Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Battery power alone can be used to track Android phones

bbc.co.uk

Post reply on HN
Print view View original

51–60 of 78 posts

Re: Battery power alone can be used to track Android phones

#51

Post by feld »

tomkinstinch wrote: post #14
egeozcan wrote: post #4

So what makes this specific to Android phones? Developers can't (get permission to) access this information on other platforms?

It's available on iOS: https://developer.apple.com/library/ios/documentation/UIKit/...

No it's not. That does not expose voltage and current.

The research paper says they're doing this ...

  ... by repeatedly reading the following two files:
  /sys/class/power_supply/battery/voltage_now
  /sys/class/power_supply/battery/current_now

Re: Battery power alone can be used to track Android phones

#52

Post by Sidnicious »

dagar wrote: post #50
zipperhead wrote: post #19

Earlier quoted context omitted.

That's the problem with android. The 'typical user' has no control over individual app permission - it's literally all or none. If you install the app you give it access to the GPS, as long as it has specified that permission.

I honestly don't understand why this is a problem. Isn't it enough that the app says it requires my location when I install it? If you don't like the required permissions no one is forcing you to install it.

Popular apps can essentially request any permission and you'll still download it — are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions?

On iOS, the average user has a chance to download that mainstream app and deny it access to their contacts.

Re: Battery power alone can be used to track Android phones

#53

Post by wcdolphin »

This is a 'tour de force' study for sure, but has a very limited scope (and reliability)- First, it only works if the attacker knows both the route(s) ahead of time and the power consumption profile of the routes, which requires careful mapping of the region with a recording device. Second, its accuracy degrades drastically depending on the number of apps running -- they only tested with background apps, which already rendered the method only slightly better than a random guess, with an arbitrary app running in the foreground the power consumption goes bananas and so does their method.

Storm in a glass of water, if you ask me.. (But you wouldn't know this by reading that abstract alone ;))

-@r2r

Re: Battery power alone can be used to track Android phones

#54

Post by robotresearcher »

Sidnicious wrote: post #52
dagar wrote: post #50

Earlier quoted context omitted.

I honestly don't understand why this is a problem. Isn't it enough that the app says it requires my location when I install it? If you don't like the required permissions no one is forcing you to install it.

Popular apps can essentially request any permission and you'll still download it — are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions? On iOS, the average user has a chance to download that mainstream app and deny it access to their contacts.

> are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions?

That sounds like you meant it as a rhetorical question, but "yes" is a reasonable answer.

Re: Battery power alone can be used to track Android phones

#55

Post by TazeTSchnitzel »

Sidnicious wrote: post #49
romaniv wrote: post #46

Earlier quoted context omitted.

I am ver surprised there is still no mass outrage over Android permissions. 1. They are not properly named or explained. And no, this shouldn't be on some obscure website. This should be right there, in the menu that asks for them. 2. There is no way to filter apps in the play store by permissions. This isn't just a privacy thing. Apps that require the least permissions are often least bloated and the most skillfully…

Also, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)

This was briefly added in Android 4.something, but Google removed it.

Re: Battery power alone can be used to track Android phones

#56

Post by digi_owl »

JoachimS wrote: post #18
PJDK wrote: post #8

This is really selling a quite interesting intellectual effort on meaningless paranoia. Who would have any interest in tracking people in this manner? Any government based group can grab the data much more conveniently via the phone towers. Anyone else? Well you've got to trick someone into downloading this thing, so it's probably not that good for targeting a specific individual. If you can think up some nefarious s…

Not sure if the "Who would have any interest in tracking people in this manner?" is really relevant. Based on the collect all, hoover all metadata etc that seems to be going on, _anything_ remotely possibly useful seems to be interesting. And the big thing is that this data can of course (and will be) correlated with things like cell tower location, wifi hotspots all kinds of other metadata.

Makes one wonder what STASI could come up with had it still been operating...

Re: Battery power alone can be used to track Android phones

#57

Post by digi_owl »

TazeTSchnitzel wrote: post #55
Sidnicious wrote: post #49

Earlier quoted context omitted.

Also, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)

This was briefly added in Android 4.something, but Google removed it.

Appops. Supposedly there as a test system for apps. I guess to see if they would crash in case of malformed data from sensors etc.

Some OEMs, like Huawei, offer similar functionality on their products.

Re: Battery power alone can be used to track Android phones

#58

Post by digi_owl »

dagar wrote: post #50
zipperhead wrote: post #19

Earlier quoted context omitted.

That's the problem with android. The 'typical user' has no control over individual app permission - it's literally all or none. If you install the app you give it access to the GPS, as long as it has specified that permission.

I honestly don't understand why this is a problem. Isn't it enough that the app says it requires my location when I install it? If you don't like the required permissions no one is forcing you to install it.

Google badly obfuscated permissions in a recent Play store update.

Where before it listed each permission, and required a manual approval of any was added in a app update, it now only list categories.

And it will only require manual approval if a new category is added.

And the categories are wide enough that someone can add an innocuous permission initially, and then push a update some time later that gives them virtually free reign of the user data.

Re: Battery power alone can be used to track Android phones

#59

Post by hahainternet »

robotresearcher wrote: post #54
Sidnicious wrote: post #52

Earlier quoted context omitted.

Popular apps can essentially request any permission and you'll still download it — are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions? On iOS, the average user has a chance to download that mainstream app and deny it access to their contacts.

> are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions? That sounds like you meant it as a rhetorical question, but "yes" is a reasonable answer.

I've no idea why you have been downvoted. I also do not have apps on my phone which ask for permissions I do not like.

Re: Battery power alone can be used to track Android phones

#60

Post by digi_owl »

Sidnicious wrote: post #49
romaniv wrote: post #46

Earlier quoted context omitted.

I am ver surprised there is still no mass outrage over Android permissions. 1. They are not properly named or explained. And no, this shouldn't be on some obscure website. This should be right there, in the menu that asks for them. 2. There is no way to filter apps in the play store by permissions. This isn't just a privacy thing. Apps that require the least permissions are often least bloated and the most skillfully…

Also, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)

The basic problem is likely that google is in the data gathering business. This to provide ever more targeted ads. Thus they can't have someone block all data going in or out of the device.
Post reply on HN