Slashdot Mirror
Popular Weather App AccuWeather Caught Sending User Location Data, Even When Location Sharing is Off (zdnet.com)
Zack Whittaker, reporting for ZDNet: Popular weather app AccuWeather has been caught sending geolocation data to a third-party data monetization firm, even when the user has switched off location sharing. AccuWeather is one of the most popular weather apps in Apple's app store, with a near perfect four-star rating and millions of downloads to its name. But what the app doesn't say is that it sends sensitive data to a firm designed to monetize user locations without users' explicit permission. Security researcher Will Strafach intercepted the traffic from an iPhone running the latest version of AccuWeather and its servers and found that even when the app didn't have permission to access the device's precise location, the app would send the Wi-Fi router name and its unique MAC address to the servers of data monetization firm Reveal Mobile every few hours. That data can be correlated with public data to reveal an approximate location of a user's device. We independently verified the findings, and were able to geolocate an AccuWeather-running iPhone in our New York office within just a few meters, using nothing more than the Wi-Fi router's MAC address and public data.
Sorry if i've mis understood something, but I thought the 'WiFi Router name' (I assume meaning SSID, if it was the BSSID it would be even worse!) was only available through APIs when loc services are enabled? Have I missed something, or is it a bug in the Location Services API?
Damnit! I really like the AccuWeather app.
Now it's uninstalled.
Is it really so hard to make money with an app that user data has to be stolen to make a profit?
To get people's consent.
In lawsuits, and deservedly so.
Ah, there you are. Where did you go? On a fucking vacation? We need to see your pointless crap at the start of each thread otherwise it doesn't feel like Slashdot anymore.
Anyway, welcome back.
#DeleteFacebook
Display ads, don't steal user data.
#DeleteFacebook
I don't have to prove I was damaged. The FTC will do it for me.
https://www.ftc.gov/news-events/media-resources/protecting-consumer-privacy/enforcing-privacy-promises
The copy of Accuweather I use is paid... Definitely not a freebie. In any case, the app is history for now.
So, went on an eclipse mini-vacation and I guess drove near the vicinity of a some trigger point. The caller was asking for another name, but still proceeded to sell me a pitch for a vacation spot I had "driven past." Now, was it my credit card company, the cell phone company, or the data-only account on my tablet who was responsible for leaking my location in real time to a vendor?
I swear to God...I swear to God! That is NOT how you treat your human!
After all accuweather had previously tried to convince Congress to gut the NWS so they could make money: http://www.politico.com/story/... So the idea that Accuweather would do something shady isn't without precedent.
"The bass, the rock, the mic, the treble. I like my coffee black, just like my metal" - Mindless Self Indulgence
The copy of Accuweather I use is paid... Definitely not a freebie. In any case, the app is history for now.
You should also ask Apple to refund your app purchase price.
Only sound they'll respect is money flowing out of their account
DROP TABLE location;
I got much better battery life after I removed the AccuWeather app from my phone (months ago). I thought it was doing something other than downloading ads all day.
Possibly all three with an AI mediated auction to see which one was allowed to sell you out first. Welcome to the future; it was yesterday.
All of those industries do those things (legally). It was probably a combination of all three.
I don't respond to AC's.
The Weather Channel app displays ads; and, while the app could stand a bit of UI tweaking in my opinion, their forecasts are supposedly top-notch (according to Professor Cliff Mass).
#DeleteChrome
we take privacy issues very seriously," the spokesperson said. "We work to have our [terms of service and agreements] as current as the law is evolving and often beyond that which may be legally required to protect the privacy of our users."
If you're only doing what's "legally required", then you aren't, in fact, taking privacy issues "very seriously".
That's fine -- but in this case, the app is intentionally circumventing the user's express wishes and giving the impression that the user's wishes are being honored.
That's deceptive. An honest app would just refuse to run until you gave it the permissions that it demands. It wouldn't engage in hacks like this.
Display ads, don't steal user data.
...and offer me an option to buy an ad-free version. If your product is worth it, I will gladly pay a reasonable amount to get rid of the ads.
I browse on +1 so AC's need not respond, I won't see it.
Google should ban the app for this deception.
In terms of security, I don't think there's much difference between using the browser and using the app.
Seriously, accuweather is about the WORST forecast going.
Only idiots or some robot would mod them up to a 4 star.
I prefer the "u" in honour as it seems to be missing these days.
I don't mind ads as long as they're well-behaved. My problem is the tracking that comes with them. There are an awful lot of apps (and websites) that allow you to pay money to disable ads, but the tracking continues to take place anyway.
To a certain degree, it doesn't matter which it was. Your phone is clearly leaking data to somebody, and you probably want to fix that.
If you're running Android and have updated to a reasonably recent version of Google Maps, then that's probably your problem. They added a "feature" to allow this. If that's the cause, they did also add a new option to disable it, or (better) you can disable location services, or (best) you can uninstall the app entirely.
For the few websites I browse on my phone they're constantly asking me to install their application instead. There is no way to block these messages because the host benefit from apps far more than a website visit.
Stallman was right after all.
As I just deleted accuweather form my phone., I'd appreciate suggestions for replacing it!
Are you telling a company who offers a free app on how to run their business model?
Tired of my customary (Score:1)
Get the Android version and it does offer a paid for ad-free version - AccuWeather Platinum.
I don't install apps when a web page is sufficient.
some karma... and kinda lukewarm about it.
If they're trying to ignore privacy laws? Yes I am.
#DeleteFacebook
Samsung phones come with a crippled version of AccuWeather installed by default. It's integrated into the firmware and difficult to remove. Does that version track you too?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Just go to Weather Underground instead, you don't need an 'app'. Or if you think that's too commercial and you're going to get tracked, then just go to the National Weather Service. Seriously, you don't need an 'app' for everything.
It's gonna have heavy lawsuit rain tomorrow. Consider getting a lawyer before leaving home.
its forced onto you by just about every device maker in the universe, if you actually sit down and LOOK at it, succuweather is highly inaccurate and almost useless
for instance glancing at succuweather, on my phone its 10 degrees cooler than weather undergound, weather.com, google, and my local news station which are all in 1 degree of each other. Lot of fat fucking good it does me to know what the weather was ... 5 hours ago
Display ads, don't steal user data.
Ads don't generate sufficient revenue and the race to bottom on app pricing means selling them for 99c doesn't generate enough turnover to support them.
My pay check doesn't generate sufficient revenue and the HB-1 salaries means my yearly salary doesn't generate enough to support me. So I'll just steal from everyone instead.
How stupid does that sound? Because that's what you just said when defending those assholes.
#DeleteFacebook
What are they stealing? Your position?
Tired of my customary (Score:1)
How can any smartphone app ignore system settings?
Aren't they running in sandbox?
Aren't they run buy a virtual machine?
Isn't that virtual machine doing any security policy checks on the app instructions to be run?
I would have thought that stories like this expose the deeply insightful nature of his frivolous-sounding blather.
I'm enough of a LUDDITE that I don't app apps, and I use a regular website to access weather information; even from a mobile device.
You don't need a hoverboard for each foot to garden in the rain, you just needs some good clogs.
And if did want to use an app, it would be open source.
My family travels with smart phones, but we don't use those sorts of apps. We don't get that sort of spam.
The stuff that leaks from credit card usage doesn't give out your info, but if you use third party banking apps those are unregulated and can do anything with your data without telling you. That's why I only use mobile banking provided directly by my bank.
The reality is that any app that asks for permission to know your location is a suspect. If you install apps with that permission, and they also ask for your phone ID, you can be pretty certain that they're selling your data. Your travel itinerary was probably sold separately numerous times; one time for each app you gave that combination of permissions to! Furthermore, some websites ask for that information; if you never turned it off in your browser, you might be leaking it there too.
But this story shows, it isn't enough just to be wary of app permissions; even apps without excess permissions are dangerous! Software tools are powerful, downloading random shit was stupid in the `90s, and it is still stupid today. And the average user still does it without any sense of caution at all.
Or you know, don't do any of that.
Yea but as far as privacy goes that's like jumping out of the pan and into the eternal flames of hell.
I browse on +1 so AC's need not respond, I won't see it.