Hacker News Reader

Comment by walterbell | Hacker News Reader

The default weather app on Apple iPhones is IBM's Weather Channel, https://support.apple.com/en-us/HT207492

> The weather data used in the Weather app comes from The Weather Channel. If you have issues getting accurate weather information, tap the icon in the lower-left corner to go directly to the weather source.

If you have an iPhone and are in the US, a home screen shortcut to mobile.weather.gov is much safer. Avoid putting the site in web browser new tab Favorites, which will be pinged by Safari even if you don't visit the site. This can be seen with Charles Proxy.

View on HN

Does the stock iOS app forward to IBM the same data the Weather Channel app does?

In current location mode, Apple's Weather.app transmits over HTTPS latitude/longitude twice, once for general weather and once for air quality, both in the GET url.

No other information about you or your device is provided anywhere in the request url or headers. No other requests were made to api.weather.com during "check the weather" testing.

://api.weather.com/v1/geocode/...

://api.weather.com/v2/globalairquality?...

Since IBM has IP address of the request, they can map this to WiFi locations via geolocation. If IBM infers your home WiFI street address, this can be correlated with other data sets (e.g. credit card history) for further analysis, even if Apple does not send additional data in the API request to IBM's weather API endpoint.

As far as I know (and please correct me if I am wrong), geolocation is not quite that magical. At best they can infer who your ISP is and the region your IP block was assigned to.

Some wireless access points have a fixed IP over time, which lets IBM reasonably predict "anyone coming from ipaddr X is probably using wifi Y which is provably at lat/long Z" with sufficient levels of certainty.

This probably works better with "My Home AP Uses A Cute Name That's Hilarious" if your IP rarely changes and you have other software leaking data to IBM, but less well for "xfinitywifi".

In order for that to work in the way I am imagining, it would be necessary for the SSID to be available and correlated to access point's IP address. While this could be performed by wardriving open WIFI networks, it would be harder to gather this on a protected network.

Again, I'm not an expert here, and would be happy to learn more about whether this sort of data collection is possible.

edit: this is quite an interesting rabbit-hole I've stumbled into. It seems that there are databases correlating SSID to location, but aren't collecting IP addresses of those networks:

https://wigle.net/faq

https://wigle.net/phpbb/viewtopic.php?t=1620

If you have a static IP address at home, that IP address can be searched in public geolocation databases online. Try it. It will list a number of possible physical addresses.

That's available freely on the web. Hedge funds and others buying data from IBM can buy data from higher quality sources, including wireless carriers, financial institutions and data brokers.

Most residential ISPs use long lived DHCP leases, and do not issue true static IP addresses.

Do you have an example of an IP address that geolocates to its homeowner's actual address (as opposed to region/city?)

Again, geolocation databases are not magical. This article explains that and some deficiencies:

https://splinternews.com/how-an-internet-mapping-glitch-turn...

Long-lived DHCP leases work. There are many examples, try the client IP addresses from the headers of emails that you receive. Geolocation dbs are not magical, but they are often close enough for practical use.

You do realize this is happening all the time with Android OS, FB's family of apps and most popular free apps that make $ from ads, right?

The default iOS weather app uses data from IBM’s Weather Channel. Your previous comment (re: app) is misleading.

Do you have any references on the data provided by Apple to IBM, e.g. how can Apple provide live weather data for all possible locations without sending your location to IBM? Is the iPhone's IP address (which can be mapped to WiFi location) used to make the weather data request to IBM?

It would be reasonable to expect that as part of TWC’s contract with Apple, they’re contractually required to keep individual location data private. I wasn’t able to find any concrete evidence of this except for the TWC privacy policy for the Apple TV, which seems to explicitly differ from the normal TWC privacy policy in that it excludes the sale of individual-level data to advertisers. (If I’m reading this correctly.)

https://weather.com/en-US/appletv-privacy/

Standard TWC privacy policy for comparison:

https://weather.com/en-US/twc/privacy-policy#us-how-we-share...

I don’t think that Apple has any technical privacy measures in place here, but I would be deeply surprised if, after all their pro-privacy advertising, they allowed a default app to be (at the contractual level) a giant privacy risk for their customers.

Good find. Wish there was a similar public privacy policy for Apple's Weather App, since phones share more data than TVs.

Your top-level reply could be misinterpreted to say that Apple ships an app called "IBM Weather Channel" on phones.

They do not.

Apple ships an app "Weather", which currently uses api.weather.com as the data source.

IBM Weather Channel operates api.weather.com.

TLDR: You're both right: it's Apple Weather, and it requests from IBM directly. https://news.ycombinator.com/item?id=18822350

Reply on news.ycombinator.com