Hacker News Reader

Comment by heywire | Hacker News Reader

I think many people would be surprised by the amount of analytics data leaving their phone _all the time_. I recently was doing some work where I had my iPhone proxied through mitmproxy on my laptop, and was blown away by just how much data was being sent. Some apps were sending a request to one or more analytics firms every single time I touched a UI control. I would set up a pi-hole and VPN to block this stuff, but I'm sure the app developers will just start tunneling the requests through their own hosts. Maybe some day one of these open source phones will actually be viable.

View on HN

I wish the AppStore review team would simply reject any app that generates unnecessary network traffic for no good reason.

They don’t even need to MITM the traffic. Just the fact that an app makes network requests when using a supposedly offline feature should immediately get them rejected.

And iOS should introduce a visible network activity indicator that can’t be manipulated by applications, like they do for location tracking.

I fully 100% agree with this. Apps should require user permission for network access. Further, the user should be able to control what domains/hosts the app has access to. The user should be able to have feedback indicating that the application is communicating over the network at what times and with how much data.

> Apps should require user permission for network access.

I think this is already a thing in China.

> Further, the user should be able to control what domains/hosts the app has access to. The user should be able to have feedback indicating that the application is communicating over the network at what times and with how much data.

This is difficult to do, since it's easy to swamp the user in prompts for every little thing.

> it's easy to swamp the user in prompts for every little thing.

I don't see this as a bad thing. It will let me quickly see what apps are built not following best practices.

Not all people value privacy over convenience as you do.

I would even surmise that a user's patience threshold for that kind of annoyance these days is pretty low.

I don't have patience for that either. I'd just uninstall the app.

Have you ever used an application level firewall like Little Snitch? I have tried using it a couple of years back, and gave up after less than an hour.

In principle it's nice to be able to manually allow / reject individual requests, but in practice you can't get anything done if you do. Popups keep popping up all the time, and it's rarely clear what the request is good for. Then you get random failures, because you accidentally blocked an important request, or you just allow anything anyway, because there really is no way to know if that request is good or bad.

And that's from the perspective of a software developer who understands what protocols and ports and addresses are.

A firewall like that would be absolutely useless for non-technical users.

You're spot on with the network activity indicator. And that network activity indicator should divide foreground/background traffic. Sometimes I want that network traffic, and sometimes I don't. It should be information given to the user.

I would love a Little Snitch for iOS.

I’d go further: I want a screen in Settings for every app, that shows me what it contacts, and how much data it sends, with the ability to block anything I don’t like on a per-app or global basis.

Basically I want Little Snitch built into iOS as a core feature. Hiding it behind “Advanced..” is fine.

https://guardianapp.com/

I use this app. So far, it blocked 1108 data trackers and 3 locations trackers.

I used to work for Crittercism (now Apteligent), but I don't claim to speak for them in any way. I can state that while I was there, I never saw anything even remotely creepy being done with the data that was sent to them. As a baseline, I'm a card-carrying member of the EFF and my definition of "creepy" is a lot easier to meet than most peoples'.

A typical setup would work like this: when you launch an "instrumented" app, it generates a UUID. Then whenever a user interacts with the app, it would send messages like "UUID 1234... launched app version 3.14. UUID 1234 clicked the 'home' button. UUID 1234 viewed their profile page. UUID 1234 searched for a video. UUID 1234 played a video. UUID experienced an OutOfMemory exception in module foo, line 942." These were aggregated together so that you could run reports like "among people who experienced the OutOfMemory exception in module foo, line 942, how many viewed their profile page first?" That allowed developers to very quickly focus on the exact steps required to reproduce a specific problem.

So sure, apps were gathering a lot of information about what you were doing, but it really was genuinely for your benefit. There was no way for customers to run queries like "what video was heywire watching?" or the like. Everything was 100% focused on being able to quickly and accurately identify the cause of crashes. Now, that was just one company and it was several years ago. Maybe every other company was creepy? Maybe Apteligent is, too, now? I don't know. I don't have any insider knowledge into the current state of things. But at the time I personally witnessed it, I would have felt very comfortable at an EFF meeting explaining how every byte of metrics information was being used.

That steps way the hell and gone past my creepiness threshold. Being able to justify it in your own head as being "for [the users'] benefit" doesn't change the fact that there's a shitload of raw data there that the users wouldn't voluntarily provide if they knew about it.

I like what Apple does, they ask you if you'd like to automatically submit usage data and crash reports, and you can opt out without any loss of functionality. I have no idea what % of users opt in, but as long as some people opt in, it'll be win-win for users and developers.

In this specific case, given what I've told you about the kind of data they collected, how it was used, and how it was surfaced to the consumers of the data, what specifically about that data flow bothers you?

> I've told you about the kind of data they collected, how it was used

No, you've only talked about what currently happens when everything is working properly. What happens if the company ends up in financial trouble; to they have a Ulysses Contract[1][2] on record that binds their future ability to monetize all of this data? Without legal enforcement, we just have to hope this company will somehow resist the temptation that most other companies are not able to resist.

> what specifically about that data flow bothers you?

> it generates a UUID

That's obviously personally identifying, which it's a header in all of the analytics you describe. Just because it's synthetic doesn't make it anonymous. Once it's mapped back to other information - which is trivial if you correlate IPs[3] or event timestamps[4] - this type of analytics is only an INNER JOIN away from being merged into someone's pattern-of-life[5].

The problem isn't what happens when everything works as intended. You need to also prepare for when (not if) your data is merged into other databases, and what others might do with the data in a future.

[1] https://en.wikipedia.org/wiki/Ulysses_pact

[2] https://www.youtube.com/watch?v=zlN6wjeCJYk

[3] https://news.ycombinator.com/item?id=17170468

[4] Take a set of "UUID 1234... launched app" events for a common app that is regularly launched e.g. when someone wakes up (or whenever). Correlate those times to other times that also happen to be launched (or webpages/email visited) at similar times. What are the odds that two unrelated people just happened to open different apps [..., 2019-02-04T10:11:22, 2019-02-06T10:17:44, 2019-02-07T10:14:52, ...] (+/- maybe 30 seconds)? A unique identifier and a few high resolution (seconds) timestamps can easily identify someone uniquely when you have enough data points.

[5] https://en.wikipedia.org/wiki/Pattern-of-life_analysis

Literally every app that uses firebase can do this, and firebase is pretty much the standard for scalable apps for the indie dev

The problem with analytics data is that it can look harmless, but it's easy to to convert seemingly trivial data into tracking points. For example, consider this: UUID 1234 always watches video between 16:00 and 17:00 UTC, and then again after 02:00. This gives you a pretty good idea where UUID 1234 lives, as well as their daily schedule (perhaps they have a job during that period? Maybe the fact they don't watch video at 21:00 means they went out to eat that day?)

That's true if you actually collect any identifying information about UUID 1234. If I, as the consumer of the data, can't tell whether they're in Los Angeles or Beijing, then that information doesn't tell you much.

I can say that at the time I was there, it was not possible for a developer logged into our system to suss out any fine-grained information about a particular user. They just got aggregated data like "92% of people who experienced this symptom did this other thing right before it happened".

Wouldn’t IP addresses be routine information collected by apps that collect information over the network? That by itself would give away the location to a good degree of accuracy in most cases.

On mobile no it wouldn't. Often enough it barely even gives away the country. When roaming with Fi in Europe I have a US IP.

> So sure, apps were gathering a lot of information about what you were doing, but it really was genuinely for your benefit.

For my benefit without giving me a clear understanding of what was being collected or the option to opt out. Gee, you really shouldn't have.

I find the user-aggressiveness of some of these techniques to be insane. I have a similar setup to you and have two pi-holes for DNS on my home network propagated to all devices include a few smart devices. On any given day roughly 45% of my home traffic (3-6 people) is blocked by pi-hole.

Aside from the Librem 5, have you thought of buying an Android phone you can flash, flash an open source ROM (LineageOS), and only use FDroid?

Yes I know that you still have baseband + binary drivers, but at least then all of the apps are open source, and so is the OS.

Yes, definitely. One of these days my freedom loving privacy aware side will win out against the side of me who enjoys the convenience and ecosystem of iOS :). At this point my entire extended family is on iOS, and use several of the iOS only features.

Haha that's fair!

Out of curiosity, what iOS features do you use? I ask because one thought you can do is have that as a phone and an iPad, so you can segregate your very private stuff and still use an iPad for iOS features

Certainly nothing that couldn’t be done on another platform, but Apple has done a great job of locking us in. iMessage (including playing the games via iMessage), FaceTime, the built in location sharing features, sharing app purchases, etc. All easily replaced with alternatives, but the friction to get everyone to switch over is tough. My personal systems almost all run Linux, and I do have an android tablet, but for my main communicator, iOS is just so convenient.

Gotcha. I am "that guy" in my family as almost everyone else has iOS, so I don't share in a lot of that.

One thought for you, I just had my Nexus 5x die, but I got a Sony Xeperia XA2 for $150 and I flashed it with lineageos. See if you can use it and ween yourself off?

I should take a look at mine and see what its like. I have a degoogled android phone with fdroid so I don't expect it would be too bad. Is there any way to do it so you see the data before encryption?

I done this recently and almost every app was using certificate pinning, so seeing the actual data was difficult. My sokution in the end was to setup a tiny vm with dnsmasq setup to forward all requests and log then as it does so, then just tail the log. There was remarkably little caching going on in the device so almost every actual trigger a DNS query.

Alternatively setup Pi-Hole for testing.

Microsoft Edge (on Android) was the worst offender, contacting vortex.data.microsoft.com almost constantly, on almost every UI action I made. Other notable were the amount of apps contacting analytics servers in the background, when the app as (from an end user perspective) not even running.

If the app doesn’t pin a cert then mitmproxy should allow you to decrypt the data

Exactly this. Mitmproxy makes it very simple to download and install the root certificate on your device. Just don’t forget to remove or disable it when you’re done.

Windows collects even less data, yet people mention telemetry in almost every post related to Microsoft.

Reply on news.ycombinator.com