Ask HN: How does my android device know my weather without location perms? | Hacker News Reader

Ask HN: How does my android device know my weather without location perms?

10 pointsawinter-py15 comments

I've disabled every location setting I can find on the device, both general location and the specific options to share with google, and it's still giving me weather.

Are they just ignoring the setting?

View on HN

You are connecting your phone to a wifi spot or honeycomb network around your places, they all have IPs, so IP is enough to tell where u live, not very accurate but enough to figure out many things.

It's more accurate to use the MAC address of the Wifi spot. Google was triangulating the locations of Wifi spots and recording their MAC address while taking pictures for Google Maps Street View.

https://outflux.net/blog/archives/2010/01/24/google-is-wardr...

https://www.darkreading.com/risk-management/google-wardrivin...

https://www.darkreading.com/risk-management/google-street-vi...

http://transition.fcc.gov/DA-12-592A1.pdf

From the FCC report:

> Between May 2007 and May 2010, as part of its Street View project, Google Inc. (Google or Company) collected data from Wi-Fi networks throughout the United States and around the world. The purpose of Google's Wi-Fi data collection initiative was to capture information about Wi-Fi networks that the Company could use to help establish users' locations and provide location-based services.

at this point I assume they're collecting more hotspot information from smartphones running G maps vs from cars

IP geolocation using external databases that don't require permissions for the Location API.

Maxmind GeoIp database. If you plan to use it, remember to pay forma it and upgrade every 2-5 days.

If I remember well, about 1% of the results were not up to date after 7 days. And the free database was at least 2-3 weeks old.

What does 'don't require permission' mean? I've assumed that when G says in a settings page that I've disabled location upload, that's more or less binding (regardless of whether the location info comes from GPS, wifi, LTE towers, or maxmind).

Have I misunderstood?

Yes I think you are misunderstanding what the poster means. When you make a request to an external server, you are giving that server your IP address. There is no way you can stop an external server from them taking your IP and looking up your IP in a geolocation database.

Therefore this kind of location lookup does not require permission.

I can't stop it from doing a location lookup against my IP, you're right. But this is a google service, they can choose to abide by the settings button that I flipped to off. I'm confused by why they aren't.

Does such a setting actually exist? I think you’re misunderstanding.

I think awinter-py means that because they turned off location services, Google should not look up their location by IP and display the weather even if they can.

But yeah, that's not what the location API means.

To be clear, this isn't a third-party weather app -- it's a feature built into android that just appeared one day. There doesn't seem to be a way to turn it off.

You’re accessing an internet service for the weather, therefore they get your IP, then there’s services out there that map IPs to locations. You can test this by using a VPN and visiting a weather site with GPS/etc turned off. It will show you the weather for the location of your VPN node.

Celltowers broadcast their location and that is enough to get a pretty good estimate of you location when GPS is disabled.

Spying is a big business and paying for forgiveness is a small price to pay over asking for permission.

If you're running the Google Play Services/Google apps package, you've already lost.

Reply on news.ycombinator.com