Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How apps track your location without asking for permission

blog.trustlook.com

Post reply on HN
Print view View original

11–20 of 35 posts

Re: How apps track your location without asking for permission

#11

Post by haywardsmyfault »

Someone1234 wrote: post #9
eyesee wrote: post #6

Earlier quoted context omitted.

On iOS you can only access the information of the SSID you are connected to, not a list of nearby networks.

Android has a lot of information leaks. I hate to keep beating this dead horse, but as of last year Google gives every app you install access to your cellphone number without them needing to ask for an extra permission (READ_PHONE_STATE is now a freebie as far as the app store is concerned, it isn't listed, in fact it will say "no special permissions" if READ_PHONE_STATE alone is in the manifest). I honestly think An…

Actually as of the Android M preview you can get the user email address without any permission guarding.

This is because GET_ACCOUNTS is under PROTECTION_NORMAL, and so it is automatically granted at install time.

Re: How apps track your location without asking for permission

#12

Post by tarentel »

magicalist wrote: post #10

> Note that these metrics are accessible even with system wifi and location disabled Can someone explain this? It doesn't seem to make sense that with wifi disabled this would be possible (and the code they link to specifically has a fall through if wifi is disabled). Maybe something just got jumbled up in their explanation.

According to the paper:

"the Android OS by default performs WiFi scans in the intervals of tens of seconds, even when the WiFi is turned off; the setting to disable background scanning when WiFi is off is buried in the advanced settings."

It looks like you can stop this from happening when the WiFi is off it just requires an extra step. I don't have an Android device so I can't really verify this.

Re: How apps track your location without asking for permission

#13

Post by halviti »

yincrash wrote: post #3

Basically doing what the coarse location provider does anyways, which is corollate visible APs on the device with a db of mapped APs. Yes, it's possible, but constantly scanning for APs will have the side effect of an app draining battery even faster than if it used the phone's location service.

During the Android setup process it asks you if you want to enable this feature and has a side note that these scans are specifically to save battery life because they take much less energy than typical location services.

Re: How apps track your location without asking for permission

#14

Post by halviti »

tarentel wrote: post #12
magicalist wrote: post #10

> Note that these metrics are accessible even with system wifi and location disabled Can someone explain this? It doesn't seem to make sense that with wifi disabled this would be possible (and the code they link to specifically has a fall through if wifi is disabled). Maybe something just got jumbled up in their explanation.

According to the paper: "the Android OS by default performs WiFi scans in the intervals of tens of seconds, even when the WiFi is turned off; the setting to disable background scanning when WiFi is off is buried in the advanced settings." It looks like you can stop this from happening when the WiFi is off it just requires an extra step. I don't have an Android device so I can't really verify this.

When you set up android for the first time it gives you some text explaining what this is and how it works, and asks you whether you want to enable/disable it.

I'm not sure if this was ever a "default", but it is definitely part of the setup prompts now.

Re: How apps track your location without asking for permission

#15

Post by yincrash »

halviti wrote: post #13
yincrash wrote: post #3

Basically doing what the coarse location provider does anyways, which is corollate visible APs on the device with a db of mapped APs. Yes, it's possible, but constantly scanning for APs will have the side effect of an app draining battery even faster than if it used the phone's location service.

During the Android setup process it asks you if you want to enable this feature and has a side note that these scans are specifically to save battery life because they take much less energy than typical location services.

Yes, wifi scan location takes less power than GPS location. Rolling your own wifi location service in an app will take more power than the framework's service, however, and it will almost certainly be less optimized.

Re: How apps track your location without asking for permission

#16

Post by Someone1234 »

haywardsmyfault wrote: post #11
Someone1234 wrote: post #9

Earlier quoted context omitted.

Android has a lot of information leaks. I hate to keep beating this dead horse, but as of last year Google gives every app you install access to your cellphone number without them needing to ask for an extra permission (READ_PHONE_STATE is now a freebie as far as the app store is concerned, it isn't listed, in fact it will say "no special permissions" if READ_PHONE_STATE alone is in the manifest). I honestly think An…

Actually as of the Android M preview you can get the user email address without any permission guarding. This is because GET_ACCOUNTS is under PROTECTION_NORMAL, and so it is automatically granted at install time.

Ouch, that's certainly a step on the wrong direction. I guess they get points for consistency, but they're being consistently bad.

Re: How apps track your location without asking for permission

#17

Post by [deleted] »

tarentel wrote: post #12
magicalist wrote: post #10

> Note that these metrics are accessible even with system wifi and location disabled Can someone explain this? It doesn't seem to make sense that with wifi disabled this would be possible (and the code they link to specifically has a fall through if wifi is disabled). Maybe something just got jumbled up in their explanation.

According to the paper: "the Android OS by default performs WiFi scans in the intervals of tens of seconds, even when the WiFi is turned off; the setting to disable background scanning when WiFi is off is buried in the advanced settings." It looks like you can stop this from happening when the WiFi is off it just requires an extra step. I don't have an Android device so I can't really verify this.

[deleted]

Re: How apps track your location without asking for permission

#18

Post by izacus »

The original title of the article is "How apps track your location without asking for permission".

Reading the article to the end:

>> The same method also applies to iOS, which has greater user location data privacy protection. Nonetheless, iOS still allows acquiring the current connected wifi BSSID. A user can deny the location requests on an iOS device at will. However, an app using wifi BSSID can still get a user’s static location without asking.

So singling out Android in HN submission title is grossly misleading. Especially since reading this comments shows that people don't read the articles posted -_-

Re: How apps track your location without asking for permission

#20

Post by the-dude »

izacus wrote: post #18

The original title of the article is "How apps track your location without asking for permission". Reading the article to the end: >> The same method also applies to iOS, which has greater user location data privacy protection. Nonetheless, iOS still allows acquiring the current connected wifi BSSID. A user can deny the location requests on an iOS device at will. However, an app using wifi BSSID can still get a user’…

> So singling out Android in HN submission title is grossly > misleading. Especially since reading this comments shows > that people don't read the articles posted -_-

I have always considered HN the 'new Slashdot'

Post reply on HN