Hacker News Reader

Comment by conradev | Hacker News Reader

The thing that scares me the most about the LocationSmart stuff is that I can't think of any workaround besides "don't use cellular data".

View on HN

It works as long as your phone is turned on and within range of at least one cell tower.

Whether you have data turned on is irrelevant, along with phone type, OS, smart or dumb - This affects all cell users.

I always assumed on or off, as long as battery was in & had charge. Hence, the proliferation of SoC(exclusively) & non-removable batts(aka elegant design).

So what if we had a pool of "shared" 3/4G wifi hotspots with burner SIMs - kind of like bookcrossing - where you use one for a while then send it on to another member - a "sharing economy" of hotspots, "like Uber, but for cellular data".

Then you use them with a non-cellular equipped device (iPod Touch?) or perhaps trust airplane mode with Wi-Fi turned on - and use Signal/iMessage/Facetime/whatever...

I wonder how hard it'd be to route incoming calls to my phone (as in, the one with a SIM registered in my name) to a vpn-ed non-cellular device? You could probably make a very plausible looking "Gets up, goes to work, stops at a bar on the way home some days, gets back home, goes to sleep." routine while still being connected while you phone is on the desk at work of the coffee table at home. (or perhaps on the Roomba at home, so it still moves around a little...)

One of two things:

1) Someone uses it for nefarious purposes, everyone involved gets implicated and investigated (in no small part in an attempt to drive people away from this model), no one wants to use these things anymore.

2) It works reasonably well, becomes a business, and big business provides for a small fee (perhaps free except for watching ads and your location data....) those hotspots and decimate the critical mass needed for this into unusefulness. If you think that's far fetched, this has already happened: consider email - it used to be distributed. There is now a copy of ~90% of emails on a Google/Microsoft server because at least one of the senders/recipients uses a hosted account.

You can't really win an infrastructure game against established player using their own infrastructure; And the barrier to entry is so huge it's unlikely you'll be able to set up your own.

It is not productive to think up technological solutions where a political one is required. Legislate for stronger privacy. Disallow companies to collect/store this data.

You're probably right, and the EU are trying at least - but there's also an argument that once "the genie is out of the bottle", there's no way to stuff it back in.

A friend of mine makes a very persuasive argument that Facebook has demonstrated how to manipulate vast numbers of people at mass scale - so much so that shutting Facebook down would no longer make any difference - now that it's known to be possible, it's much easier for anybody else to copy what's public and work out how to make the "private" algorithms work.

A long-ish read, but a lot of that argument is here: https://meanjin.com.au/essays/the-last-days-of-reality/ and here: https://ukvid.net/video/mark-pesce-on-the-end-of-reality-fPA...

Airplane mode + WiFi + Signal? Covers 95% of my daily routine. Home-Work-Home-Work-Home-Work-Home-Work-Home-Work-Weekend-Weekend.

From the first thread on this issue[0], it appears that the GPS data transfer exchange is happening underneath the OS level.

I tried the locationsmart demo, after disabling the GPS on my phone, and all location services, my exact location was still be able to be pinpointed utilizing their GPS option.

[0]: https://news.ycombinator.com/item?id=17081684

It's using the cell tower location. If you don't connect to the cell tower (Airplane mode), there's no location.

>> From the first thread on this issue[0], it appears that the GPS data transfer exchange is happening underneath the OS level.

> It's using the cell tower location. If you don't connect to the cell tower (Airplane mode), there's no location.

So you're saying that person quite explicitly saying this is GPS data is explicitly wrong about this? (i.e. you have more information than that person, and it is explicitly to the contrary?)

FWIW the Kerbs article makes no mention of GPS, only nearby cell towers

https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...

That person was clearly claiming to have 'insider' information. I'm not sure why one would expect Krebs to have been privy to the same information.

It does AGPS, pointed to where exactly I was in my house.

Or it's being reported as part of the E911 data for emergency services.

This seems like the most likely explanation to me.

It looks like this is the creepiest of all the ways "they" get your location:

https://www.qualcomm.com/products/izat

There are 3 operating systems running in any phone:

* iOS / Android * The SIM card JVM * The baseband RTOS

And Qualcomm is in most phones, running their RexOS, which Has that IzAt service, which has full access to memory, GPS, etc, and uses this access to send your location data to Qualcomm / the carrier.

https://news.ycombinator.com/item?id=17082485

https://en.wikipedia.org/wiki/REX_OS

https://news.ycombinator.com/item?id=6722292

https://forums.oneplus.com/threads/what-does-this-do.373496/

While I’d love to believe that’s enough, you can’t really be certain the SIM isn’t uploading Location data that’s been stored while in airplane mode. Until SIM is open source (which is pretty unlikely) there’s no way to be sure outside of a device not having a cellular radio or gps capability.

Why would it? The SIM card itself has no real functionality, and cannot just randomly affect the radio components of the phone. It just stores its identity and keys, so the cell tower can identify and bill the right user.

The way the location tracking works is simply by logging what phone connected to the cell tower, at the tower itself. To be able to adjust the power the radio component needs to output (to get a good signal), it needs to know the distance to the tower. You get location by then correlating with multiple towers, because the phone has to choose which one it has the strongest reception to, and therefore has to gather data from all nearby towers.

In short: that’s not how a SIM card works.

Leaving aside the SIM card, there's no way to really know what the baseband is up to: https://www.extremetech.com/computing/170874-the-secret-seco...

SIM cards do run some sophisticated software, e.g. a. Java Card runtime.

Even with something running on it, that’s not automatically gonna give it access to any other hardware component in the phone. The phone itself is only interested in using it for identification.

> Even with something running on it, that’s not automatically gonna give it access to any other hardware component in the phone. The phone itself is only interested in using it for identification.

I can't tell if this is true or false, but it seems that in either case, access to the SIM can imply access location data:

> With the all-important (and till-now elusive) encryption key, Nohl could send a virus to the SIM card, which could then send premium text messages, collect location data, make premium calls or re-route calls.

[1] https://www.forbes.com/sites/parmyolson/2013/07/21/sim-cards...

AP MAC addresses, signal strengths and locations have been collected by Google for years to provide WiFi-based location services to Android users.

I wouldn't be surprised if other platforms/applications/companies are using that data, as well.

Mozilla also.

https://location.services.mozilla.com/

The solution is political, not technical.

Which is even harder because you have to convince the masses to care instead of just messing with some code to fix the problem for yourself

Then there's no solution at all.

Faraday bags work when you want devices offline - but it doesn’t make for a very useful device.

Do you have a source for that? Even without cellular data turned on, carriers know your rough location based on cell tower locations.

Yeah, oops, I meant "don't turn on your cellphone".

Except that they can just turn your phone back on remotely, should they want to.

There is no [citation needed] big enough for this incredible claim.

Not to imply that it can just be done easily to every phone, or without preparation or perhaps previous physical access, but this concept has come up more than once in the mainstream news in recent years. So this level of incredulity seems misplaced.

http://www.slate.com/blogs/future_tense/2013/07/22/nsa_can_r...

https://www.tomsguide.com/us/nsa-remotely-turn-on-phones,new...

Honestly, I thought it was a well known thing by now. A quick search on google turns up multiple writeups.

> "Can anyone turn it on remotely if it's off?" Williams asked Snowden, referring to the "burner" smartphone Williams used for travel to Russia. "Can they turn on apps? Did anyone know or care that I Googled the final score of the Rangers-Canadiens game last night because I was traveling here?"

> "I would say yes to all of those," Snowden replied. "They can absolutely turn them on with the power turned off to the device."

Uh, what? That’s a pretty significant claim.

Use a faraday bag.

That breaks wifi (though wifi is enough to leak decent location data, unless you’re using a vpn, and somehow blocking location service).

I wonder how hard it is to open a modern iphone and cut the relevant antenna traces on the pcb.

There are youtube videos on iDevice wifi modifications. You can also use a wired ethernet adapter on iOS devices via the lightning port.

at that point, what's the point of using a phone?

There are many offline apps/data which can be synced via wired ethernet, including maps, audio, music, video, photos, books, notes, sound/light meters, compass and special purpose add-on devices.

exactly. i think the issue with cell with people is that it can track your movements and most people always have it on them and on.

Surgery: No GPS antenna, no GPS location.

Use a "proxy" phone number that forwards to your cell phone number and keep your real cell phone number private.

It's not the number that's a problem, devices are tracked and the data is sold by the cell provider. Even if it's not billed under your name, it's likely moving between your house and your work 5 days a week, that's enough to deduce who it's used by.

Reply on news.ycombinator.com