X Might Be Leaking Data From Your iPhone

It’s no secret X, previously known as Twitter, is a shell of its former self. Spam is running rampant, verification badges mean nothing, and privacy and security have taken a turn for the worse.

While no large company is likely to have perfect policies to safeguard your privacy, it’s a notable issue for the micro-blogging site in the post-Elon Musk. The more privacy and security-focused employees X sheds, the more those features will begin to crumble. We saw it with Circles, when the legacy privacy feature that ensured specific tweets could only be seen by a trusted group of followers inadvertently started letting strangers peruse your private thoughts. Not good. And now a new problem has cropped up.

X is quietly leaking your identity

The security researcher duo known collectively as Mysk recently uncovered another X security failing, this time concerning crash reports. That might not sound as bad as private tweets that aren’t so private anymore, but it is concerning any time an app leaks data it isn’t supposed to.

As Mysk point out, the iOS version of the X app offers users the option to opt-out of sending crash reports. When you disable that option, you’d naturally expect the app to stay quiet whenever it experiences a crash. But it doesn’t: The app ignores your preference, and instead quietly shares your crash report without your knowledge or consent.

You can see this in action in Myks’s video demo: They run the iOS version of the app on a Mac, showing the “Send crash reports” options turned off. When they restart the app, they demonstrate that the app actually sends a crash report to Crashlytics (a Google product).

The kicker? According to the privacy App Privacy breakdown, crash reports are personally linked to you, not collected in aggregate. That means whenever your app crashes—or whenever you restart the app, according to Mysk’s test—a report tied to your identity is sent to Crashlytics. (Side note: It’s worth giving the App Privacy breakdown for X a read when you can—it’s a long list of data that is either linked to you, or used to track you.)

While any data leak is bad, this one feels doubly galling, as it happens even when you’ve explicitly told the app you don’t want it sharing crash report data. (Someone get the EU on this as soon as possible.)

How to keep X from leaking your data

For now, the only workaround for this problem is to delete the X app off your iPhone, which is honestly probably good advice we all should have followed a long time ago.

[TechRadar]