T-Mobile has started selling your app data to advertisers | Hacker News Reader

T-Mobile has started selling your app data to advertisers

androidpolice.com

58 pointsraybb23 comments

From the article:

"T-Mobile does not currently collect app data on iOS users, fearing it could run afoul of Apple's privacy rules. ...you can opt-out of T-Mobile's program using its official "Magenta Marketing Platform Choices" app."

Lol, install a spyware app to opt out of their spyware? Something something Inception?

Presumably you only need to have it installed briefly to opt out.

I wonder how Apple would react. There was rumors years ago that Apple wanted to start their own cell service and currently, the only thing they don't control on iPhones is the data connection. I can foresee a future Apple wanting to close that gap.

Apple has already reduced MNOs to 'big dumb pipes' [1]. Hard to see the motivation to take over a low-margin and mature business.

Their motivation seems to be to gradually reduce in size, and eventually eliminate SIM cards - presumably just to free up internal volume. But they've been successful in forcing MNOs to do that anyway.

[1] https://en.wikipedia.org/wiki/Dumb_pipe

This has nothing to do with "running afoul of Apple's privacy rules". Apple has effectively killed the IDFA, so even if T-Mo built a profile of an iOS user, there's no "key" to be used later on to identify the user when they try to show an ad based on the data collected.

> T-Mobile uses network-level tools to track the apps that people use on their phones

How does this work? Does it use heuristics to associate traffic patterns or server IPs with apps? Or packet inspection for apps that don't encrypt traffic?

> Should every tap on your phone be tracked and monetized? I would hope not.

These articles always treat implementation details so infuriatingly casually. There's a vast gulf between analyzing traffic patterns, and installing spyware to report on "every tap", as this sentence implies.

> Does it use heuristics to associate traffic patterns or server IPs with apps?

That's what it sounded like to me.

> There's a vast gulf between analyzing traffic patterns, and installing spyware to report on "every tap", as this sentence implies.

I didn't see an implication that every tap was currently being tracked. Only an inference that this is what the marketeers really want, and that allowing such desires to run rampant would be a bad thing. It still baffles me that people see massive surveillance as benign because they think the end result is merely relatively ignorable targeted advertisements.

> How does this work?

I don't know myself, but it's possible that they are simply reading unencrypted SNI fields from TLS connections. SNI exposes the website hostnames that you connect to.

Bingo.

They have built a dictionary mapping the hostnames your phone talks to when certain apps are used (i.e. uber app talks to xxxx.uber.com). Altho there are millions of apps, they only need to have this dictionary for the "top" apps used by most people.

Note they're not using DNS records, but rather the SNI portion of the HTTPS requests made by the phone.

Here are mitigations:

Run a VPN on your phone at all times. Use an alternate OS based on AOSP such as Graphene, Calyx, E, Lineage or Linux for the brave. These have no carrier bloatware/spyware. Transfer your phone number to VOIP. Then only occasionally use a burner SIM away from house.

What about IMEI? Isn't that burned into the SoC? I don't think you can spoof those, can you?

Kevin Mitnick did, but I think he had a magical phone dev kit of some kind.

If you run graphene, no apps can read the imei. SIM cards do, but that is why you should use a burner SIM rarely if at all.

I know there's an opt out, but someone needs to create an app that connects to a TLS server while sending random SNI values. (I know from experience with their video streaming throttling that T-Mobile uses TLS SNI to categorize websites).

This could probably be scripted using Termux, OpenSSL, and Tasker.

Related: I checked, again, the Android T-Mobile app and I'm still opted out in the Advertisements & analytics page.

You should check this. Just when they announced (about a year ago?) they would default this to opted in, they changed my already explicit intention to opt out. Wow.

Trust is hard to earn and...

T-Mobile has no data security and gets hacked like every week.

If you trust them with your data....

They are friendly and do have good customer service, though. And they cheat a little bit less than their competitors.

This sickens me.

After we lost Net Neutrality, it was only a matter of time before this crap happened.

Net neutrality does not have to do with selling data?

https://nordvpn.com/blog/net-neutrality-pros-and-cons/

> By the end of 2017, the FCC had revoked net neutrality and allowed internet providers to sell their users’ data without their permission

Thanks. I didn't realize net neutrality included that in the US.

Reply on news.ycombinator.com