Hacker News Reader

Comment by pxeboot | Hacker News Reader

by comparing the accelerometer and gyroscope readings of each phone, the data could identify when people were facing each other or walking together.

More evidence we need far more privacy controls in mobile operating systems.

View on HN

I don't want privacy controls, I want complete control.

I'm stoked about the Librem 5 project, and I hope it succeeds enough to not disappear in a couple years. I just bought a phone, but I'll likely buy the next rev if the first one works out. I don't need much from my phone, and as long as I can make/receive calls/texts, browse the web, and can get consistent security patches from the community (e.g. some Linux distro supports the platform outside of Purism), I'm happy.

Android and iOS already support privacy controls (and root to an extent), but you're usually at the mercy of the manufacturer for updates and have to trust them to not remotely access your phone. And many manufacturers just stop sending updates once their new model is out, which is unacceptable for most people for laptops and desktops, so I don't know why it's tolerated on phones and tablets...

Complete control is easy. End to end encryption. Don’t let them see what you’re doing.

MAIDSAFE network!

What does this actually mean? No, you're not going to end-to-end encrypt your ... gyroscope data. Those words don't make sense in that order, unless you're sending your gyroscope data to somebody else for some reason- in which case your problem is with them.

If you are paranoid about your location data and security patches you should consider lineageOS and microg [1]. Awesome projects. You can have your location data stored in your phone and not rely on google.

[1] https://lineage.microg.org/

Yes, except this talk [1] still applies

[1] https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...

This is just not enough. I want to control the baseband and I want hardware switches on microphones, location and cameras.

Also there is F-Droid (only open source apps for Android) and the Yalp Store (alternative to Google Play with faked account so you don't have to own one).

Hacking my device like with jailbreak (iOS) or rooting (android) is not the way I want to have to go to feel secure and it's nothing I want to have to do before I think I can use my phone.

Perhaps the Librem 5, Necuno or Fairphone 3 will be suffice. We have a currated list of fair devices on the Fairphone Community forums [1].

[1] https://forum.fairphone.com/t/list-of-fairly-fair-electronic...

I understand and agree with your ideas on controlling the device, but I should also point out that the network that you're on is a major vulnerability, and there's little you can do to control that data yourself.

Government regulation on telecom companies is the only way to ensure that there's even a line that they're required to toe.

I definitely agree with you. Nonetheless lineageos/microg are a step in the right direction. No change will happen overnight. I hope more projects like this will pop out in the future.

> You can still preorder the phone today at the reduced early adopter pricing of $599.

Whoa!

LineageOS on a used android phone might be the better solution here.

Exactly. We (tinfoil hat's) don't want to go with less.

Google/Apple have enough power etc. and I hope Librem5 will be here to show that it is possible to create a descent smartphone with a REAL linux (no, not android) under the hood.

Freedom is only real if you own & control it - not if someone tells you that you're free to go now (to rise the shares probably) ;-)

> I hope Librem5 will be here to show that it is possible to create a descent (sic) smartphone with a REAL linux (no, not android) under the hood.

That was already proven possible with Ubuntu's smartphone adventure. What we need is a sustainable effort. We've managed on the desktop, hopefully the smartphone is possible too.

Of course there is the problem of all those proprietary IOS and Android only apps…

This is really easy to do.

At a hackathon in 2012 our team in just a few hours built tech that would detect who you were standing next to or walking past, all while your phone is in your pocket - we were trying to build a tool that would replace exchanging business cards at conferences.

Can you go into more detail with how that worked?

Not OP, but I'm guessing signal strength measurements, so if 2 devices report similar values they must be close to each other. And then just add the gyroscope info.

That's an interesting suggestion. I'm curious if the body position as it relates to the closest antenna and the phone, particularly if the RF energy has to pass through the owner's body, would add too much noise when compared to the person if they're standing facing the closest antenna.

Have you heard of Bump? They were doing something similar until they were acquired by Google: https://www.theverge.com/2013/9/16/4736860/bump-acquired-by-...

They're basically the Google Photos team, now. Have you seen the ads about face recognition and auto-sharing? They've been working on the problem of photo sharing ever since they figured out that people didn't want to share contact info with Bump, they wanted to share photos.

Didn't know that but makes a ton sense. Also surprisingly how Instagram became Instagram when they realized all it was being used for photo sharing. People love their photos.

Or we can not install apps that do this kind of stuff.

That could mean uninstall the entire operating system because this stuff can be done at device driver level, where closed source is king and even the system administrator can do nothing.

I've always been floored that people leave their location services turned on by default. I have mine on for no more than a few minutes a month. I only turn it on when I'm in an unfamiliar location, don't have my bearings, and looking at the map alone isn't enough to help without GPS.

What are you gaining in exchange for making your life harder?

Increased battery life for one. It used to be easier to toggle on older Android phones because there was a default shortcut in the slide-down menu, now it requires going through the settings at least on Google Android.

edit: Huh, turns out you can add a toggle. I can't believe I never noticed that, thanks!

On newer versions of Android, I believe there ought to be an option to edit the slide-down menu in the slide-down menu itself. Expand it all the way, and look for a pencil icon. You should be able to add a location toggle that way.

There is. Invert colors is very useful when reading HN at night.

Above user might not find it to be a hassle at all. I turn GPS off whenever I notice it on as well, but it's pretty far down the list of ux concerns when using my phone. Sometimes an app reminds me I need to turn it on before continuing, but that's all handled smoothly in-app these days. (unlike sibling comment my phone has gps toggle in the slide down menu)

In my case it's a longstanding habit from when I was told that GPS could drain battery faster :p (maybe it still? does, I don't know)

With something like Tasker this doesn't need to be laborious at all (I have location turn on while certain apps are in use, e.g. Osmand~, and turn off otherwise). And, tin-hattery aside, it has power-saving advantages.

I don't know what you mean about making my life harder. I don't see what I have to gain by using location services outside the rare moments I need it. I'm gaining privacy by not keeping it on.

You're probably gaining significant battery life as well.

I think you’re fortunate to not need it, but I lived in an unfamiliar place for a few months and I used my map apps to identify the best routes (public transit, biking, should I walk, or should I Uber?) nearly 3-4 times a day.

Turning it off/on would be difficult, but I do set most apps to only allow location services during use... but the maps I have set to always. I also don’t have the Facebook app installed

The alternative is to keep location on (while in use), but download offline maps.

No idea if the app phones home with all historical location data if you re-enable data though...

Maybe that’s why Google likes to expire it’s offline maps ?

OsmAnd and MapsWithMe are good apps that you can use offline maps on indefinetly once downloaded. They use Openstreetmap of course.

> I don't know what you mean about making my life harder

You're spending time and effort turning this on and off.

The rest of us don't.

What are you going to do with the additional ~5 minutes that not spending that time and effort has added to your life?

What is an insurance customer getting in exchange for making himself poorer? With respect to privacy, the price of peace of mind is all over the place at this point: the tech-ization is society is recent enough that even well-informed people have big differences of opinion on the likelihood and costs of privacy-related calamities.

If you estimate privacy risk as high, then you're naturally willing to make your life harder to avoid this risk, and you naturally come to regard those with lower risk estimates as reckless. Likewise, if you're in the other camp, privacy-preserving measures look like wastes of time and money.

It's hard to say at this point who's right. We haven't actually seen a lot of privacy-related disasters, the lack of which might seem to promote the low-risk camp, but the high-risk people would reply that the breaches that do occur will only become more damaging over time as we move online.

I'm not in the high-risk camp myself, but I do think that this camp has some valid points, since information is power, and power is ultimately a corrupting force. It should be easier to live a privacy-risk-mitigating lifestyle.

You gain more conscious decision making and that can help you a lot in life.

Sure you could just give in and "go with the flow" because that's what majority does and it's very convenient.

Also people as social beings want to belong to groups and doing the same stuff they do is the easiest way to gain access to groups.

That's the reason why so many use WA and FB and don't even care about their data. They already gave up and make fun about those who haven't.

If you have courage and a strong personality you can withstand this peer pressure. If you are cool enough there will be others to follow you. If not you can also learn to deal with that and in the end it's only necessary to have a few really good friends in your life.

TLDR; You gain more control over your life and strengthen your personality.

How is using location services "going with the flow", but you using the Internet isn't? Are you ceding to the majority rather than having courage and a strong personality?

I'm sure you believe that corporations are evil and basically out to get you, but the vast majority of people doesn't. I think it's safe to assume that you're the outlier here.

Have you ever tried putting yourself in the shoes of people who leave their GPS on? Can you see how much better the user experience is? Can you understand why someone who never had a negative experience involving their location data might prefer to leave their GPS on?

I leave my GPS on all the time. I love going back in time and see where I was at any given time. I can download the data and correlate it with a bunch of other metrics I keep track on. If it wasn't free, I would pay for it.

I'm not floored that you turn your GPS off. I've met many people just like you. Some of them had traumatic experiences in the past, others generally don't think other people are trustworthy. I can respect that. Just don't assume it's the default sentiment, because it's not.

Here's an interesting survey about trust:

https://slatestarcodex.com/2017/10/05/ssc-survey-results-on-...

> I'm sure you believe that corporations are evil and basically out to get you, but the vast majority of people doesn't. I think it's safe to assume that you're the outlier here.

I've worked in ad tech before. I used to write code to do some of this tracking and enable analytics on it. Nobody I worked with was out to antagonize users, but in principle I'd rather not feed a master profile about myself that gets matched, bought, and sold between companies and their partners. There's nothing controversial about my movement throughout the day but I feel better not being tracked.

You're being tracked anyway just by having your phone turned on.

Regarding your first paragraph, let me quote from the HN guidelines [1]:

> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

[1] https://news.ycombinator.com/newsguidelines.html

ask some Rohingya from Myanmar?

That’s a problem with the Myanmar government, not location-based services. People have also been jailed for articles they publish in newspapers or private letters they write. In those cases no one blames the act of writing letters- it’s fairly obvious that the government that’s reading mail is to blame, not the letter-writing in the first place.

this isn't about privacy. I literally charge my phone less, because not only does gps coming on randomly eat up battery - when it has data to collect from random apps they make a data connection and send stuff home. I could care less about going back, tracking my location history, and correlating it with other data. I have a life, and gps on, after a day of the phone sitting there on standby, eats an extra 5% of battery.

turning gps on before i launch maps is 1 extra tap on the toggle on my home screen.

I think the one with a traumatic experience here is you - one that prevents you from seeing very basic logic for the use case of GPS off.

off topic but it always irks me when people get it wrong: it’s “I couldn’t care less”

I’d also pay for the ability to see where I was at a particular time, as it does seem like a very useful feature. In fact, I did pay for it by obtaining an iOS app that stores location history locally.

Google’s implementation looks really convenient but feels too creepy to me.

It's not about the majority - don't you see that?

It's about the 1-3% who will f* you for being a naive sheep.

That is why we can't trust these corporations and that they get more powerful everyday doesn't ease my mind (accumulation until we only have "the shop").

The problem with our economy is the basis for that. In our world (at least in the west, can't really compare that to the east as I only know it from western propaganda) the biggest goal is MONEY (=POWER).

Ethics, environment and people just don't count in this equation (ok they do if you want to improve your image).

Sure that's not what majority of the people sees but also they don't know anything about computers & software and most of them probably haven't thought much about ethics & philosophy. Just because majority does something is not a very good argument (see lemmings).

Some people see the glass half full as they have evidence of their movements as an alibi should they need it.

Or a fake alibi if you're sufficiently determined.

Go fishing in a secluded area regularly to establish a pattern. Then go hide your phone there one day, do crime, come back and get phone.

Or half empty -- as evidence they were somewhere unfortunate (doing something totally benign and unrelated.)

Why would this be a concern?

At worst, you're somewhere unfortunate (doing something benign and unrelated) and someone brings you in for questioning about it. Wouldn't they do that in many cases even if your GPS was off (for example, from seeing you on cameras or other means)? It seems better to be able to bring in as many people as possible to get whatever information is needed to help with whatever situation was unfortunate in the first place.

If asked, it's not like you're going to lie and say you were somewhere else if your GPS was off. This way, you at least have proof you were exactly where you said you were.

It seems you have not at all dealt with ill intentioned law enforcement entities.

While I would wager that I've dealt with police and the court system _significantly_ more than the average American, I will admit I haven't ever encountered ill intentioned law enforcement entities -- it's hard to believe I'm just lucky, though.

I think it's pretty safe to say bad LEOs make the news because they're extremely rare, and the backlash against each one found signifies that the oversight exists to ensure they don't last long.

Broadly speaking though, it is because the criminal justice system in the US focuses on conviction as the metric of success, not whether the conviction is of the correct person -- it is simply whether there is sufficient evidence to convince the jury, or sufficient fear to garner an quick plea bargain.

Tens of thousands of people confess to crimes is because they are given the option:

- 6 months for a plea bargain confession

- 10-20yrs if they "fight the charges" but get convicted in court

Many cannot afford expensive lawyers, so often times, the odds are stacked against them in court.

In more select scenarios, people confess to crimes they had nothing to do with because of pressure applied. One of many examples would be that of https://en.wikipedia.org/wiki/Jon_Burge In summary: [Innocent person] + [cowprod electrocution] = [guilty confession]

Edit: flow

On the other hand, I've had mine on 24/7 for the past 2-3 years and routinely visit my timeline on Google Maps to look back on exactly where I went on particular days.

Looks like this, and I find it extremely awesome/useful: https://i.imgur.com/jxxjg1g.jpg

Might be a good idea to obscure the full URL in your screen shot.

I'm 95% sure that URL is safe.

I am actually going to buy a separate GPS for the car and disable as much as possible on the phone.

Cellular carriers sell your real-time GPS location even if you turn off your phone (GPS chips operate outside the network)

Proof: https://www.zdnet.com/article/us-cell-carriers-selling-acces...

Generally, carriers only have access to the RAN metadata (cell sector, signal strength, etc), not GPS.

And in Europe they can't sell or pass on personal data. They can aggregate it, and sell aggregated data (e.g. for transport planning purposes)

Read again.

"This includes cell tower and cell sector location, assisted GPS and cell tower trilateration."

GPS chips are receive only.

Read again.

"This includes cell tower and cell sector location, assisted GPS and cell tower trilateration."

They sell cell-tower data, not GPS data.

The article literally says "cell phone location data from nearby cell towers. It's less accurate than using GPS".

Read again.

"This includes cell tower and cell sector location, assisted GPS and cell tower trilateration."

Fun fact: my Android phone battery was being sucked at a fast pace last month. I don't remember exactly how it presented itself in the UI, but I ended up figuring out that the Google app was the culprit, because it was using the GPS... which I had explicitly disabled.

An internet search showed I was not alone with such problems, and that the solution was to manually revoke some permissions for the app (thankfully it was possible).

I find it amazing that an app can make use of the GPS when it's disabled! I'm actually seriously pissed about it, but there's not much I can do about it.

But you do have the option to purchase phones running operating systems that implement tighter and more credible controls. I believe that companies understand nothing better that consumer dollars.

The fact that I could prevent the app from using the GPS says the OS does have the tight controls already. This is not a problem of permissions model.

Also, the only non Android phones are essentially from Apple, and they are too big for my taste. (also, ridiculously expensive ; also, my wife uses iPhones, they all ended their (short) career with a swollen battery; not sure what she does with them)

iPhone SE is small and fairly cheap.

Its also a redheaded stepchild that Apple has discontinued without a replacement, not a great place to migrate to if you want a new phone of similar size in 3 or 4 years running iOS.

Of course it’s all hypothetical, but many pundits are betting on a comeback of a SE type of iPhone, as the expensive strategy is not working for Apple.

On Android location != GPS.

For location also Wi-Fi is used. So GPS can be turned off but they can track your location by looking at the available Wi-Fi spots around you.

My battery was being sucked by GPS according to the battery usage reporting. And that stopped being the case when I revoked the Google app permissions.

Not only that. The app for route planning with public transportation in my town. Thanks to GDPR I have learned that they are sharing data with 500 trusted partners!

And most of the time you do not need to give the app permission to use the location to do route planning even in unfamiliar neighborhood. You can just input street name or public transport stops have logical unique identifiers.

But of course most people do give permission at some point because it is easier to do so and the app i nagging constantly for the permission.

I use location and a dash of IFTTT to auto-fill timesheets. I'm aware it's a trade-off.

The problem is how broad the term location services can be. In this context Facebook is using innocuous camera and sensor data to track the same device around. They could well write some code to listen to the microphone only when nobody around is talking, which per se wouldn't raise any privacy concerns, then use it to track laptops and tablets/phones by matching the sound of their fan under load or the spectral content of finger taps on the screen.

Unfortunately I believe there's not much users can do other than stopping using Facebook and any of their and similar products for good, then keep being alert because tracking people is both a business for companies and a tool for governments to suppress dissent, so anyone involved in any technology related to communications will inevitably be incentivized to implement anti-privacy features.

I don't see it as inherently bad, though.

Reply on news.ycombinator.com