News for hackers. Stuff that matters.
Re:Candy Crush, Tinder, MyFitnessPal: Apps hijacked to spy o... by tveita on Friday January 10, 2025 @04:25AM (#42654068)
> Participating in header bidding gives you data similar to what you would see from operating a popular mobile website.

A popular mobile website can only geolocate its own visitors based on IP and will have no idea what apps they have installed and what they do whenever they are not visiting that website.

The ad exchange gets information any time the users opens any of thousands of apps, without them ever interacting with the exchange.

"This device opened Grindr at this exact GPS coordinate, then Candy Crush at the church wifi, then a month later played Yahtzee for three hours near a military base in Afghanistan"

Then they package up that historical data and sell it. You can have years of location data for whatever purpose you can think of.

A thread on using this for surveillance from about a year ago:

https://news.ycombinator.com/item?id=38289337

As I commented there, while the antitrust case against Google is well-deserved, one effect of breaking their ad monopoly is opening up for even more actors to receive real-time header bidding data.

A look at the resolution of position data you can get:

https://nrkbeta.no/2020/12/03/my-phone-was-spying-on-me-so-i...

This will be correlated and joined with the geoip data from the apps without location data.

Re:Candy Crush, Tinder, MyFitnessPal: Apps hijacked to spy o... by rvnx on Friday January 10, 2025 @08:56AM (#42655593)
Mostly yes, but there is a detail to know.

RTB bidders are actually throtled based on the amount of traffic they purchase.

For example, if you win on average 100% of the time, you will get to see 100% of the traffic (for example, third-parties can see 100% of YouTube views, know which IP block has seen what videos, etc).

However, if you win on average 1% of the time, you may get only 1% of the requests.

Usually it's proportional to the amount you buy, to prevent such passive data collection.

Re:Candy Crush, Tinder, MyFitnessPal: Apps hijacked to spy o... by twojacobtwo on Friday January 10, 2025 @01:09PM (#42658165)
Isn't the point of providing the data to give bidders a reason to bid (no point in bidding outside their market)? If so, that would give all data to any bidder, as claimed above.

Regarding proportionality, don't they always get the info of the bids they win? If so, what you're saying is that you only get the info of bids won.

Re:Candy Crush, Tinder, MyFitnessPal: Apps hijacked to spy o... by rvnx on Friday January 10, 2025 @02:32PM (#42659192)
> Isn't the point of providing the data to give bidders a reason to bid (no point in bidding outside their market)?

Yes

> If so, that would give all data to any bidder, as claimed above.

No, the big networks like Google or BidSwitch (which is an aggregator of traffic from other networks), they send you a randomized % of the requests.

The more you buy ("win-rate"), the more this % increase (so the number of requests per second you are allowed to receive.)

Some networks don't care or are too small, so they send you 100% all the time.