Wading Through AccuWeather's Response (daringfireball.net) 81
On Tuesday, ZDNet reported that popular weather app AccuWeather was sending location-identifying information to a monetization firm, even when a person had disabled location data from the app. In a response, AccuWeather said today "if a user opts out of location tracking on AccuWeather, no GPS coordinates are collected or passed without further opt-in permission from the user." But it is misleading people. John Gruber of DaringFireball writes: The accusation has nothing to do with "GPS coordinates." The accusation is that their iOS app is collecting Wi-Fi router names and MAC addresses and sending them to servers that belong to Reveal Mobile, which in turn can easily be used to locate the user. Claiming this is about GPS coordinates is like if they were caught stealing debit cards and they issued a denial that they never stole anyone's cash. The accusation comes from Will Strafech, a respected security researcher who discovered the "actual information" by observing network traffic. He saw the AccuWeather iOS app sending his router's name and MAC address to Reveal Mobile. This isn't speculation. They were caught red-handed. GPS information is more precise, and if you grant the AccuWeather app permission to access your location (under the guise of showing you local weather wherever you are, as well as localized weather alerts), that more precise data is passed along to Reveal Mobile as well. But Wi-Fi router information can be used to locate you within a few meters using publicly available databases. Seriously, go ahead and try it yourself: plug your Wi-Fi router's BSSID MAC address into this website, and there's good chance it'll pinpoint your location on the map. "Other data, such as Wi-Fi network information that is not user information, was for a short period available on the Reveal SDK, but was unused by AccuWeather," the company writes. In what way is the name and MAC address of your router not "user information"? And saying the information was "unused by AccuWeather" is again sleight of hand. The accusation is not that AccuWeather itself was using the location of the Wi-Fi router, but that Reveal Mobile was. Here are Reveal Mobile's own words about how they use location data.
NSTAAFL (Score:4, Insightful)
Re: (Score:1)
Re:NSTAAFL (Score:5, Informative)
Increasingly, "free" doesn't enter into it. Applications you pay for are often doing the exact same thing.
Re: (Score:2)
Increasingly, "free" doesn't enter into it. Applications you pay for are often doing the exact same thing.
Does that mean we're down to "There Ain't No Such Thing As Lunch", then? So it's come to this...
Re: (Score:2)
I thought it was TINSTAAPP - There Is No Such Thing As A Pitching Prospect.
Oh wait... we aren't talking about baseball, are we?
AccuPrivacyPolicy (Score:5, Funny)
Re: (Score:3)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Yes. When a pay TV provider dropped TWC, toonces33 installed Weather Underground to get TWC back.
Re: (Score:2)
Given the accuracy of their weather predictions, wouldn't that make more sense for a completely deceptive and false Privacy Policy which is likely to change at any time?
Re:Fake News (Score:4)
Your IP, easily obtainable by anyone you are communicating with, already nails down your location to a relatively small area.
Where I live, that "relatively small area" has roughly a 50 mile radius.
Re: (Score:3)
Re: (Score:2)
Re: (Score:1)
Thanks for your input, Dr. Joel Myers.
Re: (Score:2)
our IP, easily obtainable by anyone you are communicating with, already nails down your location to a relatively small area.
Disregarding VPNs, the "relatively small area" for IPs is often the service area for the IP range for the ISP, which can be city sized or bigger. My IP address is around 50 miles off.
That's a far cry from within a few feet.
Re: (Score:2)
mine comes up as either San Antonio or Plano, neither is close to where I am. IP locating works OK, but I would not want to attach anything serious to it.
Re: (Score:1)
The closest location "nailed down" for me is 12 miles away. That's because that's ostensibly where the node is, but then then there's even an argument about that as it is three different places according to various databases.
Re: Fake News (Score:1)
You're kind of a n00b, huh?
You think the accuweather app gets access to cellular tower location info of the device its running on? No.
You think an IP is tied to someone's physical location? No.
Go back to school, your book report is due.
Re: Fake News (Score:1, Insightful)
Well you just revealed your own ignorance there. Your WAN IP can indeed be tied to a fixed point in a lot of cases. Of course the area around that fixed point may be anywhere from metres to planetary scale but IP geolocation indeed works to some degree.
Re:Fake News (Score:5, Insightful)
What they're doing is merely annoying. What is actually far worse is trying to obfuscate the actual issue by issuing a mea culpa speaking to 'GPS signals' -- rather than an open admission of what they were doing and why.
And this somehow okay?
The cover-up is almost always worse than the actual deed.
Re: (Score:2)
What they're doing is merely annoying.
Welcome to 2017, where spying on users and selling all the information is 'merely annoying.' It's a Brave New World.
Re: (Score:2)
Fair enough, fair enough.
Re:Fake News (Score:4, Informative)
Not necessarily..
In many countries, ISPs are national and their address allocations are allocated from a single national pool, you could be anywhere in a given country.
You could be using a VPN.
The externally facing ip addresses of mobile networks are also generally national, and shared with hundreds of users.
When you're using roaming data in another country it usually tunnels back to your national network too - so it has the same ip as if you were in your home country, even if your half way across the world.
IP is quite a poor way to locate someone.
Geolocation (Score:5, Funny)
I just now visited a few Web sites that do geolocation.
One site has me at the opposite end of the county in which I live, about 40 miles away. On repeating that request, that same Web site placed me in Moscow, Russia.
Another Web site has me in a city in an adjacent county. Two other sites have me in different states. Accuweather has me in Chantilly, Virginia, near Washington, DC; but I am actually about 20 miles from the Pacific Ocean.
All this is because I use a browser extension that sends fake headers when I request a Web page.
Re: (Score:2)
Web site placed me in Moscow, Russia.
In post-Soviet Russia website places you
Re: (Score:2)
Although the Geolocation with my connection is often accurate (defining the city I live in) it occasionally puts me at another city 150 miles away.
Perhaps more interestingly, when I was in a remote area and we connected via a dish satellite link, I often got geolocation that put me in New York City, some 2500 miles away an in a different country.
The above is from ads, especially shady dating ads, that would suggest I could find many "available" dates in xx city. These days that doesn't happen because I use
Re: (Score:2)
Your IP, easily obtainable by anyone you are communicating with
My IP is assigned by carrier grade NAT and is narrowed down to "somewhere in the country".
Why does a weather app have that access? (Score:5, Insightful)
The network connections are managed in the iphone settings. Why would a weather app get access to available SSID info? Seems like Apple left the door open.
Re: (Score:3, Funny)
Shhhhh. Your never supposed to blame apple. Its never their fault.
Re: (Score:2)
This requires a separate "manage wifi connections" permission on Android. I'm rather surprised that iOS doesn't require something similar.
Having said that, it probably isn't reading the SSIDs itself, just using the "coarse location" service which it likely wants to present you with local weather forecasts.
Re: (Score:1)
I'm rather surprised that iOS doesn't require something similar.
Are you? Really?
Why do apps have access to the BSSID? (Score:2)
I don't think Apple allows things like WiFi sniffers / analyzers, so what other legitimate purpose is there for an app to have access to any info about the WiFi network? I would have assumed this info was locked away from the public API on iOS, only available to the OS functions that manage WiFi connectivity.
Of course, any app could still determine your public IP address and try to locate based on that, but at least it'll have even worse accuracy than the Reveal Mobile database.
Re: (Score:2)
I don't think Apple allows things like WiFi sniffers / analyzers
And many customers choose Android devices for precisely this reason. It's why, for example, Mozilla Stumbler is an Android exclusive.
They couldn't even give the standard response? (Score:4, Insightful)
"Oops, this functionality was inadvertently included in the release version of our app. We have removed it and apologize for this error."
How hard is that? Sure, it's still a lie, but at least it's not flipping the users the bird.
Re: (Score:2)
Re:They couldn't even give the standard response? (Score:5, Informative)
It's like they accidentally left a joint in their mother's car.
Re:They couldn't even give the standard response? (Score:4, Informative)
On second reading, it's hard to tell what they were really saying. My take on it was they were saying that the problem is users are misunderstanding what they're doing. But their verbage is so slippery that your interpretation may be what they wanted us to hear.
Geolocation hyperlink missing (Score:4, Interesting)
Seriously, go ahead and try it yourself: plug your Wi-Fi router's BSSID MAC address into this website...
Not sure which website the submitter was aiming for, but since the hyperlink is missing, here's one website option to try [mylnikov.org].
I tried it with three of my school's AP BSSID's, and I'm surprised that all three were accurate to the actual building. I thought the closest anyone could get was by geotracking our IP address, which leads them to a nearby town. But I had no idea that BSSID's could be much, much more precise.
Re: (Score:2)
I tried it with three of my school's AP BSSID's, and I'm surprised that all three were accurate to the actual building.
I can't get it to return anything at all. I enter a MAC or BSSID and either hit submit or return, and nothing happens. Tried four different ones.
Is it slashdotted?
Re: (Score:2)
It just worked for my home wifi... and I'm in a fairly rural area.
Re:Geolocation hyperlink missing (Score:4, Insightful)
Funny story but this is how I found out Amazon sold me a used router as new. For a while after I first got it, google maps in Android insisted that I was in a house in NW Washington outside Seattle, and not where I actually live in the mid-west. At some point that router (or one with an identical MAC, but that's not really supposed to happen) was on and was picked up by either a streetview car or an android phone and added to their database. And it was just google, Apple devices didn't have this issue.
Re: (Score:2, Interesting)
Good catch! (Almost) all of my network interfaces get a new, randomized MAC on a daily basis. I would never have noticed that... I guess there is a downside to that practice!
Re: (Score:2)
Is BSSID MAC address the same as the MAC addr of your wifi's Internet port?
Re: (Score:2)
Maybe. BSSID (Broadcast Service Set Identifier) and SSID (Service Set Identifier) are functionally the same thing -- BSSID is an SSID attached to a radio, basically.
Every network interface has such an ID. If your machine has multiple interfaces, WiFi or wired, each one has its own.
Re: (Score:2)
Man, I messed that up. To clarify and correct my answer:
BSSID: the text string that you enter to "name" your WiFi set.
SSID: This is the same as a MAC, but attached to a radio. WIth wired connections, like ethernet, it's just called MAC.
Re:Geolocation hyperlink missing (Score:4, Insightful)
You have that mixed up still...
ESSID = name
BSSID = mac address (usually of the ap's wireless interface)
Re: (Score:2)
Bah, you're right. When my brain misfires, it can be spectacular!
Re: (Score:2)
I put the LAN Port MAC addr into http://find-wifi.mylnikov.org/ [mylnikov.org] and according to Google Maps, it was 500m from my house.
Still in the neighborhood...
Re: (Score:2)
This is easy ... (Score:4, Informative)
... just uninstall the goddam thing.
Re: (Score:2)
This is NOT easy, I just spend 20 minutes trying to uninstall it from my non-rooted samsung. No luck. I can't even force stop it.
Re: (Score:2)
There are Android firewalls available that don't require root. I don't know if they're any good, because my own phone is rooted and I use AFWall+, but you may want to try one out - you just might be able to stop the app from phoning home.
Re: (Score:2)
Re:This is easy ... (Score:4, Informative)
Re: (Score:2)
remotely interact with it
I can't wait to see half a billion people trying to remote the same equipment on the app!
"We will not sell your data" (Score:2)
This is a similar smokescreen, because an equally important question is: are they selling the 'derived data' or 'modelled data' that their algorithms distill from your data? For example, when your Facebook likes reveal that you are probably pregnant/gay/smoker/etc, even though you have never literally given up that information. Because most people don't know about this distinction, they are lulled into a false sense o
Re: (Score:2)
AccuWeather probably doesn't, but if you read Reveal Media's privacy statement, they are very clear and forthright that they absolutely sell your "anonymized" data to other companies.
AccuWeather is being mealy-mouthed about all of this. They are technically correct that they aren't doing this stuff, but they don't point out that their service provider, Reveal Media, is.
Accuweather Has A long history of shady dealings (Score:1)
Re: (Score:2)
Double negative (Score:2)
a denial that they never stole anyone's cash.
So they do steal cash? Those rat bastards!
The fuck did you expect... (Score:3)
"Claiming this is about GPS coordinates is like if they were caught stealing debit cards and they issued a denial that they never stole anyone's cash."
The EULA was written by a lawyer...and for some reason people were not expecting a response like this?
Give me a fucking break. Corporations tell half-truths using legal doublespeak to fool the ignorant masses all the time. What else is new.
Re: (Score:2)
There's even a relevant XKCD [xkcd.com] about this
Install good Privacy app for seeing any spying app (Score:1)
Unfortunately this is how 'free' apps are making money these days.
I use Glasswire on Windows and android to check what apps are using my internet to upload/download.
Their latest blog post is is a good read about how some apps are getting too much information about people.
https://blog.glasswire.com/2017/08/17/is-your-data-usage-or-vpn-app-spying-on-you/
reveal = creepy (Score:2)
That reveal website looks like an independent criticism of their company's MO, but it's just THEM saying what they do plainface. It's like if the state lotto had a website titled "how to profit off the poor and stupid. "
Why Use Accuweather? (Score:2)
I do not understand why some people in the U.S. are adverse to using the National Weather Service, which does not track your visits to its Web sites.
International coverage; apparent Flash dependency (Score:2)
I too rely on Weather.gov, a service of the National Weather Service. But NWS operates only in the United States, and many people who often travel internationally don't want to have to find, install, and learn a different website for each country to which they travel. I'd bet some countries don't even have a counterpart to Weather.gov, either because they're poor or because they've enacted a counterpart to Rick Santorum's NWS Duties bill [wikipedia.org]. This failed bill would have banned NWS from issuing any information t
What's wrong with all these weather companies? (Score:1)