Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How much is Google collecting and keeping on Android if not signed in?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 58 posts

Re: Ask HN: How much is Google collecting and keeping on Android if not signed in?

#31

Post by bnr »

0xdeadb00f wrote: post #28
passerby1 wrote: post #26

Earlier quoted context omitted.

> stay as far away from MicroG as possible, it seriouly cripples the security of GrapheneOS by a lot. Do you mind sharing some details on this? I did not hear strong statements like this one before.

IIRC It requires allowing apps to mimic other app's signatures and pretend to be them, "signature spoofing". MicroG mimics the Google play services signature. But that is really crippling, because apps can now spoof other apps signatures, essentially apps can pretend to be other apps. That opens a lot of opportunities for an attacker.

With the set of patches used eg in lineageos4microg, spoofing is restricted to the microG core app.

Re: Ask HN: How much is Google collecting and keeping on Android if not signed in?

#32

Post by emptyparadise »

Thorrez wrote: post #9
partymonious wrote: post #6

I don’t if it’s still the case , but in stock ROM Androids it would track your location history even with location services turned off. https://www.wired.com/story/google-location-tracking-turn-of...

That article is about turning "location history" off, not turning "location services" off. Full disclosure I work at Google but nothing related to that.

It shouldn't take a Google employee to tell all those location options apart.

Re: Ask HN: How much is Google collecting and keeping on Android if not signed in?

#34

Post by account-5 »

lucgommans wrote: post #7

If you install TrackerControl, no root needed (it pretends to be a VPN to capture your traffic, but is not a real VPN), you will see which apps try to talk to tracking services and thus also which ones talk to Google. It also as a 'traffic log' feature which, when turned on, shows live which app is talking to which tracker. Note that, especially if you turn on blocking services marked as essential in the setup, you w…

I installed this and when I turn it on it stops all internet access to any app needing to access the internet. For example my podcast app immediately stops working.

Re: Ask HN: How much is Google collecting and keeping on Android if not signed in?

#36

Post by 2Gkashmiri »

pdkl95 wrote: post #22
2Gkashmiri wrote: post #17

Earlier quoted context omitted.

Good but who are "you" to google? Unless you sign in, you are just number on which they have data but not tied to an account. Right?

You are only "just [a] number" for a very brief period. As soon as you generate enough data points[1] to establish a recognizable subset of your pattern-of-life , the not-signed-in account can (and probably will) be correlated with your other accounts, some of which probably have data that identifies the real "you". One of the most common mistakes people make when discussing the data collected by someone like Google…

how far does pi-hole and similar tech help in this regard? i am genuinely curious about their role in reduction in data collection or at least preventing its exfiltration

Re: Ask HN: How much is Google collecting and keeping on Android if not signed in?

#37

Post by 2Gkashmiri »

theshrike79 wrote: post #29
pdkl95 wrote: post #22

Earlier quoted context omitted.

You are only "just [a] number" for a very brief period. As soon as you generate enough data points[1] to establish a recognizable subset of your pattern-of-life , the not-signed-in account can (and probably will) be correlated with your other accounts, some of which probably have data that identifies the real "you". One of the most common mistakes people make when discussing the data collected by someone like Google…

Someone with more writing and artistic skills really should make a comic strip or something about this. One we could share with less technical people. Even technical people really don't seem to understand how far data aggregation can go. Multiple small information points are collated into profiles, you need to be Jason Bourne -levels of vigilant to not create a trackable fingerprint online.

yes. exactly. i guess xkcd must have already done something on this given the depth of knowledge that guy has on the internet. if nothing, if anyone knows that guy, he can do it in 3 panels i'm sure.

Re: Ask HN: How much is Google collecting and keeping on Android if not signed in?

#38

Post by pdkl95 »

theshrike79 wrote: post #29
pdkl95 wrote: post #22

Earlier quoted context omitted.

You are only "just [a] number" for a very brief period. As soon as you generate enough data points[1] to establish a recognizable subset of your pattern-of-life , the not-signed-in account can (and probably will) be correlated with your other accounts, some of which probably have data that identifies the real "you". One of the most common mistakes people make when discussing the data collected by someone like Google…

Someone with more writing and artistic skills really should make a comic strip or something about this. One we could share with less technical people. Even technical people really don't seem to understand how far data aggregation can go. Multiple small information points are collated into profiles, you need to be Jason Bourne -levels of vigilant to not create a trackable fingerprint online.

An informative comic would be great. I have unsuccessfully tried to create a video game mechanic (ludonarrative) that demonstrates how data aggregation can be exploited. Giving people a little bit of personal experience on the other side trying to [ab]use data could be a very effective teaching tool. I suspect most people (including, as you mentioned, most technical people!) have never really thought about how personal data might be used as a weapon.

The amazing game "Papers, Please" demonstrated that a game based around an educational ludonarrative is not only possible, but can also be be relatively popular. Unfortunately, just like drawing, video game design is difficult.

> you need to be Jason Bourne -levels of vigilant to not create a trackable fingerprint online.

As Zoz said, "Don't Fuck It Up!"[1]. Any type of OPSEC has become extremely difficult. Even technically knowledgeable people that risk consequences of failure far worse than being tracked by Google screw up their OPSEC.

[1] https://www.youtube.com/watch?v=J1q4Ir2J8P8

Re: Ask HN: How much is Google collecting and keeping on Android if not signed in?

#39

Post by 0xdeadb00f »

bnr wrote: post #31
0xdeadb00f wrote: post #28

Earlier quoted context omitted.

IIRC It requires allowing apps to mimic other app's signatures and pretend to be them, "signature spoofing". MicroG mimics the Google play services signature. But that is really crippling, because apps can now spoof other apps signatures, essentially apps can pretend to be other apps. That opens a lot of opportunities for an attacker.

With the set of patches used eg in lineageos4microg, spoofing is restricted to the microG core app.

You're still taking a risk. its a risk that I won't take but you're welcome to for the sake of convenience.

Re: Ask HN: How much is Google collecting and keeping on Android if not signed in?

#40

Post by shapefrog »

emptyparadise wrote: post #32
Thorrez wrote: post #9

Earlier quoted context omitted.

That article is about turning "location history" off, not turning "location services" off. Full disclosure I work at Google but nothing related to that.

It shouldn't take a Google employee to tell all those location options apart.

Apparently journalists at wired can't tell the difference.
Post reply on HN