Google appears to be overlooking their explicit ban on this.
If your app handles personal and sensitive user data, then you must ... Not sell personal and sensitive user data.
The rule also applies to third-party code.
If you include third party code (for example, an SDK) in your app, you must ensure that the third party code used in your app, and that third party's practices with respect to user data from your app, are compliant with Google Play Developer Program policies... For example, you must ensure that your SDK providers do not sell personal and sensitive user data from your app.
Isn't this abuse what we are supposed to be paying their 15% Play Store tax to stop?
benoau 21 hours ago [-]
World would be a much better place if Google and Apple enforced their chosen policies for apps, and Meta and Google enforced their chosen policies for ads, but then these companies would be very slightly poorer.
Vaushite 19 hours ago [-]
The tax is 30% and the purpose of a system is what it does
gustavus 19 hours ago [-]
Come On, Obviously The Purpose Of A System Is Not What It Does
"The purpose of the British government is to propose a controversial new sentencing policy, stand firm in the face of protests for a while, then cave in after slightly larger protests and agree not to pass the policy after all."
This might as well be the purpose of the British government.
Vaushite 13 hours ago [-]
This guy just hasn't understood the phrase, he's picked several strawmen to argue against. Not literally everything a system does is its purpose, so you can't just pick the stupidest ones and use them to disprove the principle.
How about "the purpose of a system is not something it doesn't do" or "the purpose of a system is some of the things it does" but that's not as catchy.
loa_in_ 4 hours ago [-]
"You won't believe it's on purpose"
LoganDark 20 hours ago [-]
This just means you can't get money for the personal and sensitive user data. It's wild that companies think that's the problem.
Webloc is getting this data for free. And then reselling it, but it's outside the scope of Google then.
everdrive 21 hours ago [-]
There's no good reason to use your phone for any more than the bare minimum. Remove as many apps as possible. Treat it like a landline by just keeping in on a desk or something when you're at home.
infinite_spin 20 hours ago [-]
That's not the way I want to live. I want to enjoy technology and enjoy privacy, and since those aren't mutually exclusive, it's reasonable to expect both.
prism56 18 hours ago [-]
At least use the browser for every service you can that wants you to use an app. Bonus points if the adblocker is enabled.
jareklupinski 22 hours ago [-]
> The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps.
is there a list
nik282000 21 hours ago [-]
Don't use apps. Use your browser and an ad blocker.
TFNA 21 hours ago [-]
A significant amount of the internet for normies today is app-first, where there may be no web version, or the web version lacks much of the core functionality of the service. Instagram led the way with this before Covid already, but the practice then spread widely.
The savvy crowd on HN hopefully already knows how to protect ourselves, but we can't really expect the mass public to do so. Especially when some younger people today are losing awareness of the very concept of the browser as they use dedicated apps for all their internet use.
nik282000 20 hours ago [-]
Sucks to suck.
If a service is sub-par in the browser I don't use it. Be ThE cHaNgE yOu WaNt To SeE. I hate that sentence but it kinda applies here.
infinite_spin 20 hours ago [-]
browser based applications can still gain access to this data, using very similar workflows. E.g. a weather app rendered on a browser is still going to request your location, and can fingerprint that browser to build a user profile. I'm not sure your solution is a solution at all.
ranger_danger 20 hours ago [-]
I have tried for years but it just doesn't make a difference if enough people in the world don't care loudly enough.
Banks are relying on Play Integrity protection as well as SMS-based 2FA, neither of which are both safe and private.
exe34 19 hours ago [-]
Unless you have friends, of course, and want to keep in touch. (Not a problem for me).
mzajc 18 hours ago [-]
Exodus has a list of applications with known spyware libraries: https://reports.exodus-privacy.eu.org/en/reports/list/. The homepage has search and also lets you re-analyze applications if there's no report or it's out of date.
There will be false negatives for first-party spyware and sufficiently-obfuscated vendored libraries, but from my experience this is exceedingly rare.
In Android apps need to request location permission. You can reject it and/or uninstall those which request it.
Most apps will only be able to request location while running in the foreground.
Weather apps are unusual for having a reason to request background location access and so you should treat them with particular suspicion.
microtonal 8 hours ago [-]
In Android apps need to request location permission. You can reject it and/or uninstall those which request it.
Within the same profile, apps can communicate through local IPC though. Wouldn't surprise me if some SDKs use this to coordinate exfiltration of data between apps. I mean, tracking companies have even used localhost sockets to improve tracking: https://localmess.github.io/
We sorely need IPC scopes.
BeetleB 18 hours ago [-]
> Weather apps are unusual for having a reason to request background location access
Not really. I can just set the location in settings.
Terr_ 20 hours ago [-]
I regret that we've moved away from a world where you could easily tell your device throw a privacy-preserving bone to pesky apps. ("Sure, you've got location access, but it'll only show my house, you don't get to see where else I go.")
Instead our ownership and agency has been sacrificed on the altar of "but BigCo doesn't like it because users can lie."
fancyfredbot 19 hours ago [-]
You kind of can, but it means rooting the phone after which you can't run banking apps etc.
Personally I am okay with my bank app doing this but I'm probably in a minority here.
Terr_ 11 hours ago [-]
A compromise might be that only certain special classes of apps can get the "don't lie to me" status, where a bank's app has to prove it's a little different than some "tired of our website try our app" thing or the average shovelware.
moscoe 19 hours ago [-]
This is why network-wide dns ad-blocking is necessary.
Perhaps necessary, but not enough. Trackers will just increasingly use hostnames that also have legitimate use. Part of the solution is not technical, it is important to have strong privacy laws and they should be aggressively enforced.
Also, people should have the tools to disable tracking SDKs Morphe-style. Unfortunately, for mainstream phones, this would require assistance from Google and Apple, who would never do that, because they would get sued for benefitting themselves over others (or they'd lose the valuable tracking they do themselves).
nullfield 18 hours ago [-]
Are we back to trusting Ubuntu these days? Why can’t this support Debian, or…? (Yes I know see the FAQ)
hoppp 15 hours ago [-]
Code your own apps, run your own things.
microtonal 8 hours ago [-]
Sorry, but this is nonsense. People mostly use apps to use services. These services will just start to require remote attestation when people try to use them directly from their own apps (see e.g. how Volkswagen shut out Home Assistant, etc.).
This would only work for the small subset of apps that are mostly local (a timer, maybe a weather app if you can arrange API access, etc.).
Also, 99% of the population cannot code their own app or are not interested to do so. (Even with an LLM.)
hoppp 2 hours ago [-]
I use my own apps for a whole bunch of things, not everything of course.
Don't need to read into it more than what I wrote down.
2 hours ago [-]
yieldcrv 17 hours ago [-]
I’d rather give my info directly to the party at this point
Shouldn’t have bullied tiktok into selling for US users
RecycledEle 18 hours ago [-]
So I let a company know my location, and they turn the data over to the pigs.
Not good.
Rendered at 16:46:49 GMT+0000 (Coordinated Universal Time) with Vercel.
Isn't this abuse what we are supposed to be paying their 15% Play Store tax to stop?
https://www.astralcodexten.com/p/come-on-obviously-the-purpo...
This might as well be the purpose of the British government.
How about "the purpose of a system is not something it doesn't do" or "the purpose of a system is some of the things it does" but that's not as catchy.
Webloc is getting this data for free. And then reselling it, but it's outside the scope of Google then.
is there a list
The savvy crowd on HN hopefully already knows how to protect ourselves, but we can't really expect the mass public to do so. Especially when some younger people today are losing awareness of the very concept of the browser as they use dedicated apps for all their internet use.
If a service is sub-par in the browser I don't use it. Be ThE cHaNgE yOu WaNt To SeE. I hate that sentence but it kinda applies here.
Banks are relying on Play Integrity protection as well as SMS-based 2FA, neither of which are both safe and private.
There will be false negatives for first-party spyware and sufficiently-obfuscated vendored libraries, but from my experience this is exceedingly rare.
Solitaire
ah beans
Most apps will only be able to request location while running in the foreground.
Weather apps are unusual for having a reason to request background location access and so you should treat them with particular suspicion.
Within the same profile, apps can communicate through local IPC though. Wouldn't surprise me if some SDKs use this to coordinate exfiltration of data between apps. I mean, tracking companies have even used localhost sockets to improve tracking: https://localmess.github.io/
We sorely need IPC scopes.
Not really. I can just set the location in settings.
Instead our ownership and agency has been sacrificed on the altar of "but BigCo doesn't like it because users can lie."
Personally I am okay with my bank app doing this but I'm probably in a minority here.
Setup a personal ad-blocking vps/vpn to route traffic through when away from home: https://trailofbits.github.io/algo/
Also, people should have the tools to disable tracking SDKs Morphe-style. Unfortunately, for mainstream phones, this would require assistance from Google and Apple, who would never do that, because they would get sued for benefitting themselves over others (or they'd lose the valuable tracking they do themselves).
This would only work for the small subset of apps that are mostly local (a timer, maybe a weather app if you can arrange API access, etc.).
Also, 99% of the population cannot code their own app or are not interested to do so. (Even with an LLM.)
Don't need to read into it more than what I wrote down.
Shouldn’t have bullied tiktok into selling for US users
Not good.