Comment by baybal2 | Hacker News Reader

Comment by baybal2 | Hacker News Reader

Parent Full thread

This is what comes out of Google allowing apps to read phone IMEI in Android. I have no concrete proof, but the reason why all major Chinese apps snoop after phone IMEI is said to be that the commies have secretly demanded Chinese dotcoms to collect and report phone IMEIs.

For example if you have a 6.0 or later Android, Alibaba app will block you if you disabled the permission to read IMEI or it detects spoofing.

https://postimg.org/image/m5u0nmdxd/

It is easy to see how they also use it for their own purposes: open a new taobao account, search for some items, do factory reset, install taobao and see that you are being shown same stuff you been searching before. This way they also clearly violate Google store rules that prohibit using IMEIs as tracking IDs for marketing purposes. It was reported over so many times, and Google clearly knows of this. I guess, they are afraid of antagonising "the premier Chinese dotcom" or still considering going back to China.

    > Google allowing apps to read
    > phone IMEI in Android

An unpopular sentiment, but this is why I love iOS. I genuinely don't think any of my apps can meaningfully spy on me without my having told them they may. I even get reminders if I've let an app read my location in the background, to check that's what I want to do.

This is exactly why I use iOS over Android on my main phone. With iOS, I only need to trust Apple (approximately). They have a pretty good track record of respecting their users' privacy, and enforcing app vendors to do the same.

With Android, I need to trust a lot more parties, like Google, the hardware vendor, and every app I use to not do something crazy or shady without asking or notifying me first.

Well, I thought the same about Microsoft. Back in the days, Microsoft had a good track record. And you bought the product, they were the biggest software company, etc.

But late Steve Palmer and especially Nadella changed Microsoft completely. Nowadays, the user is the product, Windows 10 spies on you and send keystrokes, audio, install apps and what not to various IP adresses, you cannot deactivate it, ads in startmenu, pre-installed adware apps, etc. And Snowden revaled that Microsoft was the first company to hand over data (Hotmail/Live/Outlook.com). So the trust in Microsoft is gone.

I hope Apple keeps it good track record.

Even though I like Android more, I have to agree that iOS has had a better privacy story.

But even iOS has problems. For example I cannot force apps like Waze or Uber to only use my location while using them, you have to either disable location for them completely, or to allow them to take your location while running in the background.

It's an either/or proposition and the result is that Waze and Uber users do have their location tracked, because the apps are not usable with the location completely disabled and enabling location on demand is too painful. While in traffic, imagine sitting at a red light, wanting to turn on GPS navigation to take you home or something and having to enable location in iOS's settings.

And you may have given them permission, you may know about it, but are you going to stop using Waze and Uber if you don't agree? I think I know the answer for most people. And also, even with your permission, as a matter of fact it's still irresponsible to let them track your location in the background, even if you currently trust those companies.

I don't think iOS is to blame for the binary choice that you get with Uber / Waze. I have some apps which have three choices in the location services settings (Always, While using the app, Never) so it seems like a choice by the developer.

Well Apple could have made the list unmodifiable so that application can't "opt out" of the "while using the app" setting.

That wouldn't achieve much, apps already tend to give rationale for those settings, the apps could just say "If you dont choose Always, we're done here" (they already do that for "Never") and people would just be conditioned to accept Always

The application wouldn't have a way to see that. If you select "When Using" it would just not get any geo info (or even backgrounding time) when not in active use.

But then every app would just go for "Always" in case they ever wanted to change it in the future and we'd all lose.

You misunderstand. The list is for the user to choose, not the app developers. As it is now, Apple allows app developers to disable the middle choice for users, instead of forcing them to support it if the user so chooses.

> As it is now, Apple allows app developers to disable the middle choice for users, instead of forcing them to support it if the user so chooses.

TBF they also allow disabling the final choice, most of my applications (including many built-in applications like Calendar or Maps) only have "never" and "while using the app".

Ah, you mean apps should always have to support the options of "Never", "While using", and "Always" rather than the app specifying which it supports? Sure, makes sense, and I would be on-board with that.

Removing "always" could make sense for an application not needing it, but that aside yes, the "never" and "while using" choices should always be present.

Er… what? The application can't "change it in the future" in the first place.

Uber went from allowing "While using the app" + "Always" to only "Always".

I was perhaps misunderstanding the parent as suggesting that once an app has allowed "While using the app" as a choice, that could never be removed - ie Uber would still have to allow "While using the app" as a choice.

If that was the case, apps might avoid offering the "While using" choice in the first place if they might ever consider the need to remove it, no?

I was suggesting that no application should be allowed to remove "while using" ever, regardless of what they initially offered.

that is the current permutations which an application can provide are:

* no, using, always

* no, using

* no, always

I do not think the latter should be allowed.

I would definitely be on-board with this proposal (or "for one hour, until the end of the day" similar to "Find Friends".)

Allowing "While using the app" to cover ~10 minutes of background work after you switch away from the app would fix the Uber issue - at the expense of creating a whole world of confusion about what "using the app" actually covers.

An alternative would be a temporary grant for an hour / until the end of the day like you have with "Find Friends". But working out the UX and UI logistics of that are beyond my skills.

> For example I cannot force apps like Waze or Uber to only use my location while using them, you have to either disable location for them completely, or to allow them to take your location while running in the background.

What if one quits the app? Then it's no longer in the background and can't track your location, right?

Isn't that good though? It allows competitors to appear with that advantage of having better privacy. I mean, the problem is not the way iOS handles it, it's the way app developers abuse their permissions.

The Uber thing pisses me off, but I've found an easy way around it: Call your cars from city mapper. All the coords get passed along and you're depriving uber of the data they want. Win-win really.

Yeah, those are valid concerns.

The other thing I'd like is incompatibility with password managers being an automatic approval fail for the app store, in particular fields that disable paste for passwords.

This was the primary reason I chose iOS over android.

Not so unpopular...

Historically unpopular :-)

On Android 6.0+ you can deny the READ_PHONE_STATE permission and stop using apps that won't work if you do. A quick search seems to indicate that there is an Alibaba app for iOS. Do you think Apple negotiated that the IMEI isn't required for the iOS version?

Personally I don't trust Android (or the hardware companies that sell Android devices) or iOS but picked an Android 6+ device because in principle I'd rather have an operating system that's more open. AFAIK all the Apple privacy stories have been about US cases so as a non-US person I'm also not sure they'd apply the same standards to me.

> Do you think Apple negotiated that the IMEI isn't required for the iOS version?

Didn't need to negotiate anything, on iOS the IMEI has never been programmatically accessible[0], and other "global identifiers" (UDID, MAC) either weren't ever accessible or were removed afterwards.

You can get an "advertising identifier" which should only be used to hand to ad networks (your application can get banned if you use it otherwise) and a "vendor identifier" which identifies the device to the app vendor only.

[0] via public frameworks, you can get it from the private NetworkController class but that will get your application rejected from the appstore. You're "at risk" if you sideload applications though.

And, BTW, in iOS you can reset the advertising identifier in Settings -> Privacy -> Advertising.

I'm on 7.1.1 and I don't feel like installing the Alibaba app to try this out but when you say it requires the permission to read IMEI is this under the phone permission setting that says "read phone status and identity" or something else?

appears that they put it into that now

Please ELI5; What info about your actions can IMEI info/actions give anyone with access?

I'm not really clear on why it's that much worse than having your phone number; with the right access, the phone number is all you need to track a user across global cell networks anyway.

Though the IMEI should be exposed to a Stingray type device, so you'd be able to track users without access to the cell networks, you'd just have to set up a bunch of radios.

And you wouldn't be able to shake it by swapping SIMs. That said, most users wouldn't bother with changing phone numbers or SIMs.

Also, after paying for or otherwise gaining access to SS7[1], the IMEI may also allow more active types of attack[2].

[1] https://en.wikipedia.org/wiki/Signalling_System_No._7

[2] https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271...

Tracking people (phones) across apps and services.

And networks. Worldwide.

Reply on news.ycombinator.com