Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A study of data collection by Android devices

lwn.net

Post reply on HN
Print view View original

11–20 of 26 posts

Re: A study of data collection by Android devices

#11

Post by srg0 »

LWN is a nice site, but to save you a couple of clicks, this is the original post by Trinity College Dublin:

https://www.tcd.ie/news_events/articles/study-reveals-scale-...

And this is the paper it talks about (PDF):

https://www.scss.tcd.ie/Doug.Leith/Android_privacy_report.pd...

"Key findings from the study:

- With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset. This is potentially sensitive information since it can reveal user interests, e.g., a mental health app, a Muslim prayer app, a gay dating app, a Republican news app. There is no opt out from this data collection.

- The Xiaomi handset sends details of all the app screens viewed by a user to Xiaomi, including when and how long each app is used. This reveals, for example, the timing and duration of phone calls. The effect is akin to the use of cookies to track people’s activity as they move between web pages. This data appears to be sent outside Europe to Singapore.

- On the Huawei handset the Swiftkey keyboard sends details of app usage over time to Microsoft. This reveals, for example, when a user is writing a text, using the search bar, searching for contacts.

- Samsung, Xiaomi, Realme and Google collect long-lived device identifiers, e.g., the hardware serial number, alongside user-resettable advertising identifiers. This means that when a user resets an advertising identifier the new identifier value can be trivially re-linked back to the same device, potentially undermining the use of user-resettable advertising identifiers.

- Third-party system apps, e.g., from Google, Microsoft, LinkedIn and Facebook, are pre-installed on most of the handsets and silently collect data, with no opt out.

- There may exist a data ecosystem where data collected from a handset by different companies is shared/linked. Notably, the privacy focused e/OS variant of Android was observed to transmit essentially no data."

Re: A study of data collection by Android devices

#12

Post by retSava »

zibzab wrote: post #4

My thoughts on this. TLDR version: some are probably innocent but some are worse than presented here. > Key findings from the study: > > With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset. This is potentially sensitive information since it can reveal user interests, e.g., a mental health app, a Muslim prayer app, a gay dating app, a Republican n…

> but this is the norm these days

Norm as in normal, but I'd not say norm as in what most people expect and would accept if they knew.

And norms change, let's not accept a "normal" as the de facto "this is how it should be" but instead work towards a better norm.

That's the hard part, the easy part of how to do this is left as an exercise for the reader.

Re: A study of data collection by Android devices

#13

Post by gpas »

illwrks wrote: post #6
zibzab wrote: post #4

My thoughts on this. TLDR version: some are probably innocent but some are worse than presented here. > Key findings from the study: > > With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset. This is potentially sensitive information since it can reveal user interests, e.g., a mental health app, a Muslim prayer app, a gay dating app, a Republican n…

Wow. As a Xiaomi phone user, and having not read the article yet, does it mention if that level of tracking happens on Global Rom (Android One) versions of their phones?

I loved my phone until I looked at nextdns logs and noticed it's reaching out to Xiaomi owned servers roughly every 30 minutes. It's definitely tracking something. Now nextdns has a dedicated Xiaomi block list so I should be ok, but who knows?

My bad for not checking the lineageos compatibility list before buying an unsupported device.

Global MIUI 12.5.3 on a note 8 pro.

Re: A study of data collection by Android devices

#14

Post by tmsbrg »

I was curious about the LineageOS, so I checked and found:

"On all of the other handsets the Google Play Services and Google Play store system apps send a considerable volume of data to Google, the content of which is unclear, not publicly documented and Google confirm there is no opt out from this data collection. LineageOS collects no data beyond this data collected by Google and so is perhaps the next most private choice after /e/OS."

So the problem is Play Services and the Play store. Note that /e/OS uses MicroG[0] to replace Play Services so you can still use the many Android apps that require it. It's a really cool project and I think it's amazing how someone is like "Damn, I need a Google account for this app? I'll just write my own account manager to replace Google's!". Really that's the spirit of open source, and I hope more people become empowered to be able to solve problems that way in the future.

I think you can also use MicroG rather than OpenGapps on LineageOS, though I haven't tried and haven't read anything about it. Does anyone have some info about this setup?

[0] https://edevelopers-blog.medium.com/microg-what-you-need-to-...

Re: A study of data collection by Android devices

#15

Post by jqpabc123 »

zibzab wrote: post #7
jccalhoun wrote: post #5

So what is this data for? Because the ads I get are still nearly completely irrelevant. Last week youtube showed me ads in Spanish which I have zero knowledge of and ads for a company in an entirely different state. If they can't use all this data to know that I don't understand Spanish or what state I live in then what good is all this data?

It could very much be that this data is not used for advertising and is mostly just really horribly implemented dev analytics. Having read the report, I can't find any smoking guns about _uses_ of the data. But we really don't know at this point.

But we really don't know at this point.

We do know ... or a least we should.

Google has said it receives tens of thousands of "geofence" and "keyword" warrants each year looking to identify anyone within a certain geographic area at a particular time or anyone who searched for a particular keyword.

There are 3 pertinent points here:

1) Google can absolutely identify you personally; otherwise, the warrants would be useless.

2) The authorities are searching info from your phone without probable cause (aka "fishing").

3) Innocent people have been convicted for being in the wrong place at the wrong time.

https://techcrunch.com/2021/08/19/google-geofence-warrants/

Re: A study of data collection by Android devices

#16

Post by jqpabc123 »

tmsbrg wrote: post #14

I was curious about the LineageOS, so I checked and found: "On all of the other handsets the Google Play Services and Google Play store system apps send a considerable volume of data to Google, the content of which is unclear, not publicly documented and Google confirm there is no opt out from this data collection. LineageOS collects no data beyond this data collected by Google and so is perhaps the next most private…

Does anyone have some info about this setup?

Yes, you can use MicroG with LineageOS. If this totally solved the privacy issue, e/OS would be pointless.

GApps is a big upper level privacy problem that microG can solve but this is not the only issue. By default, AOSP itself also sends personally identifying info to Google servers through low level system calls. The e/OS fork is needed in order to remove this.

Re: A study of data collection by Android devices

#17

Post by aaaxyz »

tmsbrg wrote: post #14

I was curious about the LineageOS, so I checked and found: "On all of the other handsets the Google Play Services and Google Play store system apps send a considerable volume of data to Google, the content of which is unclear, not publicly documented and Google confirm there is no opt out from this data collection. LineageOS collects no data beyond this data collected by Google and so is perhaps the next most private…

By default lineageOS comes with neither Google play services nor microg. The choice of what to install is left to the user.

MicroG is a bit more complicated to install since it requires package signature spoofing, which official lineage builds don't enable since it's seen as a security vulnerability.

Re: A study of data collection by Android devices

#18

Post by rashil2000 »

tmsbrg wrote: post #14

I was curious about the LineageOS, so I checked and found: "On all of the other handsets the Google Play Services and Google Play store system apps send a considerable volume of data to Google, the content of which is unclear, not publicly documented and Google confirm there is no opt out from this data collection. LineageOS collects no data beyond this data collected by Google and so is perhaps the next most private…

You can find all the required info here -

https://lineage.microg.org

Re: A study of data collection by Android devices

#19

Post by rhn_mk1 »

zibzab wrote: post #4

My thoughts on this. TLDR version: some are probably innocent but some are worse than presented here. > Key findings from the study: > > With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset. This is potentially sensitive information since it can reveal user interests, e.g., a mental health app, a Muslim prayer app, a gay dating app, a Republican n…

> This happens when looking for updates anyway

But it doesn't have to. My Debian system does not send a list of installed packages in order to get updates. It queries the list of available ones.

Re: A study of data collection by Android devices

#20

Post by black3r »

zibzab wrote: post #4

My thoughts on this. TLDR version: some are probably innocent but some are worse than presented here. > Key findings from the study: > > With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset. This is potentially sensitive information since it can reveal user interests, e.g., a mental health app, a Muslim prayer app, a gay dating app, a Republican n…

> This happens when looking for updates anyway

I would still expect to have opt out of "looking for updates". Especially since this study suggests that this data is not collected by Play Store (Google) only, but also by the device manufacturer (possibly by their own store app which nobody really uses)

Post reply on HN