Apple notably failed in a few key ways which should serve as a lesson to others:

1. Always disclose what you’re doing. – Never just assume what you’re doing with someone’s information is cool. Apple could have mitigated a lot of this had they disclosed what the phone was actually doing from day 1. Never transmit anonymous or personal information without letting the user know first.
2. Never store more than you need – I can’t believe how many companies mess this up. Storing user information is a liability. A good business limits it’s liabilities to only what’s necessary to conduct business. Storing so much data, and not expunging was a very bad move and amplified the situation. On top of not letting users know what was going on, there was no way to purge information. This just made things much worse. Apple went as far as backing up what should be an expendable cache.
3. Always be paranoid with information – Apple states “The local cache is protected with iOS security features, but it is not encrypted. Beginning with the next major release of iOS, the operating system will encrypt any local cache of the hotspot and cell tower location information.” in the response to Edward J. Markey. This should have been encrypted since day 1. Various tools existed for a few years that could read this data in the surveillance community. Apple undoubtedly knew people were using this data sometimes for illicit purposes. No company has gotten in trouble for being to secure with customer information with anyone other than the NSA or FBI.

It’s worth noting that their software update in response to this controversy is actually pretty good and pretty thorough. I’m surprised they couldn’t quickly shim some encryption around it. The iOS is loaded with enough DRM and crypto.

On another note, I fully expect some court cases to be reopened now that “cell phone records” are not quite as accurate as they were falsely billed to be. Also companies who marketed software are capable of showing a users location history may be liable as this wasn’t accurately vetted. If they did good testing they would have seen the extent of it’s “tracking”. It seems inevitable.

Lastly, I wonder how much battery life, and how much bandwidth this was utilizing. Some customers are on metered WiFi (especially some hotspots). To geo-tag one must turn on GPS, meaning battery life was being drained behind the scenes.

Apple’s full response can be found on Congressman Ed Markey’s website (copied here for perpetuity).

It’s worth noting that Facebook restricts check-ins to friends only. This is different from almost anything they have done in the past where they opted for more public views. Clearly they knew location was pushing the envelope and choose a more restricted view.

One of the more peculiar features, the ability for friends to “tag your location”. This essentially lets your friends check you in. From the FAQ:

The first time you use Places, or the first time a friend tries to tag you in to a Place with him or her, you will receive a notification asking you to share your location and allow friends to check you in to Places.

At any time, you can also adjust this setting by navigating to the main Privacy Settings page and clicking the “Customize settings” link at the bottom of the page. Then, simply choose the Enabled in the dropdown box next to “Friends can check me into Places.”

There are two things at play here. The first is the default of “friends”, the second is the ability for a friend to tag you. Lets start with the default of “friends”.

Default “Friends”

Because of this notice Facebook feels the product is opt-in and not opt-out. Defaulting this to “friends” and not forcing users to select a group or groups isn’t a great idea. This is especially true for minors. Thanks to Facebook being a popularity contest, things like serial friending are too common. Exposing this type of information to that many people in real-time is reckless. Decisions on who qualifies as a friend may have been made a few years ago when the risks were different and content being exposed was much less harmful. Letting a stranger see your obnoxious status update is different than letting them know where you are.

For those not familiar with sociology, Dunbar’s number is the theoretical cognitive limit to the amount people with whom one can maintain stable social relationships. It lies between 100 and 230, commonly set at 150. The *average* user has 130 friends according to Facebook’s statistics when this blog post was published. Keep in mind this is the average of all users including those who rarely and never use it and abandoned accounts. If I had to guesstimate the average for a High School or College student is likely in the low 200′s. I suspect I may actually be (intentionally) overly conservative. I don’t think anyone has real data broken down by age group (though if you do, pass it along).

We can reasonably deduce that the average teenager has more “friends” than friends. At least in some cases perhaps more than even acquaintances. Odds are they don’t even recall approving some.

Facebook should have instead made users select individual friends or groups that can view places rather than make it accessible to anyone who is a “friend”. At a minimum that should have applied to minors and those with inordinate number of friends for their demographic. Because of friending behaviors in the past the concept of a “friend” doesn’t secure this feature adequately. It may be the users fault, but “the customer is always right”.

Tagging Friends

Letting friends tag you is a whole other set of risks. I’ll quote The Consumerist since they were quite whimsical at giving examples:

This could lead to friends tagging you as being inside a peepshow, or an ex-girlfriend tagging you as being with another girl so your new girlfriend gets pissed off. The sitcom storyline possibilities are endless!

Obviously there are times most people don’t want others to know about what they are doing both innocent and nefarious. In extreme cases this could even become a safety issue. Of course crimes committed through Facebook already existed (exhibit A, exhibit B, exhibit C), this just makes it easier especially in the case of serial friending. No longer does someone need to solicit location information, it’s now being broadcasted.

It’s worth noting it’s possible to remove a place you were tagged:

If a friend has tagged you in a Place and you would like to remove your name, simply go to the Place story (you can find it on your profile, your friend’s profile, or the Place page) and select “Remove Tag.” You will no longer be connected to that Place through that story.

Remember that only your confirmed friends on Facebook are able to tag you in a Place if you have enabled them to do so in the “Customize settings” section of the main Privacy Settings page.

Of course that’s in retrospect.

People Here Now

Described by Facebook:

In the “People Here Now” section, you can see others who are checked in with you at that place. This section is visible for a limited amount of time and only to people who are checked in there. That way you can meet other people who might share your interests. If you prefer not to appear in this section, you can control whether you show up by unchecking the “Include me in ‘People Here Now’ after I check in” privacy control.

This has some obvious sore points. At a stadium or concert with hundreds or thousands of people it’s relatively anonymous with random faces and names. In a more intimate setting such as a restaurant or store it would relatively easy to match faces and full names. Given some basic info like a full name, network, current location a lot can be learned by using Google and public information databases. I suspect this has not so obvious implications for many who will not uncheck this preference.

Facebook should have used just first names to ensure some privacy.

Other Risks

There are other risks as well. Any serial use of such a feature will reveal patterns about your daily life such as when you leave and get home, visit the gym, etc. Timing attacks become easier when an attacker can plan without having to actually stake out a victim.

Then there’s the question of what will be done with all the data collected over time by millions of users. This isn’t 100% clear just yet. That’s a privacy issue, but not so much safety issue.

Bottom Line

Proceed with caution. Facebook did prepare for privacy implications better this time than any other release they have done in the past. This however is a whole new ballgame. Facebook could still improve by making some changes as I discussed above. Even with the defaults there are clear and present dangers. Unlike FourSquare or Gowalla where users subscribed with location sharing in mind, this was dropped on Facebook users who likely didn’t intend to share that much with that many people.

Firefox 3.5 is around the corner. For those who don’t pay attention to development here’s the big features worth checking out. There are lots more, but these are my favorites:

User Centric Features

Private Browsing – Officially it’s called “Private Browsing” but most know it as “porn mode”. Simply put once you turn on the feature nothing about your browsing is saved to your computer until you turn it off. No browser history, cookies, cache, no passwords, download list. Great for shared computers where you may not want the next person to know where you shopped, what you bought etc.

Faster JavaScript – Everyone is doing it. Firefox 3.5 now ships with TraceMonkey which uses a technique, called trace trees to add just-in-time native code compilation to SpiderMonkey, the JS engine in Firefox. Bottom line: faster JavaScript makes JavaScript powered sites like Gmail way faster.

Faster Awesomebar – The awesomebar is a fast way of browsing the web, but the UI can sometimes get a little sluggish. Some awesome work has been done to optimize it for better performance. Faster UI = better browsing experience.

Better Awesomebar – The Awesomebar got a few enhancements including autocomplete for tagging, which is extremely handy as well as editing tags on multiple bookmarks at the same time.

Undo Closed Window – We’ve all done it before. Now you can undo a closed window just like a closed tab.

Drag Tab To New Window – Previously you could drag/drop to reorder tabs. Now you can drag a tab off the tab bar to move it into its own window. This may sound trivial but it actually makes organizing tabs much easier.

Video/Audio – Firefox 3.5 supports the new HTML5 <video/> and <audio/> tags. Specifically it supports Vorbis in Ogg containers, as well as WAV with support for more formats expected in the future. I’ve discussed open video before and suggest learning more about how important this is there.

SSL Error Pages Suck Less – The error pages shown when there is an SSL error were pretty tough on users since they didn’t display anything helpful. The new error pages are a bit more helpful. The bug implementing the changes has tons of details on the changes.

Geolocation – Simply put a website can (if you allow it) gather information about your internet connection and using a location service (provided by Google by default) will calculate your location. No more needing to constantly type in your zip code, or city name to get local information. For privacy you need to explicitly allow it. Geolocation is in a word awesome.

New Icon – Well, it’s not really new. It’s “refreshed” I guess. It’s not a huge change, but it does look really sharp, especially in more modern operating systems that use larger icons like Mac OS X. Alex Faaborg has it on his blog in various sizes for you see.

Developer Centric Features

Web Workers – My personal favorite is web workers. Essentially its background processing in a separate thread for JavaScript. No more locking up the browser’s UI because you need to do some complicated JS calculations. I’ll leave it to the documentation linked above for examples. Very handy stuff.

@font-face – Designers have long been frustrated with the lack of font options on the web. They often resort to using images and flash as a way to expand their font options. With @font-face it’s now possible to use custom fonts and reference them via css. There is however the issue of licensing of fonts used on a webpage since the font file itself is accessible via a web browser.

Native JSON Enough said. Native JSON is fast. var obj = JSON.parse(someJS);

Cross Site xhr – xmlHttpRequest() has ushered in a new era of JavaScript. It’s not however without some serious limitations. One of the most obvious limitations is that you can’t use it across hostnames. Until now.

There’s more cool toys, but these are my favorite.

Still not convinced of all the new stuff? Check out this demo, then look at the source behind it. It’s pretty impressive.

• Add HostIP look up (disabled by default)
• Add support for newer Flock, and Firefox through 3.0 alpha

Go to the options window (open up the extension manager, right click on GeoLocateFox, and select options) and check the HostIP box. This will send the IP address of the website you visit to the HostIP.info website, and get coordinates if available. This is only used if the site provides no GeoLocation data on it’s own. It’s off by default for privacy reasons. It’s pretty cool.

Next up is a bug fix release for mozPod, no date on that just yet. It’s overdue.

• Update to use Yahoo Map API v. 3.0 (Yahoo now supports more non-North American Locations!!!).
• Add support for newer Flock.
• Slightly better compressed images.
• Updated some url’s to project page.

I should also note that Yahoo’s maps are a improved (a TON).

You can find the latest release here.

And in even bigger news…
I have a new beta release available (here) that contains support for Host IP lookup using the Hostip.info database. This will find tons more locations (and the database improves all the time).

To enable the Hostip feature, open the extensions manager (Tools Menu –> Extensions) and right click on GeoLocateFox and select “Options”. There is checkbox on the right side to enable this feature. It’s off by default because it requires sending the IP address of the website you visit to the Hostip.info server.

This is a beta, though I’d love to know how it works for people.

• Firefox 1.5.0.* Support
• Flock Support
• SeaMonkey Support
• Small fix to detection code
• Small ui fix

Get GeoLocateFox

What does GeoLocateFox do?

The extension makes use of geolocation meta tags provided by some webpages (such as this one). On such pages, the icon illuminates to alert you to such content. You can then put your mouse over the icon to get a map of where the website originates. Double Clicking on the icon will bring up a full size map.

Why aren’t there any non-US maps?

For the moment, this only works on coordinates in the United States, as Yahoo Maps has yet to implement other parts of the world (this is hopefully coming soon).

Why not use Google?

Currently this extension only supports Yahoo! Maps. The intent is to support multiple mapping providers including Google, but to date only Yahoo! has a terms of use that allow for non-webapplication use. Google explicity prohibits such use right now. They were contacted by me in mid December about this extension, but to date have not replied with permission to include their service. While it may in theory be ok
to do considering Firefox is a web browser, and we are not doing anything harmful or commercially, I don’t wish to get into any trouble, it’s their API, and I respect that. Perhaps someone from Google Local will contact me about this. I’d love to add in support for it (would be great for international use).

Where can I get it?

For now you can get it here. I need to setup a project page at mozdev at some point. This is a 0.1 release, so there are still bugs.