Apple again sued over iPhone location data, personal information

24567

Comments

  • Reply 21 of 122
    magicjmagicj Posts: 406member
    Quote:
    Originally Posted by Blah64 View Post


    Why isn't everyone bent out of shape over this one?! I don't think Apple intentionally did this, but it's got to get patched up. It's simple: make it optional, just like location. If there's a specific need for an app to have access to a UUID or certain information, just ask. If I want to grant access, fine, but it should not be available to any random developer from whom I happen to try an app. And add an "enable for all apps" and a "disable for all apps" and you're done. Everyone is happy. Otherwise we're all going to need to start asking our friends to not put our info in their phones! :-(



    Yeah, this really surprised me. And now I'm wondering if Apple was stupid enough to do this on iOS, were they stupid enough to do it on Mac OS as well. Can someone write a Mac app that sends all my contacts back to them?



    On top of that. I was disappointed in Apples policy on how to handle these situations when they're discovered. If Apple finds out that an iOS app is sending contact information back to a developer, they simply make them stop doing it. Nothing else.



    So the developer has stolen Lord knows how much contact information from Apple customers and Apple does not report the company, they don't make them give the information back, and they don't inform their customers a breach has occurred.



    And, just or the record, Apple did confirm all this at the Congressional hearing and confirmed that multiple breaches have occurred.
  • Reply 22 of 122
    d-ranged-range Posts: 396member
    Quote:
    Originally Posted by magicj View Post


    It's your choice to throw away personal information in the trash.



    There's nothing wrong with companies collecting personal information with your permission. It's when they do it without your permission, and sometimes even without your knowledge, that there's a problem.



    And as I said, we're past the point where these kinds of denials are useful.



    It's also YOUR CHOICE to not encrypt the iPhone backup (including the location data) on your computer, so we are in agreement. Hence, I can conclude: nothing to see here, just move along...



    Also, in your rants you conveniently leave out that there's already a fix for this 'issue', that other phones have similar caches which can probably exploited if you try hard enough, and that the location data isn't actually that useful for anything since the accuracy is extremely low.



    Just stop here, you really are trying too hard to make an elephant out of this. I bet you had also had a field day with the antennagate thing right?
  • Reply 23 of 122
    magicjmagicj Posts: 406member
    Quote:
    Originally Posted by befuddled View Post


    Of course the DOJ testified to that effect because they are the plaintiffs and accusers in a case and so IP=ID is their wet dream wish. Thankfully, we have a separation of powers, and the courts have said the law is that IP≠ID because thank is just bunkum from a power hungry tyrannical government.



    Well, just to be clear, no one is accusing Apple of wrong-doing. Not Congress, not me. Privacy is a complex issue. The discrepancy between the court ruling and the DoJ testimony shows an example of that.



    But that doesn't change the fact that glaring issues have been uncovered and need to be resolved. There is no question in my mind that the government will be passing quite a bit of legislation on this.



    I really think it's in Apple's best interest to solve these problems now and push to use their preferred solutions as a template for that new legislation. But for that to happen, they'll first have to admit to themselves that there are many issues with their current practices.
  • Reply 24 of 122
    magicjmagicj Posts: 406member
    Quote:
    Originally Posted by d-range View Post


    It's also YOUR CHOICE to not encrypt the location cache backup file on your computer, so we are in agreement. Hence, I can conclude: nothing to see here, just move along...



    In order to make that choice, you first have to know the data is being collected on your phone and stored on your computer.



    Not only did no one know that outside of a small handful of specialists, Apple's privacy policy specifically (and falsely) stated that if you turn location services off, no location data would be collected.



    And again, we are past this point. There is no question that what Apple did was wrong. They've admitted it and fixed it. The issue now are the new problems that have been uncovered since then.
  • Reply 25 of 122
    jonamacjonamac Posts: 388member
    These are all interesting points but I think the big issue here that we have to accept is that there is no such thing as anonymity online, just as there isn't on the high street or in a night club or wherever. The internet isn't some alternate reality.



    Companies like Apple and Google need to act more responsibly than they currently do - that is becoming clear to the world - but ultimately people have to learn that they need to treat the internet and internet-connected apps with the same caution they treat strangers they meet face to face.



    An IP address cannot necessarily be used to identify an individual. At best it can be used to identify a device. I suppose from a legal standpoint that's an important distinction; you have to prove who was using the device if you want to prosecute someone or an online crime for instance, hence this judge's ruling I would imagine. (I haven't read the pdf, but I'm sure it's riveting.)



    I think the reaction to the consolidated.db file debacle was misguided, but we had no way to know that until Apple clarified it. Call me naive, but I believe Apple's explanation. It does go back to what I was saying about the need for them to be more responsible though. It shouldn't have been overlooked and the information could potentially have led to someone being tracked via a trojan, as magicj has pointed out. I'm sure Osama regrets backing up his iPhone last Sunday.
  • Reply 26 of 122
    magicjmagicj Posts: 406member
    Quote:
    Originally Posted by Jonamac View Post


    These are all interesting points but I think the big issue here that we have to accept is that there is no such thing as anonymity online, just as there isn't on the high street or in a night club or wherever. The internet isn't some alternate reality.



    I agree with this and there will never be a perfect solution, only improvements over what we currently have.



    One interesting suggestion that was made at the Congressional hearings was to allow a user access to all the information that is collected from them. So, say, an iPhone user would have an app where they could log on and see all the information Apple has collected about them.



    And your Osama line gets my vote for best line in the thread.
  • Reply 27 of 122
    gatorguygatorguy Posts: 24,213member
    Quote:
    Originally Posted by plokoonpma View Post


    LoL this is becoming ridiculous. If that morons that are suing would take their time to read the privacy terms of must apps and not granted location services to them...



    You actually read all 50 pages of the iTunes user agreement?
  • Reply 28 of 122
    blah64blah64 Posts: 993member
    Quote:
    Originally Posted by magicj View Post


    Yeah, this really surprised me. And now I'm wondering if Apple was stupid enough to do this on iOS, were they stupid enough to do it on Mac OS as well. Can someone write a Mac app that sends all my contacts back to them?



    Of course they can! A traditional application has access to most of the data on your computer, so if it knows where to look, it can grab whatever it wants. Heck, it can do a lengthy search, for that matter, just to see what's there.



    The difference is that on a traditional OS, we are in control. We can put whatever tools we want on our computer to monitor and/or stop such behavior. In fact, everyone who owns a Mac should be running Little Snitch. Seriously. If people knew how much crap goes on without their permission, well, I think a lot of attitudes would change. Just like Ghostery (a similar, but simpler-in-scope tool) shows people the amazing amount of cross-site profile gathering that happens constantly when you're cruising the web. It's appalling!



    Quote:
    Originally Posted by magicj View Post


    On top of that. I was disappointed in Apples policy on how to handle these situations when they're discovered. If Apple finds out that an iOS app is sending contact information back to a developer, they simply make them stop doing it. Nothing else.



    Yeah, this is pitiful. There are limited options available to Apple, but they should at least require the developers to notify the affected users, and perhaps even revoke their developer license. This is not something that creeps into an app by accident.
  • Reply 29 of 122
    ibillibill Posts: 400member
    Quote:
    Originally Posted by solipsism View Post


    He’s just spreading FUD. Best to ignore him.



    Yes. magicj should be on the ignore list and is now. I feel much better.
  • Reply 30 of 122
    d-ranged-range Posts: 396member
    Quote:
    Originally Posted by magicj View Post


    Not only did no one know that outside of a small handful of specialists, Apple's privacy policy specifically (and falsely) stated that if you turn location services off, no location data would be collected.



    As far as I understand this whole location cache thing, no data is collected if you turn off location services. Location data is pushed to your phone. Which effectively means you can deduct a coarse approximation of the location of the phone at a certain point in time, but it doesn't involve 'collecting location data', unless you include sending anonymized information about what cell tower you are near in that definition, which would mean every cell phone in existence is in violation. It's all semantics I know, but that observation goes both ways. It has been shown that Android and probably every other smartphone with location services has a similar file that you could try to hijack, in fact there's apparently FCC laws that mandate it. The only difference here is that the iOS cache was way too large and that it could end up unencrypted on your computer if you weren't paranoid enough to encrypt that backup. Hardly any worse than your typical OS security bug that could cause theft of private information. Do you propose to sue every OS manufacturer in existence for every security-related bug found in their software?



    If you leave out the emotional reasoning and just look at this issue rationally, it's obvious to anyone that Apple was not 'tracking you', that they didn't intentionally log your location to use it for some purpose other than to make your phone work better, and that the only mistake they made was being naive about the size of the location cache. Nothing more.



    Quote:
    Originally Posted by magicj View Post


    In order to make that choice, you first have to know the data is being collected on your phone and stored on your computer.



    The same holds for the contacts you have on your phone, your e-mails, your call logs, passwords you entered, what applications you have installed, and about EVERY other aspect about your phone and the way you use it. Do you sincerely think people read the (in the iPhone case ~60 page long) EULA that comes with the phone just so they know exactly what is and is not in their phone backup? I bet 99.99% of smartphone users just slap their SIM card in the phone, activate it and start using it, without knowing the least bit about what is and is not stored in their iPhone backup.



    My question to you is this: are you posting here because you sincerely think Apple did something terrible here, intentionally violating everyone's privacy, tracking your every move like big brother, gathering every bit of information about you that they can get their hands on? Or do you just want to rake Apple over the coals because they made a mistake determining the size of the location cache? Because of a technicality that, if you spend enough time on an exegesis of Apple's EULA, may or may not be 100% covered?



    Also: are you only wasting your time spreading FUD on AppleInsider, or are you doing the same thing on Android blogs? You realize that Google is in fact much more aggressive mining your data in every way imaginanable, right? Do you complain about Google driving around snooping WiFi data, indexing your gmail messages, pushing tracking cookies on almost every site you visit, collecting *actual* GPS data from Android phones, etc? Did you read all the EULA's for all these Google services to the last letter to determine whether they are 100% airtight and cover every way Google tries to invade your privacy?



    This whole nonsense again shows the hypocrisy and eagerness of the media to jump on the big guy and generate lots of fuss about nothing. It's very similar to the antennagate BS that you hear absolutely no-one about anymore, even though nothing has changed to the iPhone 4 antenna. If the iPhone had failed years ago and Android and Google were in the position Apple is now, everyone would be jumping on Google instead. It's a shame websites but even the traditional media are into this boulevard-style reporting these days, especially when it comes to technology.
  • Reply 31 of 122
    successsuccess Posts: 1,040member
    Quote:
    Originally Posted by plokoonpma View Post


    Just to add on the IP matter.

    Judge Harold Baker of the Central District Court of Illinois ruled this recently. The decision handed down from his bench states that an Internet Protocol (IP) address does not necessarily correlate to a particular individual, and that it cannot be treated as such during legal investigations be they civil or criminal.



    Tell that to the people who got FK'd by the RIAA.
  • Reply 32 of 122
    plokoonpmaplokoonpma Posts: 262member
    Quote:
    Originally Posted by Gatorguy View Post


    You actually read all 50 pages of the iTunes user agreement?



    I am an Apple consultant and Support specialist. Yup I did read a lots of EULA's

    Thousands of pages on my 15+ years in this business.
  • Reply 33 of 122
    blah64blah64 Posts: 993member
    Quote:
    Originally Posted by plokoonpma View Post


    Just to add on the IP matter.

    Judge Harold Baker of the Central District Court of Illinois ruled this recently. The decision handed down from his bench states that an Internet Protocol (IP) address does not necessarily correlate to a particular individual, and that it cannot be treated as such during legal investigations be they civil or criminal.



    It's a good ruling, in general. The problem is that even if it's not good enough for the courts, it's apparently good enough for law-enforcement and others, as a de facto standard. There are a lot of screwy things happening as law, technology and privacy start intersecting more and more. It's hard to know how a lot of these things will pan out over time.
  • Reply 34 of 122
    plokoonpmaplokoonpma Posts: 262member
    Quote:
    Originally Posted by Blah64 View Post


    It's a good ruling, in general. The problem is that even if it's not good enough for the courts, it's apparently good enough for law-enforcement and others, as a de facto standard. There are a lot of screwy things happening as law, technology and privacy start intersecting more and more. It's hard to know how a lot of these things will pan out over time.



    This was ruled a couple of weeks ago. I am pretty sure that will be used a lot cause its importance, trust me on this one.



    To be honest, I really blame the user in general for been naive and lazy. How many people around the world has left their wireless router password as default or use "administrator"

    This kind of case will go anywhere. I just can imagine the defendant lawyer asking them if they read the privacy terms of the app. Cause since they used it confirms they agreed to the terms of use. If they didn't and just clicked who's fault it is?



    Another example is the guy that call angry at customer service/tech support cause his computer do not work... He wants his money back, blame the company, insult the rep, don't want to make the troubleshooting and when he do they just find he needs to connect the computer to the ac.
  • Reply 35 of 122
    wizard69wizard69 Posts: 13,377member
    Quote:
    Originally Posted by Blah64 View Post


    Why isn't everyone bent out of shape over this one?! I don't think Apple intentionally did this, but it's got to get patched up. It's simple: make it optional, just like location.



    Everybody acts like this is a big surprise yet the SDK has been available for years. More so the SDK is easy to understand. All this really is is grand standing by our elected leaders. Acess to contacts and the like has never been a secret.

    Quote:

    If there's a specific need for an app to have access to a UUID or certain information, just ask. If I want to grant access, fine, but it should not be available to any random developer from whom I happen to try an app. And add an "enable for all apps" and a "disable for all apps" and you're done. Everyone is happy. Otherwise we're all going to need to start asking our friends to not put our info in their phones! :-(



    I think you have a point in that the owner should have access control. Then like a lot of people you slip off the deep end with silly ideas about having friends delete info. The reality is you are at a greater danger from lost or stolen devices.

    Quote:

    Yes, I've been waiting for this as well, and it's virtually certain to come. When companies (and forum posters) echo the laughable comments about how various kinds of data are non-identifying, it's pitiful. It only shows that many people echo what they hear instead of digging in to understand what's really going on.



    Then maybe you should dig a little deeper yourself. You do realize that our federal government, the one currently posturing about privacy, years ago required that cell phones be made trackable? Apple may not be in perfect form but it is absolutely laughable that we have people in Washington actually making air time out of this.

    Quote:



    Now, for those people who understand but don't care, that's another story entirely. I think they should all read the wonderfully entertaining privacy policy page for the DuckDuckGo search engine, (and the great real-world references) but hey, that's their choice.



    All we will get out of this is some BS legislation that on the face offers protection for our privacy but in reality does little to keep us safe. Most people in this world are far more exposed on their home PC than they are on their cell phones. If you understood what was going on you would realize this.
  • Reply 36 of 122
    wizard69wizard69 Posts: 13,377member
    Quote:
    Originally Posted by magicj View Post


    Interesting, because at the Congressional hearings with Apple and Google the Department of Justice testified to Congress that it can be used for that purpose, as did a privacy expert.



    They really don't know what they are talking about. Anybody with a bit of technical knowledge can spoof IP addresses or make use of other techniques to shield their identity.
  • Reply 37 of 122
    blah64blah64 Posts: 993member
    Quote:
    Originally Posted by d-range View Post


    If you leave out the emotional reasoning and just look at this issue rationally, it's obvious to anyone that Apple was not 'tracking you', that they didn't intentionally log your location to use it for some purpose other than to make your phone work better, and that the only mistake they made was being naive about the size of the location cache. Nothing more.



    We can presumably (hopefully) take Apple at their word that they were/are not logging and saving location data. But as discussed on an earlier thread, user location data necessarily was/is sent to Apple in order for them to generate the data that's sent back. Perhaps a bit pedantic, but there's no evidence of innocence beyond Apple telling us they didn't keep that data. And it wasn't just the size of the cache, but the fact that this data was being used even when location services were completely disabled.



    Yes, this data has always been available to the telcos, but there are legal regulations as to what they can do with that data, where there are no such regulations for hardware manufacturers, such as Apple or Google. The iPhone has made the world more complex, for better and for worse.



    Hopefully the security dudes (and dudettes) will pore over Apple's latest fix, things will be great and we'll move on.





    Quote:
    Originally Posted by d-range View Post


    Also: are you only wasting your time spreading FUD on AppleInsider, or are you doing the same thing on Android blogs? You realize that Google is in fact much more aggressive mining your data in every way imaginanable, right? Do you complain about Google driving around snooping WiFi data, indexing your gmail messages, pushing tracking cookies on almost every site you visit, collecting *actual* GPS data from Android phones, etc? Did you read all the EULA's for all these Google services to the last letter to determine whether they are 100% airtight and cover every way Google tries to invade your privacy?



    Hahaha! I won't pretend to answer for majic, but I'm going to butt in and tell you why I don't bother complaining on any Android blogs. Google's entire business model revolves around profiling their users. Because of that, I would never dream of using an Android device. So I could hardly care less what they do. I do care about Apple's policies, because I'd like to continue to be able to use their products in the years ahead, seeing as I've been doing so for over 20 years.
  • Reply 38 of 122
    freerangefreerange Posts: 1,597member
    Quote:
    Originally Posted by magicj View Post


    I'd like to give Apple the benefit of the doubt and say their heart is in the right place. It's just getting harder and harder to do that. The revelation at the Congressional hearings that iOS allows any app developer to pull _all_ your contact information without your permission or even your knowledge was pretty surprising to me, for example.





    Unfortunately for Apple, that file was shown to be able to track one of the folks who testified to Congress to within 20 feet of his actual location as determined by GPS. Also, Skyhook, the originator of the technique used to create that file, says it was designed to track individuals to within 200 - 1000 meter accuracy, not the 100s of miles claimed by Steve Jobs in a press release. http://www.skyhookwireless.com/howitworks/



    The lies are wearing thin and it's time for Apple to provide a complete end-too-end privacy policy that isn't packed with smoke and mirrors. They can do it themselves, or they can have the government do it for them.



    You are a totally clueless hack. Please, go get yourself an education so that you actually know what you are talking about.
  • Reply 39 of 122
    bilbo63bilbo63 Posts: 285member
    I think that these privacy discussions are good but for crying out loud, so much of our personal information is out there now, and has been for years. This is not an Apple only issue, like some are trying to make it. Sadly money grabbers are trying to paint evil scenarios and trying to cash in. I'm not saying that Apple cannot do better and I believe that they will, but I don't think that they are doing anything terrible here and I certainly don't believe that they are taking liberties with your info that other companies have had for years.



    For example, I get points towards groceries every time I use my MasterCard. They know what I like to buy and how often. From this data they can roughly determine my sex, age, how many people live in my house etc. Your internet provider knows how much time you spend online, where you go and what you download. I'm sure every purchase that is made with a card is recorded and kept. They know how often I travel and where I like to go. Where I get my car serviced. Who my dentist is. I'm betting that info has likely been sold many times over.



    As I said, these discussions are good, but people need to stay reasonable. If we go crazy over our personal information, then be prepared to deal in cash and use no mobile electronic devices, use no points programs or options cards, no web surfing, web searches, web purchases. Even that won't guarantee that you don't leave some sort of breadcrumbs.
  • Reply 40 of 122
    freerangefreerange Posts: 1,597member
    Quote:
    Originally Posted by magicj View Post


    Anyone who access your computer can access the data. This would include things like trojan horse software. Someone accessing that data is how this first caught the public eye. http://petewarden.github.com/iPhoneTracker/ And it's why Apple stopped backing up the data to the computer.



    You are a complete idiot! It is only on MY computer and MY iPhone, just like MY private contacts, private documents, private photos, private email, private bank information etc. etc. etc. Grow up!
Sign In or Register to comment.