm curious how this data flows from Walgreens to my rent company, but maybe I'd rather not know and just use cash/certified check from now on.

This is clearly adding entropy to de-anonymize users between apps, rather than to add specificity to ad bids.

False. Apps don't have access to cellid information unless they also have location permissions, in which case they can just request your location directly.

>the free apps you install and use collect your precise location with timestamp [...]

This is alarmist and contradictory given that the author admits a few paragraphs up that the "location shared was not very precise". It might be possible for the app to request precise location via location services, but the app doesn't request such permissions (at least on android, you can't check for requested permissions on iOS without installing the app and running it), so such apps are most definitely limited to "not very precise" locations.

>At the same time, there is so much data in the requests that I'd expect ad exchanges to find some loophole ID that would allow cross-app tracking without the need for IDFA.

At least in theory they're not supposed to do that, but it'd be hard to enforce.

"If a user resets the Advertising Identifier, then You agree not to combine, correlate, link or otherwise associate, either directly or indirectly, the prior Advertising Identifier and any derived information with the reset Advertising Identifier. "

https://developer.apple.com/support/terms/apple-developer-pr...

> I checked this by manually disabling and enabling tracking option for the Stack app and comparing requests in both cases.

> And that's the only difference between allowing and disallowing tracking

This is revealing! I'd wondered about Apple's curious wording "Ask App not to track" leaves suspicious wriggle room - apps may not track by an id, but could easily 'fingerprint' users (given how much other data is sent), so even without a unique ID, enough data would be provided for them to know who you are 99% of the time.

Amended Dead Privacy Theory:

The Dead Internet Theory says most activity on the internet is by bots [0]. The Dead Privacy Theory says approximately all private data is not private; but rather is accessible on whim by any data scientist, SWE, analyst, or db admin with access to the database, and third parties.

[0] https://en.wikipedia.org/wiki/Dead_Internet_theory

Screen brightness, boot time, memory, and network operator could probably fingerprint any device all by itself.

Because wow that would be simple to spoof and chaff and spam.

It's dinnertime here but if I had a few minutes I could make (my own house) appear indistinguishable from (Chase Center) from the perspective of SSID landscape.

It would cost nothing and is trivially easy. Even if they pair MAC addresses that's not a big hurdle. I'll bet relative signal strengths are not measured.

It might be a good flushing action[1].

[1] https://kozubik.com/items/FlushingAction/

> I know the "right" answer - to help companies target their audience better! For example, if you're promoting a mobile app that is 1 GB of size, and the user only has 500 MB of space left - don't show him the ad, right?

Author jumps to the incorrect conclusion here. The answer is fingerprinting.

There is no such thing as "private" browsing inside the factory installed browser, with factory installed DNS, and any kind of location data, or other cross-collating information along with your IP. The loss of privacy may be contextual and somewhat statistical, but it would be wrong to assume you weren't identified.

What it does do, is let you see how bidding mechanisms in services like flights and hotels will change bid when the same location as you comes to request service and doesn't have the prior search cookie state. Thats useful I guess.

"find things at a different pricepoint" cookie monster mode?

Let it be known, having an app to do something which used to be doable by a website is to me a red flag. Although I refuse to install anything other than what I genuinely trust.

“Ask app not to track” is a wash and privacy theater at best. One of the reasons I still run ad blocking on _all_ websites and at the network layer. Sorry “content creators” but you need to get your revenue from elsewhere (ie, sponsored content).

Now I want a phone that scrambles all of this data on a per app (or phone) basis.

Malicious app wants this data? Sure you can have it. But you will get randomized values for every bit of information — resolution, lat/lon, brightness, battery level (user can set range of 90-100%), ….

https://media.ccc.de/v/38c3-databroker-files-wie-uns-apps-un...

(English audio available)

0: https://docs.google.com/spreadsheets/d/1Ukgd0gIWd9gpV6bOx2pc...

Can this data fall into the hands of "evil" state actors, and why is Congress OK with that and not with tiktok?

Long ago there was XPrivacy project for Android that allowed to granularly set permissions for each app & system service and ensure they won't get the real private data. It's no longer alive these days, I guess. Can someone share their experience with the alternatives for the modern latest Android?

  - It was a clean state of a somewhat old phone (iPhone 11, factory defaults + new apple id)
  - A single (old) app was installed (Stack by KetchApp, 10-12 years old)
  - Was sending out an update a second pretty much instantly (5 kB - ~300 KB every second)
  - Within a minute: IP, Lat / Lon, country, phone model, carrier / network operator, vendor, OS version, connection type (wifi), headphone status (?), volume setting (?), screen brightness setting (?), battery status (?), CPU count, system RAM, free RAM allocation, free hard drive capacity, system boot time (?)

Edit: It's almost Remote Desktop, on an iPhone. Realtime (~1 Hz) RAM / ROM allocation. Not sure how many Apple user even know how to check their realtime RAM / ROM allocation. The free hard drive space especially is just asking for botnet downloads.

Edit: Right, and ... disabling tracking doesn't mean anything because numerous updates blatantly ignore the setting ("uc": "1", // User consent for tracking = True;) and it's just a flag while they still send your vendor specific customer identifier anyways.

Really interesting article, and great investigation, just disturbing how much on an effectively clean phone.

Example:

- You're using a known account on a Mac to search for a shelf to buy

- You're using a anonymous account to browse Reddit on an iPhone

And the shelf Ad pops up on the Reddit feed. Yep, as long as you logged in with a known account on both devices, they're now linked by device id. An all you do on those devices (regardless of the account) can be traced back to you.

I read about this in "Chaos Monkeys" but it never really hit me until this experience.

Snowden in one of interviews talks about exactly this kind of tracking with Amazon example (ts 01:18:00) https://x.com/JohnStossel/status/1885382675810181612

Basically, all these companies, ad networks, data brokers, big tech with absence of basic privacy laws (not to be confused with 4th amendment that binds Fed and State gov only, but does not restraint companies) act with wilful conspiracy with US government regulators, washing each other hand like a monopoly. This data gets enriched and collided and is perpetually on a permanent record.

https://en.wikipedia.org/wiki/Permanent_Record_(autobiograph...

So next time you talk about totalitarian regimes around the world look in the window.

Far less requires an actual app than most people imagine. It's the apps that leak so much.

https://bsky.app/profile/balsa.info/post/3lh7z776lbk2w

You connect to a special WiFi SSID and compares your traffic to known tracking/ad domains (Pi-Hole Lists mostly) and the "food" is the packets being sent to those servers.

its crude and has some high false positive rates, but it does have a chilling effect for me when exploring what data is going where

And, looking further in the document, we can see there is more.

Some of them, such as IP address and timestamp it is reasonable to use for programs that access the internet (although it should be possible for the user to set up a proxy and/or adjust the clock in order to change these things, the server would still use its own timestamp anyways).

Available memory also makes sense to be readable (although ideally, the user should be allowed to limit the amount of memory available to specific programs, in order that there is enough memory remaining for other programs; the reported total memory should then include only the memory available to this program and not to all programs), and the same should be true of the number of CPU cores and the amount of available disk space.

Others probably should not normally be known by most programs (but some are usefulf or some kind of programs), and even when they are, the operating system ought to allow users to reprogram what information is available and what filters, logging, etc will be used.

The presence of wired headphones probably should not be accessible by software, and the redirection should be handled by hardware. Perhaps an exception makes sense if the settings need to be different, e.g. mono vs stereo, although even then, programs should only see those settings (and only if they have audio output), and the user should be allowed to override them due to preferences (e.g. some users might want mono even if connected to external speakers or headphones; on my computer sometimes only one speaker works and sometimes both, so it is useful to me to be able to switch to mono).

Furthermore, there is the consideration, if the advertisers/spies are stealing your power and network bandwidth and quota in order to do these things; then, that is theft.

Also, there's a looong list of companies who know the location of your mobile device, starting from the cell phone tower operator to Apple/Google and many in between.

EDIT: please ignore, author did it differently to what I expected.

Seriously if you are going to do illegal things never ever buy a smartphone.

> This is the worst thing about these data trades that happen constantly around the world - each small part of it is (or seems) legit. It's the bigger picture that makes them look ugly.

No it doesn't seem legit to me at all. Any of it.

And then if you use a commercial VPN with DNS ad-blocking enabled, how much more does this help?

In it's paid feature, you can select app to block internet connection or you can select country, ip and host.

After browsing my internet logs, it shocked me to see some app I had absolutely no idea were spying so much.

Xiaomi home ? Yeah I knew Xiaomi app would be spyware. But Spotify for instance, how could I guess it sends every few hours data to remote server including Facebook ones.

Until I find replacement for Spotify, but most music streaming app do spy on its user (and I don't mean just learning what music you like), I can still block all the graph.facebook.com tracking.eu.miui.com Google ads.gdoubleclick.net and so on.

It's open source but firewall is paid feature, i highly recommend it if you're on Android.

https://f-droid.org/fr/packages/com.emanuelef.remote_capture...

There is even the possibility to decrypt packet and analyze them although it require root, i did it on another phone and yeah it's similar to what the author found. Every single bit of data, ip adress, since how long the phone is on, the wifi connections, when did I unlock the phone and so on.

Every data taken individually is not important to me but this stream of little data constantly going God knows where is creepy as fuck.

But, this is basically after they figured how to do "good enough" location targetting using IP and a bunch of this info this guy talked about. You don't actually need a lat, long, just the 1 mile radius/city area is good enough to run ads and they have ALL of that.

This was why meta's revenue dropped so much after apple's move, they could not fall back to collecting precise location. This is the last game in town. You shut this down, meta's precise targetting will suffer gravely, ads will become flakey.

One last thing. You may ask, who are the businesses that need precise lat longs? are like this one[2]. These businesses are like whack-a-mole. They saturate the app market steal data get money and shit down when someone yells and in a few months and comeback again, rebranded and come back as another app. They exist not just to collect data but to act as an arbiter on who get eyeballs on IRL activities to influence behavior at the (Top of the funnel) TOFu. In the Worst. Possible. Way.

[1] https://techcrunch.co/2022/05/09/facebook-to-shutter-its-nea... [2] https://www.joinpogo.com/

1. Having permission to contacts is NOT a capability. Running a function on it that is by design not leak PII is infinitely more valuable and a capability.

2. Asking users to grant permission is broken by design: You are giving a very bad multiple choice to the user: `(a)Creepy? (b). LessCreepy (c). Don't Use App`

Instead if we only granted operation rights and hid the actual information instead it would be so much better. We need a separation of data from the function to empower apps to give better choices to users.

A digital signal processing network? A bit annoying to introduce an acronym without defining it. Great article otherwise.

I sent them my uid2 and they still say they can't link to an identity and don't have a match in their database

I have location services disabled 99% of the time

And I often leave the house without my smartphone (when walking or bicycling), much to the dismay of my better half... I am sorry, I forget!

There would be so much to write about what I've seen. I've thought of making a blog post. I use mitmproxy to check on sketchy apps and to learn in general.

The information sent out is fascinating. I knew extensive telemetry is pretty norm these days, but it's another thing to see it with your own eyes. My exercise has also made the typical "yes, we collect data/telemetry, but it's deanonymized/secured/etc. and deleted after X days so no worries" sound very hollow; even if a company goes in good faith by their own rules, how am I supposed to trust the other 1000 companies who also do data collection. If someone hacked my mitmproxy itself and downloaded all the payloads it collected, they would probably know me better than I do.

Random examples on top of my head from mitmproxy (when I say "chatty" I mean they talk a lot to server somewhere):

I had GitHub CoPilot neovim plugin. I didn't realize how chatty it was until I did this (although I wasn't surprised either, obviously completions are sent out to a server, but it also has your usual telemetry+AB test experiment stuff). I had wanted to ditch that service for a long time so I finally did it after seeing with a local setup since open stuff has mostly caught up. Also it's not actually open source I think? I had no idea (I thought it would just be a simple wrapper to call into some APIs, but: no PRs, no issues, code has blobs of .wasm and .node: https://github.com/github/copilot.vim)

Firefox telemetry, if it's turned on, is a bit concerningly detailed to me. I think I might be completely identifiable on some of the payloads if someone decided to really take a go at analyzing the payloads I send. Also I find it funny that one of the JSON fields says "telemetry is off". Telemetry is actually on on the menu (I leave it on purpose to see stuff like this); just in the JSON for some reason it says off. I'm not sure if that telemetry is meant to be non-identifiable though in the first place.

Unity-made software (also mentioned in the article) send out a Unity piece at start-up that looks similar to the article, although I didn't take a deeper look myself.

Author mentioned the battery: I also noticed that a lot of mobile apps are interested in the battery level. I didn't connect the pieces why but the article mentions Uber 4% battery surcharge, and now it makes a bit more sense.

One app that has at least once been on HN at high scores starts sending out analytics before you've consented to any terms and conditions. One of the fields is your computer hostname (one of my computers has my real name in my hostname...it does not anymore). Usually web pages have "by downloading you accept terms and conditions" but this one only presented that text after you launch app before you get to the main portion. I never clicked it (still haven't), but I allowed the app mellow on background to snoop on its behavior.

Video games: The ones I've tried seen mostly don't do anything too interesting. But I haven't tried any crappy mobile games for example. One unity game on the laptop, Bloons TD 6 sends out analytics at every menu click and a finished game sends a summary and is the "chattiest" game so far, although seems limited to what the game actually needs to do (it has an.online aspect). The payloads had more detailed info on my game stats though, they should add those to the game UI ;)

Apple updates don't work through mitmproxy (won't trust the certificates). Neither do many mobile apps (none of the banking ones did, now I know what a mitm attack would look like to my bank app).

Some requests have a boatload of HTTP headers. I've thought of writing a mitmproxy module to make a top 10 list. I think some Google services might be at the top that I've seen. (I think Google also has developed new HTTP tech, is it so that they can more efficiently set even more cookies? ;)

I think anything Microsoft-tied may be chattiest programs overall on my laptop. But I haven't done stats or anything like that.

Aside from mitmproxy, I'm learning security/cryptography (managed to find real world vulnerabilities although frankly very boring ones so far...), Ghidra, started learning some low-level seccomp() stuff, qemu user emulation, things in that nature to get some skills in this space. Still need to learn: legal side of things (ToSes like to say 'no reverse engineering'), how to not get into trouble if you reverse engineer something someone didn't like. I've not dared to report some things, and to not poke some APIs or even mention them because I don't know enough yet how to cover my ass.

Modern computing privacy and security is a mess.

I've worked a good part of my career at a DSP company (it would be in the box that says "Criteo" on it on the author's article). So I have some idea what companies in that space have as data.

Sure, there may be the occasional honest actor in the industry, but they're so marginal and outcompeted by dishonest and shady ones that it really doesn't matter. IMHO the right move is to simply ban any collection that's not strictly necessary. Kind of like GDPR but without the "if the user agrees" exceptions.

Reminds me of a regulation about artificial stone (?) being banned in Australia, not because it's impossible to use safely but because the regulator concluded that the entire supply chain is unwilling to and disincentivized from using the material safely, so the best move at this point was to ban it outright.

Edit: found that article

https://news.ycombinator.com/item?id=38634213

And are these getting pulled from the store due to privacy violations? I'd assume Google would be aware at this point?

NSA Warns iPhone and Android Users–Disable Location Tracking https://news.ycombinator.com/item?id=42713536

Hackers Claim Breach of Location Data Giant, Threaten to Leak Data https://news.ycombinator.com/item?id=42627336

What would be the ideal response to such an absurd comment? At the time I found it hard to answer because she surprised me with that opinion.

Edit to note: the explanation should be compatible with a professional context. I don't want to scare my co workers or appear crazy/paranoid.

Does this apply to Brave browser?