Slashdot Mirror
Wading Through AccuWeather's Response (daringfireball.net)
On Tuesday, ZDNet reported that popular weather app AccuWeather was sending location-identifying information to a monetization firm, even when a person had disabled location data from the app. In a response, AccuWeather said today "if a user opts out of location tracking on AccuWeather, no GPS coordinates are collected or passed without further opt-in permission from the user." But it is misleading people. John Gruber of DaringFireball writes: The accusation has nothing to do with "GPS coordinates." The accusation is that their iOS app is collecting Wi-Fi router names and MAC addresses and sending them to servers that belong to Reveal Mobile, which in turn can easily be used to locate the user. Claiming this is about GPS coordinates is like if they were caught stealing debit cards and they issued a denial that they never stole anyone's cash. The accusation comes from Will Strafech, a respected security researcher who discovered the "actual information" by observing network traffic. He saw the AccuWeather iOS app sending his router's name and MAC address to Reveal Mobile. This isn't speculation. They were caught red-handed. GPS information is more precise, and if you grant the AccuWeather app permission to access your location (under the guise of showing you local weather wherever you are, as well as localized weather alerts), that more precise data is passed along to Reveal Mobile as well. But Wi-Fi router information can be used to locate you within a few meters using publicly available databases. Seriously, go ahead and try it yourself: plug your Wi-Fi router's BSSID MAC address into this website, and there's good chance it'll pinpoint your location on the map. "Other data, such as Wi-Fi network information that is not user information, was for a short period available on the Reveal SDK, but was unused by AccuWeather," the company writes. In what way is the name and MAC address of your router not "user information"? And saying the information was "unused by AccuWeather" is again sleight of hand. The accusation is not that AccuWeather itself was using the location of the Wi-Fi router, but that Reveal Mobile was. Here are Reveal Mobile's own words about how they use location data.
Accuweather confirms what everyone should already know, or assume.
They named it AccuWeather for weather reports. If they wanted to convey an accurate privacy policy, wouldn't they have called it AccuPrivacyPolicy?
Let's make like a bird... and get the flock outta here.
Your IP, easily obtainable by anyone you are communicating with, already nails down your location to a relatively small area. Triangulation of mobile device signals and tower locations can as well. This is really not much different, and pretty much a non-story. I suspect some small-fry in the world of internet security attempting to make a name for himself.
The network connections are managed in the iphone settings. Why would a weather app get access to available SSID info? Seems like Apple left the door open.
I don't think Apple allows things like WiFi sniffers / analyzers, so what other legitimate purpose is there for an app to have access to any info about the WiFi network? I would have assumed this info was locked away from the public API on iOS, only available to the OS functions that manage WiFi connectivity.
Of course, any app could still determine your public IP address and try to locate based on that, but at least it'll have even worse accuracy than the Reveal Mobile database.
hoping something relevant & truthful will appear... or warnings of what's to come... cease fire stand down... motive=results... some people still calling this 'weather'?
"Oops, this functionality was inadvertently included in the release version of our app. We have removed it and apologize for this error."
How hard is that? Sure, it's still a lie, but at least it's not flipping the users the bird.
Seriously, go ahead and try it yourself: plug your Wi-Fi router's BSSID MAC address into this website...
Not sure which website the submitter was aiming for, but since the hyperlink is missing, here's one website option to try.
I tried it with three of my school's AP BSSID's, and I'm surprised that all three were accurate to the actual building. I thought the closest anyone could get was by geotracking our IP address, which leads them to a nearby town. But I had no idea that BSSID's could be much, much more precise.
... just uninstall the goddam thing.
It little behooves the best of us to comment on the rest of us.
This reminds me all the times companies say: "Don't worry, we will not sell your data".
This is a similar smokescreen, because an equally important question is: are they selling the 'derived data' or 'modelled data' that their algorithms distill from your data? For example, when your Facebook likes reveal that you are probably pregnant/gay/smoker/etc, even though you have never literally given up that information. Because most people don't know about this distinction, they are lulled into a false sense of trust when they hear their data isn't being sold.
Accuweather has a long history of shady dealings. This comes as little surprise. One of their founders is an attorney. They are well known for suing their customers.
a denial that they never stole anyone's cash.
So they do steal cash? Those rat bastards!
systemd is Roko's Basilisk.
"Claiming this is about GPS coordinates is like if they were caught stealing debit cards and they issued a denial that they never stole anyone's cash."
The EULA was written by a lawyer...and for some reason people were not expecting a response like this?
Give me a fucking break. Corporations tell half-truths using legal doublespeak to fool the ignorant masses all the time. What else is new.
Citation? A quick search shows them being sued, but not them suing their customers.
Protoplasm. Quiet Protoplasm. I like quiet protoplasm.
Unfortunately this is how 'free' apps are making money these days.
I use Glasswire on Windows and android to check what apps are using my internet to upload/download.
Their latest blog post is is a good read about how some apps are getting too much information about people.
https://blog.glasswire.com/2017/08/17/is-your-data-usage-or-vpn-app-spying-on-you/
BSSID MACs are specific to each SSID being broadcast. Most of the octets are the same, but there will be one or two that are different in order to make it unique for that SSID.
That reveal website looks like an independent criticism of their company's MO, but it's just THEM saying what they do plainface. It's like if the state lotto had a website titled "how to profit off the poor and stupid. "
ôó
This is great! Now I can install Accuweather on my Android Stereo. If someone ever steals my car, disables GPS, and logs me out of Google or disables location history, I will have law enforcement contact them.
But he did sleep at a Holiday Inn Express last night so fuck you!
I just now visited a few Web sites that do geolocation.
One site has me at the opposite end of the county in which I live, about 40 miles away. On repeating that request, that same Web site placed me in Moscow, Russia.
Another Web site has me in a city in an adjacent county. Two other sites have me in different states. Accuweather has me in Chantilly, Virginia, near Washington, DC; but I am actually about 20 miles from the Pacific Ocean.
All this is because I use a browser extension that sends fake headers when I request a Web page.
I thought I bought some privacy with VPN hiding my IP. Now I learn that my router's MAC is tied to my home address (I checked - it is) and there is nothing but a software manufacturer's good faith keeping my MAC/home address separate from my browsing habits. How much should I worry about this and can I do anything about it?
I do not understand why some people in the U.S. are adverse to using the National Weather Service, which does not track your visits to its Web sites.
Weather.com has the worst web site ever - they even put tabloid companies to shame.
Problem solved. Anybody demanding or trying to sell me a proprietary app I tell to fuck off. It's not worth the price. It's bad enough I carry a tracking device in the first place and my only real reason for doing so is so I can spend my crypto. Yes... I'm living in NH so there are lots of places to spend it. Over a dozen in my little old town of Keene alone. Thank you free staters! ie referencing the Free State Project.
I too rely on Weather.gov, a service of the National Weather Service. But NWS operates only in the United States, and many people who often travel internationally don't want to have to find, install, and learn a different website for each country to which they travel. I'd bet some countries don't even have a counterpart to Weather.gov, either because they're poor or because they've enacted a counterpart to Rick Santorum's NWS Duties bill. This failed bill would have banned NWS from issuing any information to the public other than severe weather alerts, precisely to boost the business of AccuWeather in Santorum's district.
In addition, NWS's radar loop is still using Adobe Flash Player unless you click the out-of-the-way "standard version". First I load the 7-day forecast for San Diego, home of Slashdot Media. Then I scroll down to "Radar & Satellite Image", click the radar picture, and then click "Reflectivity: Base Loop" at the left. It doesn't load because it's SWF, and this PC has no Flash Player installed. But if I click Standard Version at the top left, it loads as a GIF. I'd bet a lot of others couldn't find this.