Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How apps track your location without asking for permission

blog.trustlook.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: How apps track your location without asking for permission

#21

Post by j_baker »

izacus wrote: post #18

The original title of the article is "How apps track your location without asking for permission". Reading the article to the end: >> The same method also applies to iOS, which has greater user location data privacy protection. Nonetheless, iOS still allows acquiring the current connected wifi BSSID. A user can deny the location requests on an iOS device at will. However, an app using wifi BSSID can still get a user’…

You know, every time I personally write a blog post, I've learned to just assume that people will only read the title. If I'm lucky they may also see a subtitle or read the first paragraph. But unless you just write some compelling content, almost nobody will read it all the way through. You can't blame people. We're so inundated with information these days, we have to skim through things.

Re: How apps track your location without asking for permission

#22

Post by r00fus »

izacus wrote: post #18

The original title of the article is "How apps track your location without asking for permission". Reading the article to the end: >> The same method also applies to iOS, which has greater user location data privacy protection. Nonetheless, iOS still allows acquiring the current connected wifi BSSID. A user can deny the location requests on an iOS device at will. However, an app using wifi BSSID can still get a user’…

I disable wifi everywhere but my home network. Even work (mainly because of reasonable traffic shaping on work wifi that doesn't align with my needs).

On iOS only the connected wifi will expose the BSSID.

Turn off promiscuous mode on iOS, don't join random networks, and you can't be tracked this way.

Re: How apps track your location without asking for permission

#23

Post by on_and_off »

haywardsmyfault wrote: post #11
Someone1234 wrote: post #9

Earlier quoted context omitted.

Android has a lot of information leaks. I hate to keep beating this dead horse, but as of last year Google gives every app you install access to your cellphone number without them needing to ask for an extra permission (READ_PHONE_STATE is now a freebie as far as the app store is concerned, it isn't listed, in fact it will say "no special permissions" if READ_PHONE_STATE alone is in the manifest). I honestly think An…

Actually as of the Android M preview you can get the user email address without any permission guarding. This is because GET_ACCOUNTS is under PROTECTION_NORMAL, and so it is automatically granted at install time.

I am not sure how it should be handled. Allowing an app to automatically propose the user's email in a login form is pretty good in terms of UX ... but it means that the app can access to that data.

Re: How apps track your location without asking for permission

#24

Post by sctb »

izacus wrote: post #18

The original title of the article is "How apps track your location without asking for permission". Reading the article to the end: >> The same method also applies to iOS, which has greater user location data privacy protection. Nonetheless, iOS still allows acquiring the current connected wifi BSSID. A user can deny the location requests on an iOS device at will. However, an app using wifi BSSID can still get a user’…

Thanks, we updated the title to the article's.

Re: How apps track your location without asking for permission

#25

Post by mst »

Someone1234 wrote: post #16
haywardsmyfault wrote: post #11

Earlier quoted context omitted.

Actually as of the Android M preview you can get the user email address without any permission guarding. This is because GET_ACCOUNTS is under PROTECTION_NORMAL, and so it is automatically granted at install time.

Ouch, that's certainly a step on the wrong direction. I guess they get points for consistency, but they're being consistently bad.

If they've found that users almost always say yes to it, that might be the correct choice for being consistently usable even if you (and I) dislike that choice.

Re: How apps track your location without asking for permission

#26

Post by JadeNB »

mst wrote: post #25
Someone1234 wrote: post #16

Earlier quoted context omitted.

Ouch, that's certainly a step on the wrong direction. I guess they get points for consistency, but they're being consistently bad.

If they've found that users almost always say yes to it, that might be the correct choice for being consistently usable even if you (and I) dislike that choice.

Enabled-by-default is a defensible choice (even if we don't like it), but it sounds like this is un-disableable, which I think is not defensible.

Re: How apps track your location without asking for permission

#27

Post by JadeNB »

on_and_off wrote: post #23
haywardsmyfault wrote: post #11

Earlier quoted context omitted.

Actually as of the Android M preview you can get the user email address without any permission guarding. This is because GET_ACCOUNTS is under PROTECTION_NORMAL, and so it is automatically granted at install time.

I am not sure how it should be handled. Allowing an app to automatically propose the user's email in a login form is pretty good in terms of UX ... but it means that the app can access to that data.

It seems pretty clear how this should be handled, no? If the app wants to do it, then, as with anything else that might make the user experience better at a privacy cost, let it ask for permission to do it!

Re: How apps track your location without asking for permission

#28

Post by click170 »

tarentel wrote: post #12
magicalist wrote: post #10

> Note that these metrics are accessible even with system wifi and location disabled Can someone explain this? It doesn't seem to make sense that with wifi disabled this would be possible (and the code they link to specifically has a fall through if wifi is disabled). Maybe something just got jumbled up in their explanation.

According to the paper: "the Android OS by default performs WiFi scans in the intervals of tens of seconds, even when the WiFi is turned off; the setting to disable background scanning when WiFi is off is buried in the advanced settings." It looks like you can stop this from happening when the WiFi is off it just requires an extra step. I don't have an Android device so I can't really verify this.

The option you are looking for is called "Keep Wi-Fi on during sleep" and it can be found under Settings -> Wifi -> Advanced on Android 4.3. This is the only device I can test with.

I advise turning it off unless you need it to be on, not only for privacy reasons but for battery life. I noticed an increase in battery life by turning that feature off.

Re: How apps track your location without asking for permission

#29

Post by harmarsupercar »

click170 wrote: post #28
tarentel wrote: post #12

Earlier quoted context omitted.

According to the paper: "the Android OS by default performs WiFi scans in the intervals of tens of seconds, even when the WiFi is turned off; the setting to disable background scanning when WiFi is off is buried in the advanced settings." It looks like you can stop this from happening when the WiFi is off it just requires an extra step. I don't have an Android device so I can't really verify this.

The option you are looking for is called "Keep Wi-Fi on during sleep" and it can be found under Settings -> Wifi -> Advanced on Android 4.3. This is the only device I can test with. I advise turning it off unless you need it to be on, not only for privacy reasons but for battery life. I noticed an increase in battery life by turning that feature off.

On a Samsung Galaxy S5 running Lollipop (5.01?) it's under Wifi -> Advanced -> Always Allow Scanning.

With this turned off and GPS turned on (ie, not using Wifi to determine locations) I get a terrible reduction in battery life because all locations are done finely with the GPS chip. With all location services disabled I get much better battery life.

Re: How apps track your location without asking for permission

#30

Post by userbinator »

Someone1234 wrote: post #9
eyesee wrote: post #6

Earlier quoted context omitted.

On iOS you can only access the information of the SSID you are connected to, not a list of nearby networks.

Android has a lot of information leaks. I hate to keep beating this dead horse, but as of last year Google gives every app you install access to your cellphone number without them needing to ask for an extra permission (READ_PHONE_STATE is now a freebie as far as the app store is concerned, it isn't listed, in fact it will say "no special permissions" if READ_PHONE_STATE alone is in the manifest). I honestly think An…

I believe these are certainly the result of deliberate decisions.

Remember when Google introduced fine-grained permission control, received much praise for it, then removed it almost immediately afterwards? To me, that showed they clearly valued the interests of themselves and their monetising "appvertiser" developers over the freedom of the users.

https://www.eff.org/deeplinks/2013/11/awesome-privacy-featur...

https://www.eff.org/deeplinks/2013/12/google-removes-vital-p...

Post reply on HN