Hacker News Reader

Comment by IAmGraydon | Hacker News Reader

Placer is able to track cell phones that have an app installed that uses their SDK. They currently have their SDK in over 500 mobile apps. The data is anonymized, but it would probably shock people how much information I can get from this system. I just pick a location and I can see how many people walked into that location over any time span in the past 4 years, where they live, how much money they make, where else they like to shop, etc. I work in commercial real estate, BTW. We use this software to analyze retail properties.

View on HN

Is there a list somewhere of apps that use placer so that I can delete those apps off my phone forever?

There was a flagged submission about a year ago about them

https://news.ycombinator.com/item?id=22704138

I’ll go on a limb and say that apps don’t even have to integrate Placer’s sdk directly. If an app uses any monetization/tracking/ad tracking system, that tracking vendor may collect the geo data and then re-sell it to Placer (i.e. talk to Placer via a server to server API to let them know about the end user)

How much geo data can they obtain if my location is disabled for almost all of my apps?

1) A device's location can be guessed with your IP address at the very least.

2) Wifi networks.

On iOS, I'm almost sure that apps cannot access the list of wifi networks that the device sees. As you may know, the list of wifi access point MAC addresses can be used to triangulate a device's geolocation (there was a related case with Google Streets View cars gobbling up that info[0])

On Android, wifi network MAC addresses may be available to apps? Is there a special permission that apps need from the user?

[0] https://www.wired.com/2012/05/google-wifi-fcc-investigation/

Android requires location services enabled to do ambient WiFi scans: https://developer.android.com/guide/topics/connectivity/wifi...

However, I believe connected WiFi information can be obtained on Android without location services enabled.

On iOS, I believe an app needs special permission even to fetch connected WiFi, and I believe you are correct that there is no way to access ambient WiFi scans.

Super interesting, thanks!

> However, I believe connected WiFi information can be obtained on Android without location services enabled.

Correct, you need the "Access network state" permission (renamed to a more sensible "View network connections" in more recent versions of Android).

However, to my knowledge neither the play store or Android system warn/ask you about this permission so to avoid it you have to explicitly check every app you install.

I believe the function is "Wi-Fi scanning" in the networking settings tab on Android 11.

Placer is one of many, many platforms that do this. Assume any app that requests location permissions is selling your data. Hopefully anonymized.

A few months ago I chose a random set of iOS apps to decompile and view their included libraries. Its amazing how much tracking is going on. One interesting that I recall was a Bluetooth library in a convenience store app. Seems like they had Bluetooth beacons around there store and it would use the phone to track you as you walked through the store.

Doesn't Walmart do this?

I recall the CVS app requesting Bluetooth permissions when I installed it. I can imagine them implementing something like this, but couldn't they just passively listen for Bluetooth beacons from people's phones using the devices in the store, without needing the app to be installed on a customers phone?

I suppose I'm not familiar enough with Bluetooth - I figured phones with Bluetooth enabled are constantly sending out some kind of "hello" beacon.

The beacons in the store are pretty dumb, so they can be cheap (on the order of a few dollars each) and plentiful, moving the real logic of tracking to the app.

You're correct in that it could be reversed and the BLE radios in the store could track the phones instead, but then they'd need far more intelligence and network connectivity, which would make them more expensive and in turn they'd be fewer of them deployed.

Source: spent the last few years writing code for wireless devices, including BLE beacons.

If you're on iOS, leave location services to "while using app" to prevent this. I take the extra step of turning background services off.

This is also Foursquare’s business.

Their opt-out page is interesting: https://foursquare.com/data-requests/

“The California Consumer Privacy Act gives California residents the right to direct businesses from selling their personal information. If you are a California resident, you have this right. If you are not a California resident, we may, at our discretion, grant you this right.”

(Emphasis mine)

Wow, this seems like incredibly valuable information for traders and hedge funds. There is a well known retail analyst (Mathew Boss) who famously said they take aerial photos of mall parking lots to estimate traffic and sales. This data is even more granular.

Yeah, commercial Satellite data "intelligence" is a big thing. (This is clearly the "civilian" version of what has been going on in the military world for a very long time)

I wanted to send this example as it's exactly what you're talking about -- monitoring of retail locations (as a data service):

https://learn.rsmetrics.com/trafficsignals/retail/monitoring...

... but I found this from the same company which is crazier:

https://learn.rsmetrics.com/cedm/boeing-tracker

"RS Metrics Boeing Tracker is a custom event driven monitoring product which focuses on the activity and production at Boeing factory sites. Insights generated from Boeing Tracker help investors and PMs' to optimize their investment strategies."

Among other things, they're counting cars at the Boeing Employee Parking Lot:

https://learn.rsmetrics.com/hubfs/BA_2_Boeing%20Renton%20Fac...

Yeah, ok. Wow.

As I understand it, this is also how proxy services that offer "mobile IPs" with millions available function as well. Kinda makes me pine for the good old days where they just annoyed the crap out of me with ads.

My cellphone doesn't leave my home. Makes location tracking much harder.

To clarify, I wasn't talking about them tracking you, I was talking about the SDKs used proxying connections unbeknownst to you using your mobile (or wifi?) data, which the SDK provider sells as a business.

Also beats the point of having a cell phone.

Isn't the point to play games and being able to login to most sites these days?

It also gives you backup internet..

Not really, not for me and many others anyway. I would just get an LTE modem for backup internet, my PC is better at everything else. I'm not sure about which sites you're talking about, but you can also do 2FA without a phone.

There are a ton of big companies and even governments that only do SMS 2FA. The US social security website is one of them.

I'll bite. Where I live and where I shop, I can understand. But how does my cell phone know how much money I make?

It might correlate it with other vendors and signals (e.g., your trail of visited web sites, completed purchases, etc.) and also deduce it by monitoring your geo position to find where your “home” is (wherever you spend most nights / wherever you use your apps late or early in the day) and then use zip code area demographics to get the average income for that area.

Oh… and, credit card companies selling data (to these same data aggregators) on their members’ buying habits and most probably demographics as well (age, income, etc.)

It's crazy how much just having your location tracked 24/7 shows about you. It can give a pretty good idea of if you're in a relationship and sexually active (where you spend your nights and when/how often), if your parents are dead and if you're married or divorced (where you go for holidays and when you stop going there), what your life expectancy is (your zip code), if you have children (when and how often you visit schools, day care centers and play grounds/chucky cheese), what you do for a living (harder now that more folks work from home), how healthy you are (time spent at doctors/hospitals/fast food restaurants/gyms), etc.

Tracking one person's location history is invasive enough, but if they're also tracking the people around you it gets a whole lot easier. Phones spend time talking to and tracking other phones around them (even when those devices are offline or have location services disabled) along with being tracked by Bluetooth beacons and collecting info about nearby wifi connections.

There are other companies that keep track of that (experian, trans union, quick books, etc) that get this from everything from your employer's bookkeeping software to your credit applications. And they sell your data. So if they know where you live and an app knows where you live ...

They can tell by where you shop and where you live.

I don’t want to live on this planet anymore.

Well one of the first things we do on Mars will be to deploy a GPS constellation so our robots are able to locate themselves.

Appreciate the response, super interesting! What do you mean how much they make? Like how much the retail makes or how much the people visiting makes?

Reply on news.ycombinator.com