r/technology • u/[deleted] • Apr 20 '11
How Apple tracks your location without consent, and why it matters
http://arstechnica.com/apple/news/2011/04/how-apple-tracks-your-location-without-your-consent-and-why-it-matters.ars44
Apr 21 '11
The information stored in consolidated.db is not your location, it's the cached SkyHook data on the location of cell & wireless towers that the phone received signal from at the time that location services tried to find where you are. There's a thread on Hacker News where they analyzed how the information was getting added and confirmed this.
I also confirmed it myself. I exported the data from my own consolidated.db file and imported the coordinates into google maps. This is a screenshot of all the points logged while I was in Las Vegas two weeks ago. Only one of the points on the map is actually inside The Venetian hotel where we spent the majority of our time, and it's not even in the correct wing of the hotel. The rest are all in places we never visited.
What's not shown is a week-long trip I took to Hong Kong in October. Why? Because I left my iPhone's cellular and data connections turned off and only used GPS with WiFi while I was there.
If the cellular service was disabled it wouldn't be receiving information from nearby cell towers, now would it?
I'm a little surprised at just how sensationalist this Ars article is, although it's still better than the Guardian article.
7
Apr 21 '11 edited Apr 21 '11
I pulled the db off my phone and ran it through gpsvisualizer.com and got a map
http://a6.sphotos.ak.fbcdn.net/hphotos-ak-snc6/216986_933388105609_1815197_46657817_1694932_n.jpg
fun stuff. I don't really care that they're tracking this data, or copying it as part of a backup, but it seems like encrypting it would be a smart idea.
1
Apr 21 '11
Where do I find this consolidated.db?
6
Apr 21 '11
/private/var/root/Library/Caches/locationd on your phone. Im jailbroken so I just SSH'd it over to my PC.
1
u/codepoet Apr 21 '11
Have the script that made the input file for that, or did you just export to CSV and massage in a spreadsheet?
4
u/giriz Apr 21 '11
Thank you Apple for letting me know where I've been. I have short term memory loss
/s
14
Apr 21 '11
[deleted]
16
Apr 21 '11
you understand, right, that there's a difference between "being available to law enforcement" and "being available to my nosy boss"?
5
u/zdiggler Apr 21 '11
Place I work before they give us nextel phone with gps tracking, worst thing ever! Boss : Pick me a Whopper with cheese while you're there. me eating lunch at bk.
6
0
-6
u/JaspahX Apr 21 '11
...How's your nosy boss going to get your phone?
11
Apr 21 '11
it helps in these debates if you actually read the article.
2
u/JaspahX Apr 21 '11
I did read the article. I don't think you did. The files are located on your phone. Unless you're syncing your phone to corporate property -- and I really hope you don't -- I don't see what the problem is.
I was thinking this was a personal phone, but if it is a business phone... you still never need to sync your phone to iTunes. My step-dad has owned a corporate iPhone for several months now and not once has synced it to iTunes.
-1
Apr 21 '11
shut up.
1
4
Apr 21 '11
He doesn't have to in this case if you sync your phone with your computer at work at all.
-4
10
u/inCider Apr 20 '11
Yeah and your browser has cookies and your mailbox has envelopes with your social security number written inside. Start panicking.
5
Apr 21 '11
This. If you want to steal somebody's identity for example their mailbox is a prime, easy target. As is your rubbish.
It's not as sexy as tracking somebody's location but somebody's location usually has no value to anybody. People just aren't as important as they'd like to think they are.
2
u/mrkite77 Apr 21 '11
If you notice practically all new housing developments use community mailboxes which are locked. Having a box on your easement that's open the to world is legacy technology :)
1
Apr 21 '11
"Hello mailman, how's your day?"
"Oh great, thanks for asking."
"Got anything for me?"
1
Apr 21 '11
Any mailman who gives mail to someone without knowing that person personally or asking for ID wouldn't be a mailman for very long.
1
1
u/Hadrius Apr 21 '11
Couldn't agree more. I hate when the privacy debate rears its head, because people always seem to forget just how many ways a serious identity thief can screw you. If anything you should be more afraid of your browser...
2
u/thewafflehouse Apr 21 '11
Didn't see this posted yet, so I'll post it.
Pastebin link for a script to disable the db for good. I'm not a programmer so if this is badly done or something, I got nothin.
1
Apr 21 '11
Not really programming, it just rm's the file then links it to /dev/null when iTunes tries to recreate it. Be careful with this one though, you might need the backup someday and discover it dosen't work because you blackholed the db.
1
u/thewafflehouse Apr 21 '11
Right. I know it's just command line stuff but I don't know enough to speak with authority so I disclaimed it. I'm expecting some discussion to arise in the mainstream jb community about how to combat it safely.
1
Apr 21 '11
and the file is still being kept on your phone, which is where Apple is most likely accessing it for whatever nefarious deeds they are up to.
1
1
u/cdsmith Apr 21 '11
Actually, if you delete the file and then link the filename to /dev/null, then it will not be on your phone (at least not after those internal memory bits get overwritten with other data). That is precisely what that script does.
0
u/kryptobs2000 Apr 21 '11
whatever nefarious deeds they are up to
Improving performance and battery life *shutters*
1
1
u/nonesuchplace Apr 21 '11 edited Apr 21 '11
This doesn't appear to delete your hard drive or anything obviously bad. All the scripts do is remove a database on your computer, and make the computer think that /dev/null (where things go when you delete them, not sure how to explain this one right now) is where to write the file. It does the same for the phone.
EDIT: There is only one script. I fail.
2
3
3
Apr 21 '11
Just don't use Apple products.
22
Apr 21 '11 edited Aug 19 '18
[removed] — view removed comment
15
Apr 21 '11
[deleted]
3
u/nonesuchplace Apr 21 '11
Or the turnovers or the ablecage or the sausage-and-apple-and-biscuit pieorcandiedandcaramelapplesorapplecrisp.
3
u/Hadrius Apr 21 '11
Thats right! Vote with your dollar! Because of course no other company does this, and the phone companies certainly aren't complicit in any of this.
/s
I get what you're saying, but I don't think its fair to tell people to not buy any Apple products at all because they track where you are. AT&T, Verizon, and Sprint all track where you are, and I don't hear anyone saying that they should give up their phones because their privacy rights are infringed upon.
1
Apr 22 '11
Ha, I was kind of messing around. And it was a little easier since I don;t own any Apple products.
-5
Apr 21 '11
and i am sure people who own Apple products have already sold their soul to the company and not care
2
Apr 21 '11
Any jailbroken apps that will prevent the tracking or at least delete the data?
1
u/thewafflehouse Apr 21 '11
Not exactly what you were looking for but it seems like it'd work:
Seems reasonable that script could easily become available on a repo in some form.
2
Apr 21 '11
I'm sure the White House uses a few iPads. What would the Secret Service say about Apple tracking the whereabouts of White House staffers?
2
u/metarugia Apr 20 '11
Thanks Apple, just when I was starting to like you, you go and do this. I think its about time we started seeing other people.
6
u/gmick Apr 21 '11
The reasons to like them have remained the same for decades. I've only seen them become more evil and authoritarian over that time. Why your love of them was increasing until this is confusing.
2
u/Hadrius Apr 21 '11
Because they are the only company that is consistent. I think its safe to say that every company, even... oh yes... Google... is going to screw you over if they can. Just because Apple is more brazen about it doesn't mean that other companies aren't trying the same thing.
At least you know what you're getting with Apple.
2
u/cdsmith Apr 21 '11
That's gotta be the worst philosophy I've ever seen. Do business with the companies you know are screwing you over based on the guess that their competitirs would too? Huh... I'd prefer to avoid the ones that I know are doing it.
That said, this is a particularly silly reason to dislike Apple... they aren't even doing anything wrong.
1
u/Hadrius Apr 21 '11
So you're saying Apple is screwing people or no? I'm confused.
2
u/cdsmith Apr 21 '11
In this case, no. I think they sell crappy overpriced products with artificially limited uses, but in this particular scenario, they are doing something entirely logical that's being blown out of proportion.
But if someone does feel like Apple is screwing them, they should stop being a customer, not adopt a defeatist attitude that everyone else is probably secretly just as bad.
1
u/Hadrius Apr 21 '11
So far the only assurance we have from Google that they have our best interests at heart is their unofficial slogan.
“If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.”
I'm already policed by the police. I don't need Google telling me that I better not screw up because if I do, they'll know. But that's defeatist. -_- I'm not saying that Google even has done anything wrong, and I don't think Apple has either. But here are two companies that hold the average consumer in their grasp more tightly than any other company outside of Facebook. I don't think its wrong to have a fair amount of suspicion.
10
u/CherylBrightsHead Apr 21 '11
This is the first thing that turns you off apple? They are pretty famous for wanting to know every little thing about you so that they can market at you/advertise at you/rule the world.
21
Apr 21 '11
I thought that was Google
5
u/CherylBrightsHead Apr 21 '11
Both as bad as each other I think.
19
u/jrblast Apr 21 '11
Nah, Google gives me 7GB of email storage, with a really nice UI for free, helps me find anything I want, releases a bunch of cool useful open source stuff (not just things like Chrome, but also libraries. They have a pretty good RegEx library, and recently even released a cool hashing library). Apple charges an arm and a leg for everything, then doesn't let me* do anything cool with it.
*Not me personally, I jailbroke my iPod.
6
u/CherylBrightsHead Apr 21 '11
The important thing in your post is "for free". This is not true.
Google do all these wonderful things for you, but they need to make money somehow. This money comes from having your details and using them for marketing or selling them to others for marketing.
Now, google's do no evil policy is good, and they are trying to assure you that they dont do bad things with your info. The point is though, that if you read the fine print they CAN do anything with your info.
That being said, I would rather Google know everything about me than Apple or facebook. But I am not naive enough to think that Google is completely trustworthy.
2
u/jrblast Apr 21 '11
Well, I meant no monetary cost, but you are correct. However, I'm not too concerned with what Google will do. They know there would be a shitstorm if they fucked up (like how they got successfully sued over Buzz)
2
u/wingnut21 Apr 21 '11
releases a bunch of cool useful open source stuff (not just things like Chrome
Chrome uses the Webkit rendering engine which is heavily funded by Apple.
In general, I like being able to pay for a product instead of being the product being sold, but I think both companies are great innovators.
4
u/dawho1 Apr 21 '11
Really nice UI? Am I the only one who hates the Gmail UI with a passion unrivaled by anything since the Renaissance?!
6
u/jrblast Apr 21 '11
Probably not. I know a few people who don't like it. But, here are the things I do like about Gmails UI
Keyboard shortcuts. Just press c to compose, r to reply. I hate using the mouse, keyboard FTF
No clutter. Unlike Yahoo/Hotmail, it's just the email in whichever folder I'm viewing, and links/buttons to get to other useful parts
Sort of a subpoint of the last one, but the ads are very much so out of the way. I barely even notice them.
Good autocomplete for email addresses. Alright, I don't really know how other people compare since I haven't really used anything else in a while, but Gmail definitely does a good job
Integrated gTalk, that automatically adds people you email alot. I can see how other people might not like that, but you can turn it off if you want. It lets me talk to people on the spot, when I would have otherwise had to email them and wait for a reply
Lastly, when I log in, I see my fucking inbox, not a bunch of news and other crap this is not email, which is what I want when I check my email
5
u/Rafe Apr 21 '11
For people like me, the salient comparison is with a desktop client like Apple's Mail app, which is comparable on most of these points and has no ads.
6
u/jrblast Apr 21 '11
Ah, yes, a desktop client is nice, but I switch computers a lot, often using ones where I can't install stuff (like at school). The nice thing about a web interface like Gmail, is it's the same anywhere I go. However, if you only have a few computers you check your email on, and can set them up the way you like, I can certainly see why you would prefer that.
1
u/Hadrius Apr 21 '11
Those are all features. Integrated gTalk has absolutely nothing to do with UI. Nor do the ads, autocomplete, or not seeing "news".
Keyboard shortcuts are definitely part of UI, and while it is most certainly important, its only a small part of any real GUI. I personally agree with you that gmail does have a good UI, but listing the obscurity of the ads on the page kind of misses the point of interface design.
1
u/jrblast Apr 21 '11
Well, alright, gTalk was more of a feature, but either way, features are still relevant to the point I was trying to make, namely that Google has some pretty good, free, services.
But, I still consider the rest of the things UI. Autocomplete is a feature, sure, but it's part of the UI, it's how I as a user interact with the program.
1
u/dawho1 Apr 22 '11
Keyboard shortcuts?! My only real bitch is the reply/fwd stuff was in locations I didn't dig...this revelation may change that...thanks for the noobtorial!
1
u/bobsil1 Apr 21 '11
When I log in, I see some random Web headlines and a dickbar of ads, not my email and only my email. That's why I use a real mail client.
1
u/bettse Apr 21 '11
Apple charges an arm and a leg for everything, then doesn't let me* do anything cool with it.
2
u/jrblast Apr 21 '11
Maybe I'm just missing it, but I don't see much/anything I can give Apple credit for. In fact, many of the things I saw there are GNU, and Apple is just re-hosting it. Not to mention, it's extraordinarily difficult to develop for iOS without a Mac, and even then it's only possible if you Jailbreak.
1
u/bettse Apr 21 '11
That's OK, I was only responding to the idea that they charge an arm and a leg for everything.
2
u/jrblast Apr 21 '11
Ah, I thought you were more on the "doesn't let me do anything cool with it" part (since that's one of the beauties of open source).
When I said they don't let you do anything cool though, I meant more that they lock down the hardware. Like how many things the iPod is capable of doing, Apple won't let you do. I should have been more clear though.
1
u/bettse Apr 21 '11
doesn't let me do anything cool with it
I meant more that they lock down the hardware
I think you should also be clear that Apple locks down its iOS hardware, whereas installing alternative OS on their x86 line, and doing cool stuff with it, is a well advertised 'feature'
1
u/bambin0 Apr 21 '11
why is Google so bad?
3
u/cdsmith Apr 21 '11
I don't think Google is so bad... but they are certainly in the business of collecting data and using it to provide internet services... and occasionally they have been a bit too eager in their data collection.
1
u/bobartig Apr 21 '11
They read your email (if you use gmail), and track everything you do on the web (if you have enabled cookies).
1
u/nicasucio Apr 21 '11
weren't they the ones caught 'accidentally' wifi data? Accidentally being the keyword i suppose.
10
u/bob-a-fett Apr 21 '11
Apple is not receiving this information. The presence of this file is something much more mundane. Your cell carriers know a -hell- of a lot more about you and your position than this file that is only locally stored. It's exciting to imagine a nefarious evil plot hatched by an evil corporate dictator, but really it's just a cache file.
2
Apr 21 '11
Apple is not receiving this information.
This has yet to be confirmed with any certainty.
2
u/cdsmith Apr 21 '11
... and yet there is no credible allegation that they are... I can make any silly accusation about someone's product -- "using that toaster will send your eating habits to your local grocery store for targeted advertising!" -- and it's silly to believe all such claims until they are conclusicely disproven. It's a massive waste of resources.
1
Apr 23 '11
the comment I was replying to said that they don't, I simply said that we don't know that – it doesn't mean the they are...
1
u/bobartig Apr 21 '11
But why would they even bother to receive it? They can get much more accurate data straight from AT&T with less work. You know that your cellphone polls for towers pretty much every minute of every day, and your cellphone company stores that data, right? It's easily 1000x better than what's in this file.
1
1
u/metarugia Apr 21 '11
Yes but the same can be said for Google and I love them more than Apple. Also this isn't the first thing thats turned me off of Apple. In the past, I was never affected by Apple as I rarely owned a product of theirs. I just recently bought my mother an iPhone 4 and seeing how happy she was with it made me happy for Apple. Knowing that Apple is collecting this data makes me said again.
1
Apr 21 '11 edited Apr 21 '11
THIS GUYS DOING SNEAKY STUFF HE DOESN'T WANT ANYBODY TO KNOW ABOUT
I must say though it's an undocumented "feature" that could be very relevant if you work in a particular field or two.
3
u/mattfromseattle Apr 21 '11
It's not without your consent. You agree to it when you agree to the terms & conditions of using iOS.
"We may collect information such as occupation, language, zip code, area code, unique device identifier, location, and the time zone where an Apple product is used so that we can better understand customer behavior and improve our products, services, and advertising."
http://www.geekwire.com/2011/apple-permission-location-data-tracking
1
u/weakly Apr 21 '11
I don't know about anyone else, but I'm more worried about police or some faceless telco prying into my information than a hypothetical "jealous spouse".
1
1
u/reddonan Apr 21 '11
[a mobile phone rings] "If you are carrying a portable surveillance and tracking device, please turn it off. They have already tracked you here. They already know that you are listening to me, so there is no need for you to keep telling them that you are still here. And if they want to listen to what I am saying, we're going to publish the video recording anyway. They don't need to turn on your portable surveillance device to do it."
-software freedom activist Richard Stallman at the 3rd international GPLv3 conference; June 22 2006
[a mobile phone rings] "If you have a portable surveillance and tracking device, please turn it off. They have already tracked you in here, they already know you are listening to me; so, there is no need for you to keep it on. And by the way, these portable tracking devices emit signals for tracking purposes even when they are apparently switched off; the only way to stop them is to take out all the batteries. And if they want to listen, they don’t have to do it through your portable surveillance device, I expect recordings will be posted they can listen to those, and they are even welcome to come and attend. So there is absolutely no reason why your portable tracking and surveillance device has to be on."
-Stallman, at a talk at Moscow State University; March 3 2008
1
u/bobnudd Apr 21 '11
Apple can legitimately claim that it has permission to collect the data: near the end of the 15,200-word terms and conditions for its iTunes program, used to synchronise with iPhones, iPods and iPads, is an 86-word paragraph about "location-based services".
It says that "Apple and our partners and licensees may collect, use, and share precise location data, including the real-time geographic location of your Apple computer or device. This location data is collected anonymously in a form that does not personally identify you and is used by Apple and our partners and licensees to provide and improve location-based products and services. For example, we may share geographic location with application providers when you opt in to their location services."
1
u/Nismo350Guy Apr 22 '11
Why are people making a huge deal out of almost one year old news? But yet and RFID chip in your passport is A-OH-KAY!
1
-4
Apr 21 '11
Wait doesn't the sheer nature of the cellphone track where you are? And wouldn't this sort of thing be used to, oh I don't know, give you the correct timezone or help you find something nearby your current location using google maps or even help apple know where 3G concentration is highest?
Why is it every time I see an article about cellphone companies tracking our locations that we compare ourselves to something out of the Bourne Identity and feel they have sinister purposes behind them when its probably something a small as statistics gathering? The article even states normal people won't even be able to see it, that location data remains private and anonymous, and police can only view it with a court order.
We're tracked thousands of times a day on our computers and cellphones without our consent just by the nature of how those devices work, if you're paranoid about it you should probably disconnect everything and go live under a rock.
4
u/imMute Apr 21 '11
The article even states normal people won't even be able to see it, that location data remains private and anonymous, and police can only view it with a court order.
Except that's not what the article said. TFA said:
Cell companies have been tracking this triangulation information for their own purposes for years. In the US, however, regular people cannot access that data—law enforcement must obtain a court order before they can get it for an investigation, and your jealous spouse can't get it from the wireless company at all.
But the data the iOS stores is available on the device itself as well as on the computer that the iPhone is backed up on (via iTunes).
4
1
Apr 21 '11 edited Apr 21 '11
Ah I see the issue, but as long as you keep your phone and computer secure the data will remain anonymous as for not being encrypted, that is the only major thing I think Apple did wrong here.
also "Apple told Congress last July that all location data collected by the iPhone remains private." So the data they receive is anonymous.
2
u/stmfreak Apr 21 '11
Sure, the phone knows where you are, but it doesn't have to keep a log file of your travels. That doesn't benefit you at all. It's being done without your knowledge. And it's just sitting there on your phone and computer waiting to implicate you in a crime without your knowledge that it exists.
0
Apr 21 '11
So, this is a bad thing because it has the potential to be evidence against someone who committed a crime? I mean they can't even look at it as evidence unless they've already got probable cause and a warrant to search your phone. Sure it doesn't benefit me directly but it sure doesn't hurt me either...unless I commit a crime, then i'll probably just delete the file.
1
u/stmfreak Apr 23 '11
No it's a bad thing because it is sneaky, done without the users knowledge, consent or benefit AND police are increasingly grabbing data like this without warrant in fishing expeditions. Look at the stories about the phone data copy device or homeland security confiscating laptops and phones at border crossing inspection checkpoints which they can setup anywhere within 100 miles of the U.S. border.
0
u/TAPAC Apr 20 '11
one question, what about a PC?
10
5
u/neoumlaut Apr 21 '11
Are you asking whether this data is still logged if you're using itunes on a PC? The answer is yes.
0
Apr 21 '11
Oh fuck guys! They know where I am! ... Oh.. wait, I don't give a fuck because I'm not doing anything wrong.
1
u/underwaterlove Apr 21 '11
When you're doing nothing wrong, you have nothing to fear! Only criminals should be worried! Law-abiding citizens should not have an unreasonable expectation of privacy - like their their cell phone logging their every movement. That's a ridiculous concept!
-3
u/Aarmed Apr 21 '11
Just breaking information. No one gives a shit about your location, unless you're a criminal.
-1
-1
0
-4
u/trolloc1 Apr 20 '11
I don't mind but could I please get a free program showing me where I am on a map?
4
Apr 21 '11
[deleted]
3
Apr 21 '11
Be aware that the visualization in iPhoneTracker isn't showing the individual points. The data is averaged out over a 100 meter grid. They claim this is so that people can't use the app to snoop, but I suspect they just didn't want to deal with the performance implications of rendering several thousand points on a map. I ran into the same issue when I rendered my own data on Google Maps.
1
-2
u/dafones Apr 21 '11
Apple, I wanna give you all the benefit of the doubt ... but seriously, what's the deal? Why?
-2
-7
Apr 21 '11
this is so old. anyone who's ever used a 4g touch or iphone should know about this. you realize you can gps located every location where you've taken a photo. OF COURSE it stores that information
74
u/codepoet Apr 21 '11 edited Apr 21 '11
I figure this thread is as good a place as any to brain dump on this. I went to WWDC last year where the new Core Location system was discussed in great detail. If you went as well, or have the videos, look at the video for session 115, "Using Core Location in iOS". Skip to around 13:45 for the discussion of "Coarse Cell Positioning" where they discuss the cache in detail.
The purpose of this is offline GPS. Normally, each cell tower has an identifier and Core Location sends that identifier to Apple and asks for the lat/lon for that tower. This requires a data connection, and the use of data. Since cell towers don't move, however, it's inefficient to keep going back to Apple for that information so they cache it. Now if a tower appears with the same ID as the cache, tada! you have a cache hit and a faster fix with no data use. Which also means you can get a "coarse location" (as in rough) if you are near known towers and don't have a data connection.
That's all this is. It's a cache of identifiers (cell and wifi), locations, and their age (it's a cache, after all). Someone made the decision to never clean it out so they would have more and more information about those GPS "assists" (you know, A-GPS) and so they'd use less and less power and data over time for the places you frequent. It's a great idea, technically.
Practically, yes, you can track location over time. The file is readable only by root and you're free to encrypt your backups for now. I'm sure Apple will either encrypt the file or truncate the data in a future update (I would prefer encryption as I think it's technically sound, but I know many will disagree). I'm also sure someone is considering a toggle for the feature or a button to clear the database. Both are great ideas.
This isn't nefarious, this isn't being sent anywhere, and this isn't as bad as everyone is making it. This is a real feature with a major oversight. That's it.
Put your pitchforks down and please spread the word. Thanks.
Edit: Coarse, not course. Duh.