Slashdot Mirror
Wading Through AccuWeather's Response (daringfireball.net)
On Tuesday, ZDNet reported that popular weather app AccuWeather was sending location-identifying information to a monetization firm, even when a person had disabled location data from the app. In a response, AccuWeather said today "if a user opts out of location tracking on AccuWeather, no GPS coordinates are collected or passed without further opt-in permission from the user." But it is misleading people. John Gruber of DaringFireball writes: The accusation has nothing to do with "GPS coordinates." The accusation is that their iOS app is collecting Wi-Fi router names and MAC addresses and sending them to servers that belong to Reveal Mobile, which in turn can easily be used to locate the user. Claiming this is about GPS coordinates is like if they were caught stealing debit cards and they issued a denial that they never stole anyone's cash. The accusation comes from Will Strafech, a respected security researcher who discovered the "actual information" by observing network traffic. He saw the AccuWeather iOS app sending his router's name and MAC address to Reveal Mobile. This isn't speculation. They were caught red-handed. GPS information is more precise, and if you grant the AccuWeather app permission to access your location (under the guise of showing you local weather wherever you are, as well as localized weather alerts), that more precise data is passed along to Reveal Mobile as well. But Wi-Fi router information can be used to locate you within a few meters using publicly available databases. Seriously, go ahead and try it yourself: plug your Wi-Fi router's BSSID MAC address into this website, and there's good chance it'll pinpoint your location on the map. "Other data, such as Wi-Fi network information that is not user information, was for a short period available on the Reveal SDK, but was unused by AccuWeather," the company writes. In what way is the name and MAC address of your router not "user information"? And saying the information was "unused by AccuWeather" is again sleight of hand. The accusation is not that AccuWeather itself was using the location of the Wi-Fi router, but that Reveal Mobile was. Here are Reveal Mobile's own words about how they use location data.
Accuweather confirms what everyone should already know, or assume.
The network connections are managed in the iphone settings. Why would a weather app get access to available SSID info? Seems like Apple left the door open.
"Oops, this functionality was inadvertently included in the release version of our app. We have removed it and apologize for this error."
How hard is that? Sure, it's still a lie, but at least it's not flipping the users the bird.
They can actually be more precise if you are indoors and can't get a great GPS fix. Turn off wifi, open google maps, look at the size of the location circle, then turn Wifi on and watch it collapse.
Funny story but this is how I found out Amazon sold me a used router as new. For a while after I first got it, google maps in Android insisted that I was in a house in NW Washington outside Seattle, and not where I actually live in the mid-west. At some point that router (or one with an identical MAC, but that's not really supposed to happen) was on and was picked up by either a streetview car or an android phone and added to their database. And it was just google, Apple devices didn't have this issue.
I browse on +1 so AC's need not respond, I won't see it.
Well you just revealed your own ignorance there. Your WAN IP can indeed be tied to a fixed point in a lot of cases. Of course the area around that fixed point may be anywhere from metres to planetary scale but IP geolocation indeed works to some degree.
What they're doing is merely annoying. What is actually far worse is trying to obfuscate the actual issue by issuing a mea culpa speaking to 'GPS signals' -- rather than an open admission of what they were doing and why.
And this somehow okay?
The cover-up is almost always worse than the actual deed.
You have that mixed up still...
ESSID = name
BSSID = mac address (usually of the ap's wireless interface)
http://spamdecoy.net - free throwaway anonymous email - avoid spam!