Live data from Hacker News

Some Android apps are using ultrasonic beacons to track users

bleepingcomputer.com

21–30 of 93 posts

Re: Some Android apps are using ultrasonic beacons to track users

#21
post #3

Is it really ultrasound? Microphones on phones may be able to pick this but what speakers are able to play even 20 kHz? And these apps should always listen, that will drain battery quickly, so these apps will be listed in top power-consuming apps and user will notice it.

your first point coupled with diminishing free air range in bands above 40kHz makes this hack seem like a futile attempt to simply gather as much data as possible, as low or uncorrelated as it might be. Some phones might be more cappable than others, however, and air is dense enough for several meters of significant ultrasound transmission at low power. With e.g. Samsung TVs always listening, I wouldn't be surprised if they optimized the speakers and micros in that regards, while benign applications aren't out of the question either.

The second point however is an overly broad generalisation disregarding the technical inaptitude of the target group of such apps (wherein I might include myself).

Re: Some Android apps are using ultrasonic beacons to track users

#22
post #18
post #5

This is why apps that shouldn't need the mic or speaker but still require it should not be installed. Permissions on an app should be checked carefully by a user, and users should be educated in this!

That model is backwards. If there is one thing iOS got right, it's the permission prompt. Nobody reads those lists and it's hard to know what the intent is without context in the app. Having the app ask on first use makes much more sense. It's much less likely to get away with this. Even better, you can still use the app if you say no. It will just get dummy values back.

On the flip side, this means you have already installed and committed to having this app on your phone. Lots of people might just press "accept" at that point out of being lazy, instead of uninstalling it and going back to the app store to look for an alternative.

If you ask me, both should be in place. When I install an app a list of permissions (and a short text next to each from the developer explaining why they need this permission), along with manual prompting once the app is installed and the thing in question (like the mic) is to be used.

Re: Some Android apps are using ultrasonic beacons to track users

#23
post #3

Is it really ultrasound? Microphones on phones may be able to pick this but what speakers are able to play even 20 kHz? And these apps should always listen, that will drain battery quickly, so these apps will be listed in top power-consuming apps and user will notice it.

The article gives the example of speakers in physical stores, so I imagine they would be special ones that could transmit ultrasound. Additionally, the article states that phones are mainly just the receivers.

Re: Some Android apps are using ultrasonic beacons to track users

#24
post #18
post #5

This is why apps that shouldn't need the mic or speaker but still require it should not be installed. Permissions on an app should be checked carefully by a user, and users should be educated in this!

That model is backwards. If there is one thing iOS got right, it's the permission prompt. Nobody reads those lists and it's hard to know what the intent is without context in the app. Having the app ask on first use makes much more sense. It's much less likely to get away with this. Even better, you can still use the app if you say no. It will just get dummy values back.

I think Android 7 does now ask on first use rather than at time of installation.

Re: Some Android apps are using ultrasonic beacons to track users

#25
post #18
post #5

This is why apps that shouldn't need the mic or speaker but still require it should not be installed. Permissions on an app should be checked carefully by a user, and users should be educated in this!

That model is backwards. If there is one thing iOS got right, it's the permission prompt. Nobody reads those lists and it's hard to know what the intent is without context in the app. Having the app ask on first use makes much more sense. It's much less likely to get away with this. Even better, you can still use the app if you say no. It will just get dummy values back.

This works the same since Android 6 (2015)

Re: Some Android apps are using ultrasonic beacons to track users

#26
post #15

Is there a physical way to deactivate the microphone (on my tablet, I never use it)?

The destructive way: open up the unit and destroy the mic, either by prying it loose from the pcb, or just smashing it if it's too integrated. On my Fairphone I think it was a small metal box with a little hole on top.

Re: Some Android apps are using ultrasonic beacons to track users

#27
Reading the title, I thought "ultrasonic" was some evil site that paid for people to use their beacon...

Reading the article, it's actually worse!

This sort if things should be taught in school, don't give an apps permission to your mic, GPS, camera, contacts, etc... Unless you understand why. Not everybody will write "hello world" in JavaScript in their life, but most people will installed apps on a device.

Re: Some Android apps are using ultrasonic beacons to track users

#30

> Their results revealed Shopkick ultrasonic beacons at 4 of 35 stores in two European cities. The situation isn't that worrisome, as users have to open an app with the Shopkick SDK for the beacon to be picked up. Wouldn't it be far easier to just transmit a wifi SSID that encodes this information?

I suspect they wanted to isolate it so that people walking past a store wouldn't be counted.
Post reply on HN