Ads in Popular Apps Give Police a Powerful Tool to Spy on Users

> The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps. is there a list

• nik282000 · 10 hours ago

  Don't use apps. Use your browser and an ad blocker.

  • TFNA · 10 hours ago

    A significant amount of the internet for normies today is app-first, where there may be no web version, or the web version lacks much of the core functionality of the service. Instagram led the way with this before Covid already, but the practice then spread widely. The savvy crowd on HN hopefully already knows how to protect ourselves, but we can't really expect the mass public to do so. Especially when some younger people today are losing awareness of the very concept of the browser as they use dedicated apps for all their internet use.

    • nik282000 · 10 hours ago

      Sucks to suck. If a service is sub-par in the browser I don't use it. Be ThE cHaNgE yOu WaNt To SeE. I hate that sentence but it kinda applies here.

      • ranger_danger · 9 hours ago

        I have tried for years but it just doesn't make a difference if enough people in the world don't care loudly enough. Banks are relying on Play Integrity protection as well as SMS-based 2FA, neither of which are both safe and private.

      • infinite_spin · 9 hours ago

        browser based applications can still gain access to this data, using very similar workflows. E.g. a weather app rendered on a browser is still going to request your location, and can fingerprint that browser to build a user profile. I'm not sure your solution is a solution at all.

      • exe34 · 8 hours ago

        Unless you have friends, of course, and want to keep in touch. (Not a problem for me).

• fancyfredbot · 10 hours ago

  In Android apps need to request location permission. You can reject it and/or uninstall those which request it. Most apps will only be able to request location while running in the foreground. Weather apps are unusual for having a reason to request background location access and so you should treat them with particular suspicion.

  • Terr_ · 9 hours ago

    I regret that we've moved away from a world where you could easily tell your device throw a privacy-preserving bone to pesky apps. ("Sure, you've got location access, but it'll only show my house, you don't get to see where else I go.") Instead our ownership and agency has been sacrificed on the altar of "but BigCo doesn't like it because users can lie."

    • fancyfredbot · 9 hours ago

      You kind of can, but it means rooting the phone after which you can't run banking apps etc. Personally I am okay with my bank app doing this but I'm probably in a minority here.

      • Terr_ · 1 hour ago

        A compromise might be that only certain special classes of apps can get the "don't lie to me" status, where a bank's app has to prove it's a little different than some "tired of our website try our app" thing or the average shovelware.

  • BeetleB · 7 hours ago

    > Weather apps are unusual for having a reason to request background location access Not really. I can just set the location in settings.

• mzajc · 7 hours ago

  Exodus has a list of applications with known spyware libraries: https://reports.exodus-privacy.eu.org/en/reports/list/ . The homepage has search and also lets you re-analyze applications if there's no report or it's out of date. There will be false negatives for first-party spyware and sufficiently-obfuscated vendored libraries, but from my experience this is exceedingly rare.

  • jareklupinski · 7 hours ago

    > https://reports.exodus-privacy.eu.org/en/reports/253268/ Solitaire ah beans

Google appears to be overlooking their explicit ban on this. If your app handles personal and sensitive user data, then you must ... Not sell personal and sensitive user data. The rule also applies to third-party code. If you include third party code (for example, an SDK) in your app, you must ensure that the third party code used in your app, and that third party's practices with respect to user data from your app, are compliant with Google Play Developer Program policies... For example, you must ensure that your SDK providers do not sell personal and sensitive user data from your app. https://support.google.com/googleplay/android-developer/answ... Isn't this abuse what we are supposed to be paying their 15% Play Store tax to stop?

• benoau · 10 hours ago

  World would be a much better place if Google and Apple enforced their chosen policies for apps, and Meta and Google enforced their chosen policies for ads, but then these companies would be very slightly poorer.

• LoganDark · 9 hours ago

  This just means you can't get money for the personal and sensitive user data. It's wild that companies think that's the problem. Webloc is getting this data for free . And then reselling it, but it's outside the scope of Google then.

• Vaushite · 8 hours ago

  The tax is 30% and the purpose of a system is what it does

  • gustavus · 8 hours ago

    Come On, Obviously The Purpose Of A System Is Not What It Does https://www.astralcodexten.com/p/come-on-obviously-the-purpo...

    • Vaushite · 2 hours ago

      This guy just hasn't understood the phrase, he's picked several strawmen to argue against. Not literally everything a system does is its purpose, so you can't just pick the stupidest ones and use them to disprove the principle. How about "the purpose of a system is not something it doesn't do" or "the purpose of a system is some of the things it does" but that's not as catchy.

There's no good reason to use your phone for any more than the bare minimum. Remove as many apps as possible. Treat it like a landline by just keeping in on a desk or something when you're at home.

• infinite_spin · 9 hours ago

  That's not the way I want to live. I want to enjoy technology and enjoy privacy, and since those aren't mutually exclusive, it's reasonable to expect both.

• prism56 · 8 hours ago

  At least use the browser for every service you can that wants you to use an app. Bonus points if the adblocker is enabled.

This is why network-wide dns ad-blocking is necessary. Setup a personal ad-blocking vps/vpn to route traffic through when away from home: https://trailofbits.github.io/algo/

• nullfield · 7 hours ago

  Are we back to trusting Ubuntu these days? Why can’t this support Debian, or…? (Yes I know see the FAQ)

So I let a company know my location, and they turn the data over to the pigs. Not good.

I’d rather give my info directly to the party at this point Shouldn’t have bullied tiktok into selling for US users

Code your own apps, run your own things.