News for hackers. Stuff that matters.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by matt_wulfeck on Wednesday October 18, 2017 @01:45PM (#15501220)
Ads are not the main privacy issue any longer, since there’s client-side protection against them.

Now the issue is your ISP getting into the marketing/data-monger business, since they have the keys to your privacy kingdom and are becoming increasingly desperate for profits.

https://www.google.com/amp/s/www.forbes.com/sites/thomasbrew...

Re:It Takes Just $1k to Track Someone's Location with Mobile... by pcl on Wednesday October 18, 2017 @02:46PM (#15501805)
It's ironic that your citation is a Google AMP link... Not only does the AMP-proxy situation further disenfranchise the ISPs, it also funnels all that value to Google.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by abalone on Wednesday October 18, 2017 @02:28PM (#15501634)
> Ads are not the main privacy issue any longer, since there’s client-side protection against them.

False. There is client-side protection in some browsers now, but this attack exploits native apps that submit precise geolocation when requesting location-targeted ads. It demonstrates how to essentially reverse engineer that precise location with a matrix of ads crafted for this purpose.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by interfixus on Wednesday October 18, 2017 @09:36PM (#15504778)
There's very real client-side protection: Do not have sleazy, add-supported apps installed, and - for what it's worth - keep your GPS and location services turned off except when explicitly needed.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by abalone on Wednesday October 18, 2017 @11:59PM (#15505377)
It’s not clear if you believe all ad-supported apps are sleazy or if you think it’s clear to users when apps use precise geotargeted ads. Either way that doesn’t constitute “very real client-side protection” anymore than expecting folks to regularly disable basic functionality.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by mirimir on Wednesday October 18, 2017 @11:14PM (#15505218)
Better yet, don't use a smartphone when you care about your location being tracked.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by monochromatic on Wednesday October 18, 2017 @11:31PM (#15505278)
Well, sure. If I'm ever going to go murder someone, I'll try to remember to leave it at home.

But I care some about it being tracked even when I'm not doing anything bad.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by mirimir on Thursday October 19, 2017 @12:22AM (#15505441)
Well, OPSEC isn't all or nothing. And there's lots of other good advice.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by _puk on Wednesday October 18, 2017 @03:18PM (#15502078)
There is a bit of an arms race between get a few $/c extra CPM by spoofing the geo location (the app needs to ask for this, and have reason to from App Store perspective, so not always available), and the data aggregators detecting said spoofing (all clients having the same geo / patterns in geo etc).

Reverse engineering will get you a PoC, but you can buy the cleansed data fairly easily (apparently..)

Re:It Takes Just $1k to Track Someone's Location with Mobile... by roblabla on Wednesday October 18, 2017 @03:16PM (#15502071)
My phone (Android/LineageOS) blocks native ads too. There's adaway that does this nicely. Client-side protection exists.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by abalone on Wednesday October 18, 2017 @05:40PM (#15503430)
The claim was not merely that client-side protection "exists." It was that ads are not a privacy issue any longer, implying a ubiquitous native solution, which is false.

It's great that some OSes are trying to solve it system-wide but host blocking isn't viable as ubiquitous protection against this attack. It would just break all ads all the time, which ultimately would make the platform untenable for ad-based apps. What you want is something like the machine-learning Intelligent Tracking Prevention that Safari just rolled out, but applied to native apps. That is non-trivial.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by Feniks on Thursday October 19, 2017 @09:08PM (#15512860)
"It would just break all ads all the time"

Sounds like a feature not a bug.

Anyways I'm sure tech savvy folks who care about privacy and hate ads already have all the basic angles covered. I know I do!

Re:It Takes Just $1k to Track Someone's Location with Mobile... by Twirrim on Wednesday October 18, 2017 @04:17PM (#15502553)
also DNS66 helps
Re:It Takes Just $1k to Track Someone's Location with Mobile... by JoshMnem on Wednesday October 18, 2017 @02:15PM (#15501503)
I don't think that there is much client-side protection against ads on mobile devices (outside of Firefox's browsers), at least on Android.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by TACIXAT on Wednesday October 18, 2017 @02:23PM (#15501586)
Firefox Focus is solving such a pain point for me. Browsing the web on mobile feels like 2002 desktop with all the flashing, scrolling, pop overs. It's a nightmare. The companies that rely on ads for revenue took the thing that made adblockers so commonplace and did it on mobile.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by gcb0 on Wednesday October 18, 2017 @05:39PM (#15503422)
"anything on a unrooted mobile feels like 2002 desktop with all the flashing, scrolling, pop overs. It's a nightmare."

fixed it for you.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by jraph on Wednesday October 18, 2017 @06:45PM (#15503940)
Stock rom without root was pretty decent for me. No ads at all. However, I only use free software apps mostly from F-Droid (and uBlock Origin takes care of the web). I knew that this was putting myself in a bubble, but I had not realized that the experience of using a phone for a lot of people must be that annoying. What a shame. Computers should serve humans, not the other way round!

I discovered Google Play's App Store on someone else's phone, that was painful and stressful. But what you are describing seems hellish.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by TACIXAT on Thursday October 19, 2017 @10:34AM (#15508247)
I used to root the devices I got. Relying on CM supporting my device or totally breaking carrier updates got old though. I switched to Google Fi and am using a Nexus 6P (Android 8) and it's really nice.

I wanted to get a PCAP from an app a few nights ago, I was surprised it was possible without root. Now there are apps that can act as a VPN to sniff traffic. Having the most up to date firmware and Google Fi's international rates are worth giving up root to me.

It would be nice if they built in secure root access interface to Android though.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by KozmoNau7 on Thursday October 19, 2017 @04:13AM (#15506251)
The main problem with rooting my phone is that a number of apps I use will stop working, including the de facto standard mobile payment app in my country.

If you rein in the notifications (ie. switch them all off), use Firefox with uBlock Origin (or Firefox Focus) and avoid using apps with obnoxious ads (or switch to the paid versions), Android as of 2017 is quite nice.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by Sir_Substance on Wednesday October 18, 2017 @05:33PM (#15503367)
If you root your phone, you can modify the hosts file to blackhole any address you please. That will affect every part of the system that attempts to dial out to those addresses, including native apps.

On behalf of the Linux community, no need to thank us, you're welcome.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by uerrarcv on Wednesday October 18, 2017 @03:06PM (#15501985)
Adguard android app does full-device ad blocking including __native apps__ by setting up a local VPN. It's a proprietary app, and there are some open source alternatives such as MinMinGuard or DNS66, but the difference is that Adguard inserts their js into html, effectively running a browser extension.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by nacs on Wednesday October 18, 2017 @02:45PM (#15501789)
iOS has a bunch of apps that do ad-blocking in the App store. It works well in Safari.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by vosper on Wednesday October 18, 2017 @02:52PM (#15501856)
Mozilla Focus does this - you don't have to use the Focus browser, just enable it as a content blocker for Safari. Works great.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by code_duck on Wednesday October 18, 2017 @04:54PM (#15502951)
What percentage of users have client side protection active on mobile? I'm guessing it's currently very low.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by javajosh on Wednesday October 18, 2017 @02:09PM (#15501430)
Yeah, it's too bad that knowing the physical position of your customers is a technical requirement for the wireless ISP industry. That said, knowing their identity is not a technical requirement.

I wonder if it's feasible to construct an ISP that still must know where all it's customers are, but can't distinguish between them.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by kakarot on Wednesday October 18, 2017 @03:16PM (#15502069)
Networking and behavioral analysis will probably render such obfuscation useless for most subjects.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by MR4D on Thursday October 19, 2017 @10:14PM (#15513097)
I think the whole “ISP data” issue is a red herring. Google, Facebook, etc already gather everything about you unless you go to extreme measures.

The only reason those tech companies are against ISP tracking is that it hurts their revenue model...significantly.

Don’t by in to the easy explanation - look at their motivations.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by dsgfhasgjklas on Wednesday October 18, 2017 @04:40PM (#15502800)
> Ads are not the main privacy issue any longer, since there’s client-side protection against them.

Not really, though, at least for ios. On android there are at least firefox + extensions, but there's nothing quite capable/available on ios at the moment.

Re:It Takes Just $1k to Track Someone's Location with Mobile... by djrogers on Wednesday October 18, 2017 @05:30PM (#15503337)
What? There have been iOS ad blockers for ages, with official APIs and support since iOS 9.
Re:It Takes Just $1k to Track Someone's Location with Mobile... by dsgfhasgjklas on Wednesday October 18, 2017 @05:32PM (#15503358)
Right, and none of them come close to a well-configured ublock install. I happen to use purify (after choosing it over others) and regularly see both ads and tracking network requests.