Slashdot Mirror
Popular Weather App AccuWeather Caught Sending User Location Data, Even When Location Sharing is Off (zdnet.com)
Zack Whittaker, reporting for ZDNet: Popular weather app AccuWeather has been caught sending geolocation data to a third-party data monetization firm, even when the user has switched off location sharing. AccuWeather is one of the most popular weather apps in Apple's app store, with a near perfect four-star rating and millions of downloads to its name. But what the app doesn't say is that it sends sensitive data to a firm designed to monetize user locations without users' explicit permission. Security researcher Will Strafach intercepted the traffic from an iPhone running the latest version of AccuWeather and its servers and found that even when the app didn't have permission to access the device's precise location, the app would send the Wi-Fi router name and its unique MAC address to the servers of data monetization firm Reveal Mobile every few hours. That data can be correlated with public data to reveal an approximate location of a user's device. We independently verified the findings, and were able to geolocate an AccuWeather-running iPhone in our New York office within just a few meters, using nothing more than the Wi-Fi router's MAC address and public data.
Sorry if i've mis understood something, but I thought the 'WiFi Router name' (I assume meaning SSID, if it was the BSSID it would be even worse!) was only available through APIs when loc services are enabled? Have I missed something, or is it a bug in the Location Services API?
Damnit! I really like the AccuWeather app.
Now it's uninstalled.
Is it really so hard to make money with an app that user data has to be stolen to make a profit?
Accuweather is a free app. We don't pay for it, yet they have to run infrastructure, collect data, and other things that cost money. How do you think they pay for that? You aren't their clients. You're just part of their data set.
To get people's consent.
In lawsuits, and deservedly so.
Ah, there you are. Where did you go? On a fucking vacation? We need to see your pointless crap at the start of each thread otherwise it doesn't feel like Slashdot anymore.
Anyway, welcome back.
#DeleteFacebook
AccuWeather is one of the most popular weather apps in Apple's app store, with a near perfect four-star rating and millions of downloads to its name.
Who let this turd into the Walled Garden?
Prove you were damaged somehow?
I don't have to prove I was damaged. The FTC will do it for me.
https://www.ftc.gov/news-events/media-resources/protecting-consumer-privacy/enforcing-privacy-promises
So, went on an eclipse mini-vacation and I guess drove near the vicinity of a some trigger point. The caller was asking for another name, but still proceeded to sell me a pitch for a vacation spot I had "driven past." Now, was it my credit card company, the cell phone company, or the data-only account on my tablet who was responsible for leaking my location in real time to a vendor?
I swear to God...I swear to God! That is NOT how you treat your human!
Yep, I got rid of that app, was sucking down my battery and finally figured out why. The Weather Channel's app is pretty sketchy too. I know just use the browser to get my weather.
After all accuweather had previously tried to convince Congress to gut the NWS so they could make money: http://www.politico.com/story/... So the idea that Accuweather would do something shady isn't without precedent.
"The bass, the rock, the mic, the treble. I like my coffee black, just like my metal" - Mindless Self Indulgence
DROP TABLE location;
I got much better battery life after I removed the AccuWeather app from my phone (months ago). I thought it was doing something other than downloading ads all day.
Accuweather is a free app. We don't pay for it, yet they have to run infrastructure, collect data, and other things that cost money. How do you think they pay for that? You aren't their clients. You're just part of their data set.
I agree! They should ignore user preferences because they offer an app that is paid for by prostituting user data and calling it "free" - Lying.
I used to use AccuWeather before I found out that they are liars and frauds. AccuWeather is a bunch of scammers. Fauds.
AccuWeather lies to people. AccuWeather is a bunch of liars. AccuWeather scam.
So, asshole - don't ever defend a lying scum company like AccuWeather when they lie to their customers..
There is ZERO excuse!
AccuWeather lied to their customers.
I don't have to prove I was damaged. The FTC will do it for me.
https://www.ftc.gov/news-events/media-resources/protecting-consumer-privacy/enforcing-privacy-promises
LOL! I just sneezed a mouthful of Pepsi out of my mouth onto the monitor.
Awesome laugh, thanks man.
*uninstall*
Possibly all three with an AI mediated auction to see which one was allowed to sell you out first. Welcome to the future; it was yesterday.
All of those industries do those things (legally). It was probably a combination of all three.
I don't respond to AC's.
I'm still trying to figure out why people download and install executables to do simple tasks that I do in a web browser.
I blame the stupid Apple ad telling us "There's an App for that"
we take privacy issues very seriously," the spokesperson said. "We work to have our [terms of service and agreements] as current as the law is evolving and often beyond that which may be legally required to protect the privacy of our users."
If you're only doing what's "legally required", then you aren't, in fact, taking privacy issues "very seriously".
Google should ban the app for this deception.
In terms of security, I don't think there's much difference between using the browser and using the app.
Seriously, accuweather is about the WORST forecast going.
Only idiots or some robot would mod them up to a 4 star.
I prefer the "u" in honour as it seems to be missing these days.
To a certain degree, it doesn't matter which it was. Your phone is clearly leaking data to somebody, and you probably want to fix that.
If you're running Android and have updated to a reasonably recent version of Google Maps, then that's probably your problem. They added a "feature" to allow this. If that's the cause, they did also add a new option to disable it, or (better) you can disable location services, or (best) you can uninstall the app entirely.
For the few websites I browse on my phone they're constantly asking me to install their application instead. There is no way to block these messages because the host benefit from apps far more than a website visit.
Stallman was right after all.
As I just deleted accuweather form my phone., I'd appreciate suggestions for replacing it!
I don't install apps when a web page is sufficient.
some karma... and kinda lukewarm about it.
The overwhelming majority of these bullshit apps are essentially just a fucking web-page.
You don't fucking *need* an app for the weather, just visit their damned website.
These apps exist to collect data about you, push ads, and essentially act as a wrapper for their fucking web pages.
Boo fucking hoo if you don't realize most of these apps exist to harvest your data. Uninstall the fucking thing.
Samsung phones come with a crippled version of AccuWeather installed by default. It's integrated into the firmware and difficult to remove. Does that version track you too?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Not anymore!
Just go to Weather Underground instead, you don't need an 'app'. Or if you think that's too commercial and you're going to get tracked, then just go to the National Weather Service. Seriously, you don't need an 'app' for everything.
I have no need for a Weather app. I know what the weather is going to be.
May-Nov: Hot, Humid, Chance of rain
Dec-Apr: Less Hot, Less Humid, lesser chance of rain
Where's the 'locate sexconker so I can beat him to a pulp' app? I'd even get a smartphone for once just to be able to use that app!
It's gonna have heavy lawsuit rain tomorrow. Consider getting a lawyer before leaving home.
You do realize that the FTC falls under Trump's executive branch, right? If you're looking to the Trump administration for consumer protection, you're in for a rude awakening.
its forced onto you by just about every device maker in the universe, if you actually sit down and LOOK at it, succuweather is highly inaccurate and almost useless
for instance glancing at succuweather, on my phone its 10 degrees cooler than weather undergound, weather.com, google, and my local news station which are all in 1 degree of each other. Lot of fat fucking good it does me to know what the weather was ... 5 hours ago
Trump is too busying losing and playing golf to mind the FTC.
That's because he got tired of all the winning. Losing is the new winning. #greatagain
How can any smartphone app ignore system settings?
Aren't they running in sandbox?
Aren't they run buy a virtual machine?
Isn't that virtual machine doing any security policy checks on the app instructions to be run?
There's a huge difference!
The app was never accurate. One day, I checked for any rain in their "MinuteCast". There wasn't, which was supposed to be good for 120 minutes. After about 30 minutes, the app gave me "advanced" warning about a severe weather in the area. 1 minute later, mother nature gave a 45-minute-long performance of Torrential Downpour. Even my weak spidey senses picked up something was wrong long before that 1 minute of "advanced" warning.
That app was gone after I left a sarcastic review.
I would have thought that stories like this expose the deeply insightful nature of his frivolous-sounding blather.
I'm enough of a LUDDITE that I don't app apps, and I use a regular website to access weather information; even from a mobile device.
You don't need a hoverboard for each foot to garden in the rain, you just needs some good clogs.
And if did want to use an app, it would be open source.
My family travels with smart phones, but we don't use those sorts of apps. We don't get that sort of spam.
The stuff that leaks from credit card usage doesn't give out your info, but if you use third party banking apps those are unregulated and can do anything with your data without telling you. That's why I only use mobile banking provided directly by my bank.
The reality is that any app that asks for permission to know your location is a suspect. If you install apps with that permission, and they also ask for your phone ID, you can be pretty certain that they're selling your data. Your travel itinerary was probably sold separately numerous times; one time for each app you gave that combination of permissions to! Furthermore, some websites ask for that information; if you never turned it off in your browser, you might be leaking it there too.
But this story shows, it isn't enough just to be wary of app permissions; even apps without excess permissions are dangerous! Software tools are powerful, downloading random shit was stupid in the `90s, and it is still stupid today. And the average user still does it without any sense of caution at all.
Everyone seems to have forgotten that Android now requires location to be turn on for adv. Blue tooth services to work. Google REFUSED to comment on this. Sheepeople just kept quiet about it.