Uber Faces Negative Reactions After Update Introduces Background GPS Tracking

[riverfreak]

Uber et al

My data is MINE. If I agree to give it to you, in exchange for a value-added service while I use your product, fine.

But I will not give it to you once I cease using your product. Not now. Not ever. Horrendous. Goodbye.

 

[tangfish]

The Uber app was just updated to a new version and still maintains only the Always vs Never choices.

Everyone please go and give it a one star review.

 

[macTW]

You have been unable to explain how exactly Uber tracking customers after leaving the car has any security benefits. Uber is not the 911 emergency service, they have no business requesting people's location information in the name of "security". It's just a lame attempt to justify collecting potentially sensitive personal information.

Clearly you don't understand logic. I'm done here.

 

[ginkobiloba]

If anyone thinks people concerned about this ( or ANY other similar company or service that gathers data about you, from Google to whoever else ) are crybabies, here is why you should be concerned :


"UBER, the popular car-service app that allows you to hail a cab from your smartphone, shows your assigned car as a moving dot on a map as it makes its way toward you. It’s reassuring, especially as you wait on a rainy street corner.
Less reassuring, though, was the apparent threat from a senior vice president of Uber to spend “a million dollars” looking into the personal lives of journalists who wrote critically about Uber. The problem wasn’t just that a representative of a powerful corporation was contemplating opposition research on reporters; the problem was that Uber already had sensitive data on journalists who used it for rides."

http://www.nytimes.com/2014/12/08/opinion/we-cant-trust-uber.html?_r=0

 

[righteye]

If they don't make it to destination, there's evidence something happened... And if driver knows they have to get to destination, the driver could drop them off, circle around block, and come back... Again, a great feature for evidence for court, but should be opt-in, not mandatory.

Better to just recall the cab without being tracked, this tracking "service" is not for the customers benefit or safety IMO and is just to gain information for targeted advertising and anything else they want to glean from the next five minutes of your life, as an option its fine otherwise i see it as an infringement.

 

[kstotlani]

See but all I hear when I read a post like this is, "I demand to be able to use your service, but you're not getting anything from me in return."

It just reeks of uninformed crybaby nonsense.

You use Uber for free? It's not like using google photos or Facebook which are free so they want something in return. We all pay for the rides.
[doublepost=1481109793][/doublepost]

As an Uber user, I COMPLETELY agree with this. I can always shut off location to the Uber app or my phone as a whole, if I am 'uber'-paranoid, but I think 5 minutes is a reasonable duration for them to 'know' I got to my location safely.

How do you know it's only 5 minutes? Can you see this data or the implementation?
[doublepost=1481109873][/doublepost]

The Uber app was just updated to a new version and still maintains only the Always vs Never choices.

Everyone please go and give it a one star review.

And I did.
[doublepost=1481110345][/doublepost]

Because its not up to you. You are the user, and quite frankly, you don't have a clue what is best for the App or the service. User's like you will ignore all of the factual detail and will just fauxrage over some talking point, about which you know absolutely nothing.

You are right out of the Matrix. "It's your life but you don't know how to live it. We will tell you how".

 

[TwoBytes]

Waze does this and is a battery hog. App developers should give people the option... it will be hard to user uber or waze if your phone battery is dead!!

 

[makr]

As an Uber user, I COMPLETELY agree with this. I can always shut off location to the Uber app or my phone as a whole, if I am 'uber'-paranoid, but I think 5 minutes is a reasonable duration for them to 'know' I got to my location safely.

How can they know you were kidnapped juts by tracking your location?
Imagine this, you got off the uber and walked a bit then someone shows you a gun and ask them to walk in front of them, how can uber possibly know something going on?

 

[mquinn]

Did you like being able to see where your passenger was waiting? Because I chose to disable location services for uber when iOS gave me the warning during update.

Sure. And if I can't find you, then I'm just going to cancel the pick up.
[doublepost=1481303055][/doublepost]

If you can come up with a scenario that's remotely plausible, I would eat my hat.

My uber driver ended the trip in his app, and then he drove me over to his house and tried to rape me!

Done. Before, once the ride was over, which the driver has full control over, Uber was done tracking if you didn't have the app open. Which no rider has the app open after they are in the car. Then I can stop the ride as the driver, go offline in my app and do whatever I want.

Now Uber knows if you got to the destination or not. Since most people closed the app once they are in the car, the only way they could tell was the driver app connected to that trip. Which could easily be manually ended.

 

[ubereverywhere]

Nope, not a work-around in this case.

Wrong. I take it everyone paranoid about this setting simply doesn't understand the difference and are not developers. I've seen numerous articles claim it tracks you while the app is not open, which simply isn't true. Go read the CLLocationManager API Reference:
https://developer.apple.com/reference/corelocation/cllocationmanager
https://developer.apple.com/referen...manager/1620562-requestwheninuseauthorization
https://developer.apple.com/referen...ionmanager/1620551-requestalwaysauthorization

The app has to be running either in the foreground or the background for it to do anything. Period. Apps don't magically keep running as hidden processes when you close them, at least not 3rd party, Apple approved apps.

The purpose of "Always Authorization" is so that the app can still receive updates from the location manager whether it's running in the foreground OR background. If the app is not running, it's not doing jack. Just close the app if you don't want it to use GPS while it's running in the background.

As a developer, when you make an "In Use Authorization", the app can only receive GPS data while it's actively running in the foreground unless you also enable background mode, so when you switch to another app and still have the previous app running in the background, it's no longer tracking, where as "Always Authorization" can keep tracking as long as the app is still running. Yes, "Always Authorization" can be abused by developers, but this seems to be a big misunderstanding by the media and paranoid people. Apparently many are just not smart enough to close their apps when they are done with them (Double press home button and swipe up on the app). Blame Apple for introducing multitasking in iOS 4. Prior to that, this setting never even existed because you could only have a single 3rd party app open at a time. Apps also closed automatically when going into the background.

Those paranoid about this setting should not use cell phones or the Internet. As a manufacturer, Apple has more control over your device and privacy and can do things with their private APIs like turn your mic and camera on or track your location without you ever knowing.

For those who think Uber can magically track you while the app isn't open or running in the background, setup a proxy server like Charles or run a packet capture on whatever router or network you're connected to. You're not going to see any requests going to Uber's servers when the app is not running (foreground or background). You may however be surprised to see various requests to Apple's servers.

 

[mquinn]

What ubereverywhere said times a million.

 

[69Mustang]

My uber driver ended the trip in his app, and then he drove me over to his house and tried to rape me!

Done. Before, once the ride was over, which the driver has full control over, Uber was done tracking if you didn't have the app open. Which no rider has the app open after they are in the car. Then I can stop the ride as the driver, go offline in my app and do whatever I want.

Now Uber knows if you got to the destination or not. Since most people closed the app once they are in the car, the only way they could tell was the driver app connected to that trip. Which could easily be manually ended.

Holy crap this is dumb as hell. Not you, your scenario. Gotta ask, did you even try to think this through? Fear mongering is not the way to justify additional tracking. Even if it was, your scenario is... holy crap dumb as hell.

So much wrong, where to begin. Let's see, did the driver nicely ask you for your phone so you couldn't, I don't know, dial 911 when you realized you weren't actually headed to your destination? Did they hit you with some knockout gas, chloroform you from the driver's seat, put on their gas mask and spray you with mace to incapacitate you...

Okay, forget that part. Let's get past the made for TV movie drama and look at the facts regarding the additional 5 minutes of tracking.
1. It's location data tracking. GPS. Not video. Uber would have no idea what transpired in the 5 minutes of additional tracking. They would have location data, that's it.
2. A customer is no more or less safe if Uber knows their location 5 minutes after the ride ends. It's not like Uber can prevent something from happening by simply knowing the location. Not unless Uber has Pre-Cogs on staff.
3. The 5 additional minutes of tracking only gives Uber an indication of the general area where the passenger is located when the tracking stops not where they're going to be if they need another Uber.

Now Uber knows if you got to the destination or not. Since most people closed the app once they are in the car, the only way they could tell was the driver app connected to that trip. Which could easily be manually ended.

Hasn't Uber always known if you got to your destination or not? I'd imagine if people weren't reaching their destinations Uber would be out of business. 5 minutes of added tracking has nothing to do with getting to your destination. It's a continuation after you're already there. If someone takes an Uber and closes the app when they get in the car, the tracking would be for an additional 5 minutes. What if your trip takes 10, 15, or 20 minutes? Are we back at the fear mongering stage now? OMG, they don't know where I am

Face it man, the premise of addition tracking increasing safety is inherently flawed. Even in your rape scenario, the passenger wouldn't be safer because of the additional tracking. It's just dumb.

 

[mquinn]

How do you know it's only 5 minutes? Can you see this data or the implementation?
[doublepost=1481109873][/doublepost]

Yes, you can. It's called a packet capture. You can see exactly what server is requesting and being sent data. Take the tin hat off. Apple wouldn't let an app in if it was abusing their rules.
[doublepost=1481312193][/doublepost]

Holy crap this is dumb as hell. Not you, your scenario. Gotta ask, did you even try to think this through? Fear mongering is not the way to justify additional tracking. Even if it was, your scenario is... holy crap dumb as hell.

So much wrong, where to begin. Let's see, did the driver nicely ask you for your phone so you couldn't, I don't know, dial 911 when you realized you weren't actually headed to your destination? Did they hit you with some knockout gas, chloroform you from the driver's seat, put on their gas mask and spray you with mace to incapacitate you...

Okay, forget that part. Let's get past the made for TV movie drama and look at the facts regarding the additional 5 minutes of tracking.
1. It's location data tracking. GPS. Not video. Uber would have no idea what transpired in the 5 minutes of additional tracking. They would have location data, that's it.
2. A customer is no more or less safe if Uber knows their location 5 minutes after the ride ends. It's not like Uber can prevent something from happening by simply knowing the location. Not unless Uber has Pre-Cogs on staff.
3. The 5 additional minutes of tracking only gives Uber an indication of the general area where the passenger is located when the tracking stops not where they're going to be if they need another Uber.


Hasn't Uber always known if you got to your destination or not? I'd imagine if people weren't reaching their destinations Uber would be out of business. 5 minutes of added tracking has nothing to do with getting to your destination. It's a continuation after you're already there. If someone takes an Uber and closes the app when they get in the car, the tracking would be for an additional 5 minutes. What if your trip takes 10, 15, or 20 minutes? Are we back at the fear mongering stage now? OMG, they don't know where I am

Face it man, the premise of addition tracking increasing safety is inherently flawed. Even in your rape scenario, the passenger wouldn't be safer because of the additional tracking. It's just dumb.

Of course they are! So if someone false accuses them of something happening, they can CYA. And as I driver, that means I'M protected just a little bit more.

And your last point is valid, under the old way they do this. But now, it runs ALL the time, even when the app is not in the foreground. So people close the app and it keeps track of where you are. Not like it was before. They exited the app and put it in the background it stopped tracking. Now it doesn't. Good, I can't get accused of anything.

Uber as a company has lot of problems. How drivers are treated, some of their morals are questionable at best. But this is not one of them.

 

[69Mustang]

Of course they are! So if someone false accuses them of something happening, they can CYA. And as I driver, that means I'M protected just a little bit more.

And your last point is valid, under the old way they do this. But now, it runs ALL the time, even when the app is not in the foreground. So people close the app and it keeps track of where you are. Not like it was before. They exited the app and put it in the background it stopped tracking. Now it doesn't. Good, I can't get accused of anything.

Uber as a company has lot of problems. How drivers are treated, some of their morals are questionable at best. But this is not one of them.

Quinn, what are you not seeing? I can accuse you of trying to steal my wallet, smoking weed while driving, abusive language, dangerous driving, or any number of things. It would literally be my word against yours. An additional 5 minutes of tracking after the ride is over will protect you from none of that. You keep presenting these unrealistic doom and gloom scenarios as if they are a de facto part of the Uber experience that can be mitigated by 5 minutes of additional tracking. They can not. Plus the vast majority of Uber rides conclude with nary a problem, rendering the tracking superfluous at best, and invasive at it's worst. 5 minutes of additional tracking does nothing to protect you or the customer.

Besides, getting around the tracking is childishly easy. I could turn off Uber tracking altogether and manually put my location in the app. If Uber sees enough people doing this, they're simply going to reverse the decision.

 

[Rigby]

Yes, you can. It's called a packet capture. You can see exactly what server is requesting and being sent data.

Actually you can't. At least I hope so, because it would mean that Uber is sending location information unencrypted over the Internet, which would be an even worse privacy breach and also violate Apple's developer guidelines starting at the end of the year.
[doublepost=1481317722][/doublepost]

Wrong. I take it everyone paranoid about this setting simply doesn't understand the difference and are not developers. I've seen numerous articles claim it tracks you while the app is not open, which simply isn't true. Go read the CLLocationManager API Reference:
https://developer.apple.com/reference/corelocation/cllocationmanager
https://developer.apple.com/referen...manager/1620562-requestwheninuseauthorization
https://developer.apple.com/referen...ionmanager/1620551-requestalwaysauthorization

The app has to be running either in the foreground or the background for it to do anything. Period. Apps don't magically keep running as hidden processes when you close them, at least not 3rd party, Apple approved apps.

Your own source says that apps that have been closed by the user can be relaunched in the background, for example by events that notify the app when the location has been changed significantly:

"The significant location change service delivers events normally while an app is running in the foreground or background. For a terminated iOS app, this service relaunches the app to deliver events. Use of this service requires “Always” authorization from the user."

If you are a developer, you know that there are many ways to wake up an app in the background.

 

[ubereverywhere]

Actually you can't. At least I hope so, because it would mean that Uber is sending location information unencrypted over the Internet, which would be an even worse privacy breach and also violate Apple's developer guidelines starting at the end of the year.

A packet capture has nothing to do with whether they are using SSL or not. You'd still see the encrypted requests.

Your own source says that apps that have been closed by the user can be relaunched in the background, for example by events that notify the app when the location has been changed significantly

Maybe not clear in my post. I'm just saying an app can not transmit any data over the Internet if it's not running. It's simply impossible. Instead of all the fear mongering by the EFF and others, they should just inform people on how to properly close an app and disable/enable location services.

Having your app launch from a significant change in location, which can only be done with "Always Authorization," is a function that iOS core location services is performing, not the app. What do you think is monitoring location when the app is terminated? It's certainly not the app, it's iOS, and iOS wakes up or launches the app when it detects a change. The app is just registering with those services. If people have a problem with developers using the API functionality Apple provides, they should really be up in arms with Apple, not Uber. After all, it wouldn't be possible if Apple did not allow it in the first place.

The whole thing that makes me laugh is that regardless of whether they use "Always" or "In Use" authorization, they can still get the same exact data. To do it with "In Use Authorization" would only require background services enabled for location and background app refresh. This is actually what Apple recommends for background monitoring. By default "In Use" doesn't function that way and when you do enable background services, it's a bit more transparent to the user with a blue bar at the top stating the app is using location services. Despite the name, I don't use Uber. For all anyone knows, they were already doing this with "In Use" authorization and background services. If not, they could just change it to make paranoid people happy, while still getting the same data.

 

[Rigby]

A packet capture has nothing to do with whether they are using SSL or not. You'd still see the encrypted requests.

The previous poster claimed that you could "see exactly what server is requesting and being sent data". You can't.

And if the app is written to silently collect location information in the background and only upload it to Uber's servers whenever the app connects to them anyway, you'd have no way to tell if location information is being sent.

Maybe not clear in my post. I'm just saying an app can not transmit any data over the Internet if it's not running. It's simply impossible.

You are wrong. Apps can absolutely send data while running in the background. There are various ways to wake up apps using certain events. iOS then allows them to briefly run in the background, and they can do pretty much what they want including transmitting or receiving data. That's how, for example, apps with push notifications work.

Instead of all the fear mongering by the EFF and others, they should just inform people on how to properly close an app and disable/enable location services.

If you are claiming that closing an app prevents it from collecting location information in the background, that would be misinformation. Turning off location services is of course possible, but who wants to do this every time they get out of the car? The "While Using" option exists for a reason, and Uber should respect that many people don't wish to be tracked when they are not using Uber's services.

Having your app launch from a significant change in location, which can only be done with "Always Authorization," is a function that iOS core location services is performing, not the app. What do you think is monitoring location when the app is terminated? It's certainly not the app, it's iOS, and iOS wakes up or launches the app when it detects a change

I don't know if you really don't understand this or are deliberately trying to misinform people? Assuming the location option is set to "Always", the app - once relaunched in the background by the system service - can simply request the location information using a system call, record it, and go back to sleep. This would not be possible if the option "While using" was set.

The whole thing that makes me laugh is that regardless of whether they use "Always" or "In Use" authorization, they can still get the same exact data.

This is false.

Given your user name, I assume you are working for Uber?

 

[cmaier]

How can they know you were kidnapped juts by tracking your location?
Imagine this, you got off the uber and walked a bit then someone shows you a gun and ask them to walk in front of them, how can uber possibly know something going on?

Plus it's not like Uber is taking responsibility for me being safe for the next 5 minutes. Good luck suing them if you are mugged or hit by a truck or kidnapped or whatever in that time period. They want the data but won't guarantee anything in return.
[doublepost=1481327992][/doublepost]

I'm just saying an app can not transmit any data over the Internet if it's not running. It's simply impossible.

That's absolutely false. iOS apps that aren't running can be silently launched in the background in response to notifications that the app has subscribed to (like "my location has changed").

 

[C DM]

If you are claiming that closing an app prevents it from collecting location information in the background, that would be misinformation. Turning off location services is of course possible, but who wants to do this every time they get out of the car? The "While Using" option exists for a reason, and Uber should respect that many people don't wish to be tracked when they are not using Uber's services.

If an app is actually closed (vs suspended) then it wouldn't be able to run in the background. Even for background refresh to work it seems that the app has to be at least in suspended state and not closed. Has that changed in some way where apps can just randomly run even if they haven't been opened or have been explicitly closed (and, just for the sake of it, let's say background refresh is off as well)?

 

[cmaier]

If an app is actually closed (vs suspended) then it wouldn't be able to run in the background. Even for background refresh to work it seems that the app has to be at least in suspended state and not closed. Has that changed in some way where apps can just randomly run even if they haven't been opened or have been explicitly closed (and, just for the sake of it, let's say background refresh is off as well)?

If an app is force-quit then it won't receive background notifications.

 

[C DM]

If an app is force-quit then it won't receive background notifications.

Right, so in that case, if an app is actually closed, then it wouldn't be tracking or sending/receiving anything (I mean there might be push notifications coming in for it via APNS, but those would just be handled by iOS itself), right?

 

[cmaier]

Right, so in that case, if an app is actually closed, then it wouldn't be tracking or sending/receiving anything (I mean there might be push notifications coming in for it via APNS, but those would just be handled by iOS itself), right?

If by "closed' you mean quit by swiping it off the task list, then correct.

 

[C DM]

If by "closed' you mean quit by swiping it off the task list, then correct.

Correct, that's what I mean, either swiped off the recent app list, or basically never launched since the last time the device was restarted (for example).

 

[cmaier]

Correct, that's what I mean, either swiped off the recent app list, or basically never launched since the last time the device was restarted (for example).

correct.

hence i force-quite Facebook (background battery hog) and Uber (privacy invader) when not in use.

 

[ubereverywhere]

The previous poster claimed that you could "see exactly what server is requesting and being sent data". You can't.

Have you ever ran Wireshark or any pcap tool? You can 100% see the IPs making the requests. Only the data is encrypted.

You are wrong. Apps can absolutely send data while running in the background. There are various ways to wake up apps using certain events. iOS then allows them to briefly run in the background, and they can do pretty much what they want including transmitting or receiving data. That's how, for example, apps with push notifications work.
If you are claiming that closing an app prevents it from collecting location information in the background, that would be misinformation. Turning off location services is of course possible, but who wants to do this every time they get out of the car? The "While Using" option exists for a reason, and Uber should respect that many people don't wish to be tracked when they are not using Uber's services.

You said I'm wrong that they can't send data if the app's not running and back it up by saying they can while running in the background? lol. It's either running or not. Please show me any AppStore app that can transmit data and phone home while it's not running on the device. Push notifications have nothing to do with what I am saying and push notifications are also not generated by an app installed on your device. If you registered an app for APN services, you'd typically create your own provider service on a server that generates the notifications and handles all the tokens. The app isn't doing it. You also need to have a valid cert through Apple as they are pushed through their servers. Even if you wanted to create a push notification with an event to launch an app the app is not silently running in the background doing whatever it wants waiting for push notifications. It's not running at all. iOS handles it and knows what app to open or deliver them to based on the response and permissions.

Again, show me any AppStore app that can collect location information while it's not running. When you terminate an app, even if you are using "Always Allow" authorization and monitoring for significant location changes, if there is a significant change in location, guess what....if permission is granted, iOS will launch the app in the background and it's then running. You can't be tracked by Uber if you're not using their services. It's entirely impossible unless Apple allows them to use private APIs.

I don't know if you really don't understand this or are deliberately trying to misinform people? Assuming the location option is set to "Always", the app - once relaunched in the background by the system service - can simply request the location information using a system call, record it, and go back to sleep. This would not be possible if the option "While using" was set.

Not sure how it's misinformation. My entire point was that with "Always" authorization iOS launches the app and that the app is not silently running in the background collecting data or waiting for these events like some seem to assume. It can only get data while it's running, and unless you grant permission, the app can't launch or doing anything from location based events.

This is false.

Based on what they said they were using it for it's not. In fact, there's really no reason for them to even use "Always" authorization if what they are saying they are doing is true because they can get the same exact data with "In Use" auth until the user terminates the app.

Given your user name, I assume you are working for Uber?

Nope, just a meme.