UberSuggest Chrome Extension tracks your location data extensively | Hacker News Reader

UberSuggest Chrome Extension tracks your location data extensively

5 pointssachinjain6 comments

I was debugging something & searched for jquery in the Network tab and stumbled upon an API call to pro.ip-api.com and when I found the response for the API, I was shell shocked to see the detailed being captured.

Here are the things that I found pro.ip-api.com was capturing about my location

{ "as": "My ISP Pvt Ltd", "city": "My City", "country": "My Country Name", "countryCode": "My Country Code", "isp": "My ISP", "lat": my.lat, "lon": my.long, "org": "Something", "query": "My.Actual.IP", "region": "Quite Close Region Code", "regionName": "Quite Close Region Name", "status": "success", "timezone": "Accurate/Timezone", "zip": "Accurate ZIP" }

PS - The data UberSuggest captures is very scary. I use UberSuggest for SEO purposes. For the time being, I have blocked this API end point with the following Requestly Rule - https://app.requestly.io/rules/#sharedList/1664432223477-Block-Pro-IP-API

More Importantly, UberSuggest fires this on every page/domain. I assume every analytics tool captures Country & City so that'd have been fine but tracking information till region, ISP & ZIP code is unacceptable.

Should I try contacting Neil Patel and tell him about this before dropping a review on Chrome Store.

Well... visit https://ipinfo.io/json and tell me what do you see? You can get this information for free even.

What you are seeing IP address based geolocation data. When you use a web based service or product you sent your IP address and the IP geolocation service provider aggregates data from various sources and does a lot of analytics work to "estimate" where the device connected to that IP address is located. It is an estimated result on a city/postal code level scale.

Is there an ethical dilemma? PERSONALLY, I don't think think so. You are providing your IP address and the geolocation provider is doing a lot of logic and number crunching to figure where you are from but at the end of the day, it is not specific enough to violate any personal privacy boundary. This information is valuable in ensuring security and providing insights related to usage.

At the end of day it is an estimate because if you use a VPN or Proxy you can spoof the IP geolocation service. Visit that link above using a VPN, Proxy or Tor and see the result yourself.

Disclaimer: I work for IPinfo, but this is my personal opinion and personal account.

> This information is valuable in ensuring security and providing insights related to usage.

My question is not about ip-api or ipinfo products but my question & concern is why does UberSuggestion collect this information from my device. However, It is not specific enough, it is giving the exact ZIP code, lat, long (close enough).

In a nutshell, UberSuggest is also collecting my browsing history as well as I am logged into the product. Why do they need to know all of this about me?

> Why do they need to know all of this about me?

The reason for data is endless. It is a trillion dollar industry! But IP geolocation isn't something to be worried about. Every and each popular website you visit probably has that information about you. Handful of websites do this on the frontend but the rest of them do it on the backend.

I have no idea how they use your IP geolocation, but it is mainly used for security and sales intelligence.

Let's say someone is taking advantage of their free tier. They could be churning accounts as they hit limits. So as a protection a website can find common attributes from each account's IP address say, city/post code or ASN or ISP name. A malicious actor can always open a new email address and sign up, but changing their IP address, their location takes a bit more effort.

Neil Patel has always done shady stuff. You are better off trying to get this out to the bigger SEO community

pro.ip-api.com is not capturing data sent by the extension, they already have this data. see ip-api.com

Its not ip-api that's capturing the data. It is UberSuggest content script that is firing this API call and capturing this data.

Reply on news.ycombinator.com