SoylentNews

Fnord666 [soylentnews.org] writes:

Our mobile phones can reveal a lot about ourselves [pewinternet.org]: where we live and work; who our family, friends and acquaintances are; how (and even what) we communicate with them; and our personal habits. With all the information stored on them, it isn't surprising that mobile device users take steps to protect their privacy, like using PINs or passcodes [doi.org] to unlock their phones.

The research that we and our colleagues are doing identifies and explores a significant threat that most people miss: More than 70 percent [haystack.mobi] of smartphone apps are reporting personal data to third-party tracking companies [arxiv.org] like Google Analytics, the Facebook Graph API or Crashlytics.

When people install a new Android or iOS app, it asks the user's permission before accessing personal information. Generally speaking, this is positive. And some of the information these apps are collecting are necessary for them to work properly: A map app wouldn't be nearly as useful if it couldn't use GPS data to get a location.

But once an app has permission to collect that information, it can share your data with anyone the app's developer wants to – letting third-party companies track where you are, how fast you're moving and what you're doing.

An app doesn't just collect data to use on the phone itself. Mapping apps, for example, send your location to a server run by the app's developer to calculate directions from where you are to a desired destination.

The app can send data elsewhere, too. As with websites, many mobile apps are written by combining various functions, precoded by other developers and companies, in what are called third-party libraries. These libraries help developers track user engagement [google.com], connect with social media [facebook.com] and earn money by displaying ads [google.com] and other features, without having to write them from scratch.

However, in addition to their valuable help, most libraries also collect sensitive data and send it to their online servers – or to another company altogether. Successful library authors may be able to develop detailed digital profiles of users. For example, a person might give one app permission to know their location, and another app access to their contacts. These are initially separate permissions, one to each app. But if both apps used the same third-party library and shared different pieces of information, the library's developer could link the pieces together.

Users would never know, because apps aren't required to tell users what software libraries they use. And only very few apps make public their policies on user privacy; if they do, it's usually in long legal documents a regular person won't read, much less understand [doi.org].

Source: The Conversation [theconversation.com]

Original Submission