Hacker News Reader

Comment by saddlerustle | Hacker News Reader

Which company, apart from Facebook, Google and Apple, would remotely have access to any of the data on that list? Facebook Google and Apple don't share data with data brokers.

View on HN

Up until very recently, a lot of this could be done by any of a number of innocuous looking apps with tracking toolkits installed. Sometimes knowingly, sometimes not.

Even now, the problem is that you want the data sometimes. Like maybe you use Life360 because it's handy for your family. Well, it knows how fast you drive (it likes to tell me my wife's top speed after she goes somewhere...). It has enough accelerometer access to decide if you've been in a wreck. It's a GPS app so of course it has pretty tight location information. And maybe you consent to all this, but hidden somewhere in the TOS it says Life360 may share this info with selected partner companies. Now it gets slurped up by big data warehouses.

Maybe you install a sleep tracking app. Now they know how well you sleep, and I would bet they could pretty accurately figure out if/when you're having sex. Depending on the device, they might even be able to guess whether or not it was solo.

Perhaps you don't like the limited options Apple has for pedometer data, so you install Pedometer++. Another possible avenue for data collection.

Or Instacart, Uber, Uber Eats, etc.

So. Much. Data.

This is a good point and a good reason to prefer first-party apps!

No need to hide it, Life360 clearly states right near the top of its privacy policy "In order to keep our Service free for most users, we generate revenue through trusted data partnerships. We share device data, including location and movement data, with trusted data Partners for tailored advertising"

Akamai and Microsoft.

When your Apple device communicates with "Apple", many/most of those IP addresses are owned by Akamai.

Even when you search DuckDuckGo, both the search results (Bing) and web servers that serve the content are owned by Microsoft (Azure).

That covers one or two of the list I suppose, but is there any reason to believe Akamai is lying to its customers and harvesting their users' data? I can't think of any incentive for them to do that, it would be brazen fraud for an insignificant revenue source.

Akamai's privacy policy on personal data: https://www.akamai.com/us/en/privacy-policies/privacy-shield...

I wasn't trying to make a point other than sharing examples of companies, like Akamai, that store a lot of personal data on behalf of others. Storing data with Apple is storing it with Akamai, and all of the other third parties involved--where "third parties" becomes a blanket term in privacy policies and not an exhaustive list. The "chain of trust" in this regard has some missing links.

So far as their businesses are concerned, the data is safeguarded and I would never expect it to be sold--not by the top of the data food chain in any case.

But there's the issue of data being stored with US companies requiring being subject to US laws, such as the USA PATRIOT Act.

Dating sites would have that kind of data and have been breached in the past (Ashley Madison was one high profile instance, as I recall).

I've somehow never heard of this, that's a wild story.

I don't recall the Ashley Madison leak having anything remotely similar to the data on OP's list.

I was replying a later comment that was considering whether that list should include knowing who you’ve slept with.

You cellular company has first party signal data, that even the big tech companies don't have.

All the internet access examples on that list would use encrypted connections, so a cellular company wouldn't be privy. Cellular companies do have course location data, but to be pedantic that doesn't really apply to any of OP's list.

Server name indicator from ssl is not encrypted and neither are most dns queries.

> use encrypted connections

TLS SNI.

I have a bridge to sell you.

"Gmail messages 'read by human third parties'" https://www.bbc.com/news/technology-44699263

"One company told the Wall Street Journal that the practice was "common" and a "dirty secret". ...Google indicated that the practice was not against its policies."

That article is just describing gmail APIs, which requires explicit user consent via oauth to enable. This is no more shocking than gmail supporting IMAP.

"The companies said they had not asked users for specific permission to read their Gmail messages, because the practice was covered by their user agreements."

Regardless of what those third party companies told their users, users would have had to accept a pretty clear dialog [1] delegating access to their Gmail accounts. That's just how google oauth works.

[1] https://i.stack.imgur.com/aBTMm.png

Reply on news.ycombinator.com