Comment by throwaway97777 | Hacker News Reader

Comment by throwaway97777 | Hacker News Reader

Parent Full thread

Well, buckle up folks.

Android's GLS service has an absolute insane data ingestion pipeline consisting of sensor fusion from GPS, Wifi, accelerometer, barometric data, and cell tower locations. It's accurate to within meters, can locate you inside buildings, can count your footsteps, and even knows what floor you've been on.

It's been used by Google to tune its indoor WiFi maps and improve location accuracy for years.

Anyone who has high location accuracy mode turned on and has Google Play Services has already been unwittingly uploading "anonymized" location data multiple times an hour for literally years. In many cases such anonymized data is accurate to within a meter and contains accelerometer data that can literally count your footsteps and determine if you are walking, running, riding in a car, etc. Anonymized GLS data is what informs traffic congestion and many other "non scary" services.

Google believes the negotiation of a 7-day expiration of randomized UID is sufficient anonymization to meet the legal definition in all of its markets. It might be right about the legal definition. It's wrong if it believes it actually anonymizes data. Google believes a popup notifying that high accuracy mode may upload "anonymized usage data" to Google's services constitutes informed consent according to GDPR. I think the EU would disagree if they knew the technical capabilities of Google's infrastructure.

Google's internal privacy review system believes that they are safeguarding the privacy of its users. Their model does not take into account NSLs or interference from intelligence agencies. And it absolutely did not foresee this.

The surveillance dystopia is here, folks, and your Android phone won't do anything noticeably different. They'll flip some switches in their ingestion pipeline and have an insanely powerful draconian surveillance network instantly.

It's over.

5G is the next piece of the puzzle in the surveillance dystopia. Consider how much money has been spent to erect it. Who is paying the bill? Telecom companies are freely able to sell the data they accrue - that was the first step. 5G connects to every IoT device you own. It can make 3D representations of its surroundings https://www.here.com/en/company/newsroom/press-releases/2020... . It maps out the insides of buildings. It knows where people are located, by Verizon's own admission https://www.youtube.com/watch?v=ZmYk-yk0FXw . This is not about giving people faster internet speeds, or miraculous rescues after natural disasters.

Of course, the range of the transmitters is lower because the signals get absorbed by materials in the way. Trees and buildings absorb the radiation, and attenuate it, and thus, to be effective requires the installation of untold numbers of transmitters covering the world. If trees and buildings absorb the radiation, you can bet that your body and brain absorb them as well. We used to keep cell towers far away from people's homes; now we are putting higher frequency transmitters right in front of them. 5G is for surveillance and control. It is a weapon and this weapon is being pointed into people's bedrooms.

> has already been unwittingly uploading

Majority have been doing it unwittingly, true. But you do get services in return. I actually know about the collection, and in case of Google, in my opinion I get compensated in a reasonable way. I'm contributing to wigle and osm as well to counteract the monopoly, but in practice - it's worth it. We could attach some risk to everything and consider what would happen if gov abused it, but we'll all have some threshold of saying "I'm ok with it in exchange for participation in modern society" (it can be re-evaluated later of course)

The alternative is to not accept any of the risks and live in a disconnected commune. Which is ok if that's what you're after, but... that won't apply to most people.

I don't want to call you out personally, but I absolutely hate how servile this attitude is.

Its as if you can't even imagine a world where you get some of these benefits but where your privacy is protected either legally or technically. Both are totally possible, but your lazy attitude about it is part of the problem.

One of these days all this data we've just been casually giving out is going to be used for a pogrom or some other terrible thing and then it will be too late for this facile "the benefits outweigh the costs" bullshit.

>it will be too late for this facile "the benefits outweigh the costs" bullshit.

No it won't, because the horrible, but realistic, take is that the benefits indeed will outweigh the costs. For all the people who are not targets of the pogroms.

Horrible as it sounds, a lot of people don't really care about things that happen to other people. Even if those other people die. Especially when the other people are not like them.

Sometimes I wonder whether apathy is the true root of evil, not really money. I'm no different, I'm guilty of that tendency towards apathy as well. I'm certainly up in arms about privacy, but I really don't get the same way about women's issues. Nor black guys being gunned down by cops in their apartments. I may lament those situations, but I certainly don't donate money or time to those and other causes.

Point is, root of the issue is that no one cares. Everyone has their own concerns. Which is democracy. And that's great.

But inherent in that environment is a kind of built in "divide and conquer" quality that provides political and economic élites a convenient control mechanism.

If blacks or women suffer from state suppression it would be natural to care for privacy too.

Yes we need a model where this can be done on a large scale with the way to compensate that doesn't involve private data. But realistically we just don't have that model. We can imagine the world where that's the result. The hard part is imagining how did we get there, and that's really not trivial - anyone has a chance to do it and succeed right now and it's just not happening.

Then there's the technical issue of: We can't guarantee no collection right now, without rebuilding internet from scratch. Then we need to solve the spam/credible information problem again without existing identity information.

So again, unless you want to live in a disconnected undocumented commune, you're drawing your own acceptance line somewhere. If you don't have own solutions to propose, calling others lazy is a bit of glass house situation.

The thing is that you can participate in modern society without Google needing to track you. It isn't even hard to imagine.

Without Google, yes. But I said: this applies to everything. Do you want medical records staying with your doctor? Do you want a driving license? Do you want a passport? Do you want to register the birth of your kids? It's where you draw the line of convenience -vs- privacy.

That is not equivalent to the tracking discussed here. I don't share any location data with Google or any service for that matter. I think most do not.

Its not over - I switch to oldschool phone that I'll regularly switch off. I'll have some lagging in communication, but at least it's a way to raise awareness among my friends.

The internet presents a unique challenge to privacy. You have to physically connect somewhere. Normally that connection is also tied to your account. This means you they know who and where you are at all times. VPNs can help but are a single point of failure if the government ever shuts them down or installs backdoors.

If you go for the free Starbucks Wi-Fi plan on a tablet, you have some chance but you need to always have access to this kind of proxied connection. Additionally, you are likely to get fingerprinted fairly quickly based on services used and how the ad networks cross target. At the very least, they will know when and where you are at that Starbucks. I really think we have lost. The best we can hope for is E2EE baked into secure chips on our devices to at least protect our messaging.

I don't have anything of that shit activated and I am far from alone with this. My GPS is maybe turned on once a year, so probably pretty inconclusive.

The problem is if the try to form conclusions from the data collected that would concern me too.

If more people were aware what data Google collects, I believe far more people would be careful with Google services.

What is true is that Android basically become a shitty OS, something open source should have prevented, but we know how that turned out.

I don't think that I miss anything with opting out of it to be honest.

Seems like a good time not to have a phone made by a company whose profits mainly come from selling you data.

oH BUt It'S NoT a waLLeD GArdEn!1

ffs.

I use iOS, but the iron grip Apple has on its walled garden puts advanced users at great disadvantage.

You want a privacy-friendly browser like Firefox? No, you are only allowed to use a Firefox skin on good old Safari instead.

You want local ad/tracker blocking? No way, you are allowed to use a VPN instead, and hope it doesn't sell your data too.

You want to jailbreak and stroll outside the corral? Better hope iOS keeps having zero-days, because there's no official way, and Apple actively works against the unofficial way.

Could you roll your own vpn to say your home where you have a a rpi set up as a pihole and your own adblocking dns like you could on android? (Common roll your own VPN's like Wireguard or OpenVPN)

That is exactly my point, these are not solutions, but workarounds we end up with. A sensible approach would be a local blocklist, which would save not only battery and bandwidth, but all the material resources needed for the workarounds.

I understand Apple will never implement this because ads and a captive audience are a crucial part of their business model; I just resent that Apple actively blocks people that want to implement this themselves.

I switched my phone off yesterday. I plan to power it on only on emergencies.

A more hopeful interpretation. This can be a tool for good. It's not necessary for the state to have access. We already have access.

This capability is precisely what we need to generate data that can be used to resolve this crisis and allow us to safely exit from quarantine.

The GDPR allows individuals to request access to their own data.

They can voluntarily share this with their health systems, communities, and governments, such as when testing positive for SARS-CoV-2. This doesn't have to be open-ended, just for recent data that could help track transmission and find other contacts.

On the flip side, individuals who don't know if they're carriers can plug their own data into a system that relates it with the movements of affected people and warns them if they need to get tested.

> A more hopeful interpretation. This can be a tool for good. It's not necessary for the state to have access. We already have access.

The state has had realtime, direct access to the data without a warrant or meaningful oversight on a query-by-query basis since the 14th of January, 2009, when Google joined the PRISM collection program.

It would be a very simple matter to expand that access to send wider selections of data. It may already have the capability to perform such queries.

I argue if everyone would increase their Vitamin D level drastically (by 10000IU), this sole intervention would save much, much more lives than tracking location of phones.

I'm in for the Vitamins, not for tracking.

Reply on news.ycombinator.com