A technical privacy investigation examines Aladin, a Czech weather app with more than a million Google Play installs. In version 1.13.0, the app bundles six data-collection SDKs and, after a user grants location access and accepts an unnamed “external partners” consent, can send data to at least two analytics companies: P3Crowd and CellRebel. The captured records include precise location, Wi-Fi network name and router address, nearby-network count, mobile carrier and cell-tower details, device information, and persistent installation identifiers. The app also sends UPnP discovery requests to scan the local network. Collectors run only when consent and location permission are present and the installation falls within remotely controlled rollout settings. Several other SDKs are bundled, though not observed transmitting data during testing.
The investigation combines per-app network monitoring, APK decompilation, and Frida hooks that capture request data before encryption. A proxy alone could not inspect P3Crowd’s traffic: the SDK encrypts its payload inside the app before ordinary TLS, so the researcher instrumented the app to log the JSON directly. Aladin’s consent screen names no partners and misleadingly suggests the sharing is legally required; the app’s Play listing says it shares no data with third parties. The findings therefore expose a gap between what users are told and what the app transmits, while documenting the limits of the test: it covers one app version and a fresh installation, and remotely configured or unobserved SDKs may behave differently.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.