I tried their proof of concept app on CyanogenMod. Its PrivacyGuard was not fooled at all; it described the app as asking for Location permission, and it blocked access to the list of wifi access points unless that permission was granted.
How apps track your location without asking for permission
31–35 of 35 posts
Re: How apps track your location without asking for permission
#32Very real issue to consider as we all try to guide Android's imminent permission system update (Make noise and open issues!) Is accessing nearby BSSIDs available in a similar fashion on iOS? A quick look reveals: https://developer.apple.com/library/ios/documentation/System...
On iOS you can only access the information of the SSID you are connected to, not a list of nearby networks.
Even the actual SSID name is probably more than an ordinary app needs to know.
Unless it needs some sort of location data to provide functionality, what is the minimum set of facts that would cover app behaviour?
I guess they might want to know:
- if the connection is secure and/or explicitly trusted
- if the connection is bandwidth-metered
- if the connection can route to the internet
Then, it can check those flags and decide if it wants to download those 3GB of your personal banking details or whatever.
Or, perhaps better still, it registers one or more 'acceptable network profiles' based on the above fields, and the OS gives it a callback when is becomes available/unavailable.
That would prevent it from polling and building a neighbourhood network map, but I suppose it could still register for all possible combinations, and beacon out to a remote host which can then geo-IP backtrack it to you-ish.
I'm definitely not happy with the carefully secreted privacy options scattered around the android UI. I'm still getting used to it, and every time I poke around in a settings menu I'll probably find at least one thing I would much prefer to default off.
Re: How apps track your location without asking for permission
#33I am surprised that this is even news to people. Fire OS uses Wi-fi to set timezones (which means, by just knowing the BSSIDs, Amazon can pin point your location). Similarly, IP Addresses, if you have tolerance for error, can pretty much help you gauge (coarse) location as well.
It goes without saying that the OHA-Android [0] is a data mine for Google already. With M, they're really upping that game [1]. Far worser things to worry about.
[0] http://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-...
[1] http://www.computerworld.com/article/2931084/android/google-...
Re: How apps track your location without asking for permission
#34So what is that tool name mapping the BSSIDs on a Google Map?
http://blog.trustlook.com/wp-content/uploads/2015/06/Screen-...
Re: How apps track your location without asking for permission
#35Earlier quoted context omitted.
I am not sure how it should be handled. Allowing an app to automatically propose the user's email in a login form is pretty good in terms of UX ... but it means that the app can access to that data.
It seems pretty clear how this should be handled, no? If the app wants to do it, then, as with anything else that might make the user experience better at a privacy cost, let it ask for permission to do it!
Having to ask for the permission to display the email just for the autocomplete makes sense from a privacy perspective, but defeats its UX purpose.
A better solution would probably be to continue to move away from email + password logins and ask the user to login once in an OCD platform and then only propose this in order to signup/login to an app.