Mar 12, 2018 5:07 PM

Stop Strava Spies

Your fitness apps may be giving more away than you thought. Here's how to lock them down.

Featured in this article

Strava—the “social network for athletes”—unwittingly exposed secret military and intelligence bases around the world. How? Operatives posted there forgot to opt out of sharing their Fitbit data. Then Strava made it public by releasing a global activity heat map.

See, popular apps like Strava, MapMyRun, Nike \+ RunClub, and Runkeeper all work the same way. They automatically share your stats with the universe—times, routes, locations, and all—unless you opt out.

So even if your cycling route doesn’t compromise national security, you might still be putting yourself at risk. Think about it: your routes probably begin and end somewhere like your home or office—locations you wouldn’t otherwise share with the internet.

Fortunately, shoring up your basic security measures is easy. It just takes a trip to Settings. Depending on your app, either your Privacy or Sharing menu will let you calibrate how much data you want to share with whom.

01
Strava—the “social network for athletes”—unwittingly exposed secret military and intelligence bases around the world. How? Operatives posted there forgot to opt out of sharing their Fitbit data. Then Strava made it public by releasing a global activity heat map.
02
See, popular apps like Strava, MapMyRun, Nike \+ RunClub, and Runkeeper all work the same way. They automatically share your stats with the universe—times, routes, locations, and all—unless you opt out.

03
So even if your cycling route doesn’t compromise national security, you might still be putting yourself at risk. Think about it: your routes probably begin and end somewhere like your home or office—locations you wouldn’t otherwise share with the internet.
04
Fortunately, shoring up your basic security measures is easy. It just takes a trip to Settings. Depending on your app, either your Privacy or Sharing menu will let you calibrate how much data you want to share with whom.

05
Strava’s Privacy Zone feature will even let you create a digital fogbank around your routes’ start and end points—making it significantly harder for creeps to follow you home from a jog.
06
Trouble is, most fitness apps, if they have privacy policies at all, still reserve the right to pass off your data to third parties as long as it’s properly anonymized or aggregated. Will that bullet-proof your privacy? Not exactly—Just ask those now-compromised military athletes.

Comments

Arielle Pardes, a former senior writer for WIRED, covers people and products in Silicon Valley. ... Read More

Think Exercise Is Hard? Try Training Like a Nike Super-Athlete

Our writer is using the same training regime, apparel, and expertise as three elite Nike athletes.

Ed Caesar

How You Could Road Race—and Win—From Your Living Room

Virtual exercise is more immersive, dynamic, and—mercifully—distracting than a traditional treadmill or stationary bike.

Robbie Gonzalez

This AI Reads Privacy Policies So You Don't Have To

Polisis, a machine-learning-trained tool, automatically produces readable charts of where your data ends up for any online service.

Andy Greenberg

Privacy Shield Will Let US Tech Giants Grab Europeans' Data

Companies can keep transferring data from the EU to their US servers under a new deal between the two governments that privacy advocates are decrying.

Klint Finley

Science Says Fitness Trackers Don't Work. Wear One Anyway

Activity monitors are getting more addictive—and more motivational.

Robbie Gonzalez

Split Tunneling Is Your VPN’s Best Feature. Here’s How to Make the Most of It

This feature common to VPN services gives you protection and privacy specifically when and where you need it.

David Nield

Shaq Got Hacked. Now He’s Pitching for a VPN

At a recent event for security firm NordVPN, NBA superstar Shaquille O’Neal revealed that he got hacked—and warned the public about the need to “have control of their own information.”

Lily Hay Newman

Bluesky Is Blocking Links to a Major Leak of DHS Employee Records

Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact information, shared without their authorization.

Dhruv Mehrotra

Encryption Is Getting Squeezed From All Sides

Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world.

Matt Burgess

A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse

The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.

Dan Goodin, Ars Technica

Muse Creates Detailed Profiles of All Your Friends and Family

Millions have downloaded Meta’s AI agent Muse. But getting it to do your bidding comes with privacy costs.

Lily Hay Newman

This App Brutally Shames You by Tracking How Many Hours You’ve Lost to Scrolling

The iOS app Oh My Hours takes a new approach to curbing screen time. It splits up your day into hour-long blocks, then shows which ones you wasted on Instagram and TikTok.

David Nield