Hacker News Reader

Comment by sixbrx | Hacker News Reader

"Many of these trackers are also available in the Apple iOS app store, though technical and legal barriers limit privacy and security analysis."

https://law.yale.edu/yls-today/news/isp-privacy-lab-publishe...

And from https://boingboing.net/2017/11/25/la-la-la-cant-hear-you.htm...:

"As Exodus and Yale note, these trackers are almost certainly also present in iOS: the companies that make them advertise their iOS compatibility, for one thing. But iOS is DRM-locked and it’s a felony – punishable by a 5-year prison sentence and a $500,000 fine for a first offense in the USA under DMCA 1201, and similar provisions of Article 6 of the EUCD in France where Exodus is located – to distribute tools that bypass this DRM, even for the essential work of discovering whether billions of people are at risk due to covert spying from the platform."

View on HN

In four years of developing iOS apps I can't think of a single client that didn't want some kind of third party analytics service installed. This is SOP for pretty much anybody trying to drive user growth on mobile and isn't specific to one platform or the other.

Would it be more pro-privacy than anti-developer if Apple sensible integrated such analytics into its platform?

Apple does now offer integrated analytics in iOS but it's pretty limited compared to what the third party services offer so it's not really a viable replacement for most people yet.

Worse still - on iOS there's no way to block this kind of stuff. On Android there's both VPN and hosts file based blockers as well as extremely capable tools like XPrivacy for those who really want to get down and dirty.

Try launching one of the top games with XPrivacy installed. You get to click allow for the dev's server and block to 5+ 3rd party analytics, crash reporting and ad services. I'm sure many of these provide developer value, but there's definitely a harm to user privacy.

Try Adguard's DNS content blocker. I bought the pro version to control access with a custom VPN, and that enables it to filter your cellular traffic, not just wifi. The app runs a local VPN on your iPhone, and you can block analytics domains. Here are some things I've blacklisted and prevented common apps from connecting to: settings.crashlytics.com data.flurry.com graph.facebook.com google-analytics.com adobemobiledev.sc.omtrdc.net api.leanplum.com

So you can deny connections to a lot of shady websites, and in total I'm blocking around 100 different domains.

No more web fonts from Google, no Facebook or social media connections through apps or websites, and it's great.

The data the trackers can gather is more restricted but the principle remains the same. I've installed various of different kinds for my customers. Most of them are simply tracking what users do in an application to see how they can be improved but I've seen an app that uploaded your whole contacts book immediately (when it was still allowed, not the case anymore).

I'm not too much in the know about Android permissions. I know it improved a lot lately but I think still some permissions are still accepted silently on install.

Gathering data about the movements of your users within your application can really be helpful, I draw the line where things get shared with third parties or excessive data is gathered.

Reply on news.ycombinator.com