SIMSme
This translation was generated automatically.
The German Post Office’s new messenger supposedly talks only to German servers and is TÜV-certified, therefore “secure”. Let’s see who the app actually talks to.
On first launch, it connects to server 194.42.93.243. Some GeoIP databases place that address in the UK or Switzerland; others say Berlin. Let’s assume the Post Office merely reused an IP address that used to be located abroad.
All right, moving on. On first launch, the app sends this information over the wire:
https://test.docwallet-de.de/aio/startup mac_md5=...&session_count=1&idfa=...&environment=production&created_at=2014-08-13T1...&App_token=...&mac_sha1=...&ios_uuid=...&tracking_enabled=0
It also sends the device model, iOS version, and system language:
User-Agent: release.de.dpag.simsme 141 iPhone iPhone6,2 ios 7.1.2 en DE
The app that supposedly doesn’t track you gets back a “tracker” token:
{"tracker_token":"...","tracker_name":"Organic","network":"Organic","country":"gb"}
The app appears to send the hashed MAC address and device ID, exactly what its own privacy policy says it shouldn’t do. An iOS 7 app shouldn’t be able to access the MAC or device ID, but something is being sent—at least the advertising identifier. The privacy policy mentions only usage-based data such as the number of logins and messages sent. It says nothing about device characteristics, only crash logs, which could also contain such information.
The app’s privacy policy supposedly lets you disable this behaviour, but the setting only appears partway through registration. I can’t verify whether disabling it actually prevents the device information from being sent.
During the rest of registration, tracking events are sent to the following endpoint after almost every tap:
https://test.docwallet-de.de/aio/event ios_uuid ... idfa ... event_count 1 session_count 1 environment production event_token ... time_spent 435 session_length 435 created_at 2014-08-13T16:... app_token ... tracking_enabled 0 subsession_count 1 mac_md5 ... mac_sha1 ...
The rest of registration uses simsme-prod.docwallet-de.de / 194.42.93.59. That’s also on the same UK/Berlin network, but at least the certificate is pinned, which makes eavesdropping a little harder.
In the next step, the phone number is verified by SMS and the address book is uploaded (supposedly only in hashed form).
If you refuse, you can’t continue. You can, however, environmentally dispose of the app by holding its icon and then tapping the ×.