Apple Testifies on Mobile Privacy, Location Cache Encryption Coming to iOS

[aristotle]

So I thought that 4.3.3 meant that the consolidated.db file was going to be shrunk to hold just 7 days of data from here on out. Yet when I run the program to look at it, it still shows my entire year's worth of travel???

Huh? With 4.3.3 you should not be able to access the file as it is not backed up by iTunes so how are you accessing it? They are not going to truncate the existing file with the upgrade. You would have to turn off location services which would delete the file and then it will not grow beyond 7 days when you turn location services back on.

The update process does not touch your existing backups either.

 

[theelysium]

This is a gross waste of time. They have to explain themselves to people who don't understand technology, because the other people who don't understand technology got them up in arms over nothing. In this era the blind still lead the blind.

I think it's funny that this all got started from some nosy college students snooping around the OS. Lets get all worked up over what a couple of STUDENTS want to claim.

STUPID!

 

[DotCom2]

Apple uses user location to provide better experience.

Google uses user location as cash cow.

I think this might be true!

 

[organerito]

The honest answer: Why do you care? Do you intend letting anyone steal your iPod Touch? And if they steal it, what are the chances that anyone actually bothers checking what is in that cache? And if they actually bother checking, what are the chances that they could find anything that could be used against you?

There are many reasons why people would like to know something. One of them might be just curiosity.

 

[louis Fashion]

Buggs Bunny

Bug? I see no bug. AAPL designed the program, it worked, and now they are changing it. Big deal.

 

[gnasher729]

I don't understand this argument.

For one obvious example, if a battered woman's crazy ex-husband was able to find everywhere she's visited in the last year by stealing her iPhone, that's a problem. Extreme example, sure. But it's not always strangers that you have to worry about.

The places where she _might_ have been in the imagination of a crazy ex-husband are surely a much bigger risk. As is the contents of her address book, her e-mails, her browser history. So the risk is: Battered woman, crazy ex-husband locates her, steals her iPhone, doesn't mind what's in her address book, browser history, e-mails, but he actually knows about this cache file, has software to investigate her, and kills her because of some place she has been. Very likely. If she gets rid of her iPhone for another phone, it is more likely that he kills her because she must have something to hide. If she sells her iPhone and buys a gun with the proceeds, she is more likely to shoot herself by accident.

But I asked about the risk compared to things like lightning or snake byte. In the USA, an average of slightly more than hundred persons a year die from lightning. Isn't that something you should worry about a million times more?

Just out: Facebook caught exposing millions of user credentials: http://www.theregister.co.uk/2011/05/10/facebook_user_credentials_leaked/

That should keep the crazy ex-husbands busy for a while.

 

[Full of Win]

Why do you care? What are you afraid of? What is more likely, that you are struck by lightning, bitten by a poisonous snake, or that someone steals your iPhone, extracts this data, and manages to use it in a way that hurts you more than the first two risks?

I mean if someone gave me _exact_ locations where you have been for every second in the last year, how would I be able to use that against you?

Do I care if a company tracks my position, logs it, and retrieves this information from my iPhone and iPad, all with location services OFF ? Yeah, I care. While location logging is done by the telcos, this is disclosed and mandated by the FCC. Also, the information has a barrier of protection to its access and use. What Apple and Google are doing is WRONG. When I set Location Services to 'off' in iOS - then ALL location data collection, except for what is mandated by Federal Law or Code, STOPS. End of story.

 

[PsudoPowerPoint]

What's the big deal

Like the majority of people posting, I really don't have any need to conceal my whereabouts. But not everybody is that lucky. The US Justice department estimated that there were 25,000 cases of stalking last year where the stalkers used GPS to track their victim. The big deal is that there is a segment of the population that needs the government to help protect them and their privacy.

 

[BaldiMac]

The places where she _might_ have been in the imagination of a crazy ex-husband are surely a much bigger risk. As is the contents of her address book, her e-mails, her browser history. So the risk is: Battered woman, crazy ex-husband locates her, steals her iPhone, doesn't mind what's in her address book, browser history, e-mails, but he actually knows about this cache file, has software to investigate her, and kills her because of some place she has been. Very likely. If she gets rid of her iPhone for another phone, it is more likely that he kills her because she must have something to hide. If she sells her iPhone and buys a gun with the proceeds, she is more likely to shoot herself by accident.

But I asked about the risk compared to things like lightning or snake byte. In the USA, an average of slightly more than hundred persons a year die from lightning. Isn't that something you should worry about a million times more?

Wow. That's pretty obtuse. I was responding to your question:

"I mean if someone gave me _exact_ locations where you have been for every second in the last year, how would I be able to use that against you?"

I used an extreme example. I also used a simpler example of an employer finding out you've interviewed with another company. Obviously, where you've been can be used against you. If that information is supposed to be gone, and it's not, that's a problem.

And, by the way, in either example, stealing the iPhone is not required. You can get the same information from the backups on the PC.

 

[RalfTheDog]

I like how apple states it's a bug. BS. If you believe it's a bug, ihave some ocean front property in Iowa I can sell you, real cheap. The federal government should get a warrant and go into apple and see first hand exactly what apple is storing on users. Only way to make sure. But. Of course, they will just take their word on it. Similar to the tobacco company stating nicotine is not addicting. What a joke!

No warrant needed. The information is on your iPhone, not Apple servers. Just do an unencrypted backup, then use a hex editor to view the file.

Nobody goes, "hey, steal my ipod!" It's normally the case that the thief is sneaky and catches us when we get distracted by life. Not everyone can do a Mad-Eye Moody and practice "constant vigilance." Also, it's usually not the person who steals your ipod that's interested in looking at your location data.
In California, the police can search your phone without your permission. If they are determined to railroad you, they can use your location information against you. With the precedent of CA, you can bet other police departments will try to commit the same illegal intrusions on your privacy.
The government does warrantless searches under the PATRIOT ACT. It's not just the usual Al Qaeda terrorists either that they're searching. If you protest the government (whether you're on the right or the left), you're considered a terrorist.
It's bad enough the government is trying to invade our privacy. We don't need companies like Apple to help them out.

Just use a lock code on your phone. you may not have a reasonable expectation of privacy when your phone is open, If it is password protected, you do.

Do I care if a company tracks my position, logs it, and retrieves this information from my iPhone and iPad, all with location services OFF ? Yeah, I care. While location logging is done by the telcos, this is disclosed and mandated by the FCC. Also, the information has a barrier of protection to its access and use. What Apple and Google are doing is WRONG. When I set Location Services to 'off' in iOS - then ALL location data collection, except for what is mandated by Federal Law or Code, STOPS. End of story.

Retrieves the data? I was under the impression the data is only stored on your phone and never transmitted.

 

[chrono1081]

It was an interesting hearing. I am curious to see the outcome of it. It kinda sounds like the gov wants Apple to adopt the Google Installation window to notify users of what data the app will want access to.

Apple already does this. Any app that wants to use location services has to ask.

 

[ghostface147]

Huh? With 4.3.3 you should not be able to access the file as it is not backed up by iTunes so how are you accessing it? They are not going to truncate the existing file with the upgrade. You would have to turn off location services which would delete the file and then it will not grow beyond 7 days when you turn location services back on.

The update process does not touch your existing backups either.

Ah, thanks for the rational answer. I assumed that backups I've done since the 4.3.3 update would've done the job, especially since I only keep one backup on my machine and delete the rest. I'll turn off location services to see what it does. I also used that app the developers who found this issue released. I think it's called iPhone Tracker.

Why do you care? What are you afraid of? What is more likely, that you are struck by lightning, bitten by a poisonous snake, or that someone steals your iPhone, extracts this data, and manages to use it in a way that hurts you more than the first two risks?

I mean if someone gave me _exact_ locations where you have been for every second in the last year, how would I be able to use that against you?

Not a rational response.

 

[manu chao]

The 8 day thing doesn't really matter. Unless you teleport into a location, your iPhone will likely already have cached the local access points before you actually open an app that requests your location.

I would assume the same, the iPhone will keep downloading the location of the cellphone towers and WiFi networks it sees quietly in the background, the amount of data required for this is pretty small, the MAC address of a WiFi router is about 15 bytes, the location information it receives back maybe 20 bytes.
The only situation where you might notice a difference is when travelling with the iPhone switched off or in airplane mode but even then only when you need location data right after activating the phone again and the delay would really only be about updating the cache which should be very fast.

 

[ThisIsNotMe]

i wonder if the "bugs" they talk about are actual bugs or if apple just didn't think those were a big deal.

Well they weren't a big deal because the data didn't go anywhere.
I could find out just as much information from your phone without it than I can with it.

 

[shartypants]

Apple is doing the right things, I hope this puts pressure on Google

 

[42streetsdown]

I don't understand this argument.

For one obvious example, if a battered woman's crazy ex-husband was able to find everywhere she's visited in the last year by stealing her iPhone, that's a problem. Extreme example, sure. But it's not always strangers that you have to worry about.

How about a simpler example. I take the iPhone given to me by my current employer and synced to my work computer to a job interview. Nothing wrong with that. But I don't want my current employer to know where I've been, but IT would have direct access to the location cache backed up on my computer.

except the location cache still wouldn't tell them where you've been

 

[42streetsdown]

Well they weren't a big deal because the data didn't go anywhere.
I could find out just as much information from your phone without it than I can with it.

and since they aren't a big deal, apple shouldn't have to pander to the irrational fears of the misinformed public.

i hate how badly this whole thing was thrown by the media. it's crazy that people don't research and report FACTS even in the big newspapers.

 

[PaulSorensen]

Tribble

and no Star Trek jokes? MacRumors fans, I'm disappointed with you.

 

[PeterQVenkman]

Ronald Huang, Senior Engineering Manager, iOS Location and Motion at Apple, filed patent application 12/553,554 in March, "Location histories for location aware devices," which explains how Apple can amass and use location data in the very ways Apple critics fear. The patent application, for example, envisions a searchable map plotting the owner's location history; tying location to financial transactions; transmitting location data over the internet to remote servers; and many other uses.

I think Apple got caught building the backend for this, and played it off as a "software bug".

OTOH, who knows WTF google is doing with all their info.

To be honest, the Google guy had practically nothing to say.

As John Gruber put it:

Apple is represented by Bud Tribble, a vice president of software engineering. Google is represented by Alan Davidson, a lobbyist.

Thumbs down, google. Thumbs down.

 

[damage00]

3G owners: Please read....

Tribble's comments were not accurate... there are thousands and thousands of 3G owners on iOS 4.2.x for whom a fix was not offered. Can't upgrade, can't downgrade. If you are one of them, like me, contact Sen Al Franken here.

 

[Popeye206]

Yeah great. Silly worthless information is going to cause the government to start regulating apps. Oh fun. Or more like there goes our fun.

This is so stupid. I wish people weren't so paranoid about stupid things like this... Yeah... I know... Someone's going to chime in and tell me about their personal privacy... We'll guess what... The information captured by the phones is captured by the cell companies too. And guess what, if someone really wants to know where you're at, theyre not going to get very accurate info from your iPhone log.

All this is doing is going to take away functionality and innovation. Thanks to all the paranoid whiners.

 

[Full of Win]

Retrieves the data? I was under the impression the data is only stored on your phone and never transmitted.

According to the Wall Street Journel, Apple does collect this informtion from our iPhones and 3G iPads. This is a quote from a Wall Street Journal article. If Apple collects it, then yes it is transmitted. The link point to tis follows.

Apple, meanwhile, says it "intermittently" collects location data, including GPS coordinates, of many iPhone users and nearby Wi-Fi networks and transmits that data to itself every 12 hours

http://online.wsj.com/article/SB10001424052748703983704576277101723453610.html#ixzz1LzfD6s3V

Tribble's comments were not accurate... there are thousands and thousands of 3G owners on iOS 4.2.x for whom a fix was not offered. Can't upgrade, can't downgrade. If you are one of them, like me, contact Sen Al Franken here.

If he lied, or gave false testimony, I think you should also contact the Department of Justice as well.

 

[Sammio2]

I really hate how this has all been blown out of proportion... I mean, this discussion came up in uni today, and someone i consider to be highly intelligent was considering abandoning his iPhone because of this whole fiasco.

When I tried pointing out to them all that this bug had actually been noted and reported months ago, and has now been fixed (to a degree) in 4.3.3 they honestly believed that it was simply a cover up, and that Apple was lying to everyone. I mean, come on, do you really think Apple could get away with blatant lying? Furthermore, when i tried pointing out the ways in which my mates HTC Android device harvests the location, AND SENDS it to google, he outright denied that it was happening, ensuring me he has total control over everything sent over his phones cellular network connection...

So really, are there that many people out there, who honestly believe Apple was 'Tracking' our locations?, regardless of the fact that the database files were PROVEN not to leave the handset (except for backup purposes in iTunes.) Jesus, I've heard of paranoia, and whilst this bug had the potential to be a little worrying, it definitely is not the massive 'scaremongering' deal that the press (and subsequently the lemmings of the world) are making it out to be!

Besides, if it really was a problem, we'd know, because Apple would kindly inform us that we were merely travelling wrong...

 

[doctor-don]

Nobody goes, "hey, steal my ipod!" It's normally the case that the thief is sneaky and catches us when we get distracted by life. Not everyone can do a Mad-Eye Moody and practice "constant vigilance." Also, it's usually not the person who steals your ipod that's interested in looking at your location data.
In California, the police can search your phone without your permission. If they are determined to railroad you, they can use your location information against you. With the precedent of CA, you can bet other police departments will try to commit the same illegal intrusions on your privacy.
The government does warrantless searches under the PATRIOT ACT. It's not just the usual Al Qaeda terrorists either that they're searching. If you protest the government (whether you're on the right or the left), you're considered a terrorist.
It's bad enough the government is trying to invade our privacy. We don't need companies like Apple to help them out.

My phone is ALWAYS in MY possession when I am not in my own home.

Much ado about nothing.

 

[WiiDSmoker]

I really hate how this has all been blown out of proportion... I mean, this discussion came up in uni today, and someone i consider to be highly intelligent was considering abandoning his iPhone because of this whole fiasco.

When I tried pointing out to them all that this bug had actually been noted and reported months ago, and has now been fixed (to a degree) in 4.3.3 they honestly believed that it was simply a cover up, and that Apple was lying to everyone. I mean, come on, do you really think Apple could get away with blatant lying? Furthermore, when i tried pointing out the ways in which my mates HTC Android device harvests the location, AND SENDS it to google, he outright denied that it was happening, ensuring me he has total control over everything sent over his phones cellular network connection...

So really, are there that many people out there, who honestly believe Apple was 'Tracking' our locations?, regardless of the fact that the database files were PROVEN not to leave the handset (except for backup purposes in iTunes.) Jesus, I've heard of paranoia, and whilst this bug had the potential to be a little worrying, it definitely is not the massive 'scaremongering' deal that the press (and subsequently the lemmings of the world) are making it out to be!

Besides, if it really was a problem, we'd know, because Apple would kindly inform us that we were merely travelling wrong...

Maybe people truly aren't so nieve and don't believe that this is a "bug". Calling this a bug is completely ridiculous.