Hacker News Reader

Comment by Mediterraneo10 | Hacker News Reader

One of the most disappointing changes in Android recently is that any network-assisted geolocation plugins must now be installed as a system app, not a user app. That means that even if you use LineageOS where most Google stuff has been stripped out, getting a GPS fix through network assistance still sends data to Google servers. Only a tiny minority of users are comfortable working with the command line and will install e.g. Mozilla geolocation to the right place on disk. Just one of many changes Google has pushed into AOSP that end up strengthening its own monopoly.

View on HN

> getting a GPS fix through network assistance still sends data to Google servers

Well, that's not a GPS fix.

If you want a traceless position fix, use GPS Navstar / Glonass / Beidu / Galileo. Yes it takes longer from cold start, but that's the trade-off for privacy.

Assuming it is the system I'm thinking of, it is all about sepeeding up the time to a first fix. Without it can be quite a few minutes to get a fix.

https://en.m.wikipedia.org/wiki/Assisted_GPS

I always deactivate geolocation and I assume and hope it doesn't phone home to Google in that case. I still deactivate network if I don't need it. Android devices cannot really be trusted and it seems to be getting worse.

Of course I am not using contact tracing either in this case, but I certainly won't allow Google to trace my location.

If I understand it correctly, contact tracing should rely on bluetooth only. Does it require location services and/or network on Android?

Sadly yes. It is probably a software component problem that bluetooth is bundled with location services, but without the separation from GPS, I have serious concerns about privacy, even if I think that I only use well behaved apps.

Bluetooth and location services being bundled is a policy decision by Google. If one has a database filled with historical correlations between bluetooth devices "in range" and GPS coordinates, it is possible to get a pretty accurate fix on someone's location from the current devices that are in range. This is the reason why Google has bundled Bluetooth and GPS in one permission.

Of course, the very fact that these permissions are bundled is the reason why it's feasible to keep such databases up-to-date, and why up-to-date databases provide a continuously stronger case why Bluetooth should be considered a type of location permission..

It would be totally possible to separate location permissions between "passive" location (e.g. triangulation through received GPS coordinates), and "active" location, e.g. inference of location through indirect measures and correlations with historical databases.

Afaik it's now a system-wide setting to disallow said correlations, but offering app developers more fine-grained control would be better for all of us. Why does, for example, my Sony Bluetooth headset need my location just for updating some firmware..

It's practical and also Apple does, but it's confusing for most users. I wish both platform explaining why it's bundled on the screen. Maybe create a permission only able to connect specific OUI would be a solution?

I believe that with the latest version of Android, and on supporting handsets, only Bluetooth is needed. Fraid I can't recall where I read it.

On a Pixel 4 with android 11 I was able to run the covid contact tracing app without location services. If I turn off bluetooth a notification appears that says exposure notifications is inactive until bluetooth is turned back on.

Even if you disable geolocation, Google can learn your location via Wifi/Access points nearby easily. It should be easy to cross references you (geolocation disabled) and others (one of them enabled geolocation) in the same network for Google.

> Google retains a detailed map of known Wi-Fi networks and access points. By knowing the exact location of these networks, and your proximity to them, its location services can gauge your location with roughly 30 feet of accuracy. [0]

[0] https://slate.com/technology/2018/06/how-google-uses-wi-fi-n...

It should be noted that by using WiFi (or Bluetooth) triangulation you can actually get much higher location accuracy, like a foot or two

30 feet sounds like cell tower triangulation.

Using cell tower and wifi location actually made my location much less accurate when I was living in SF. Rideshares would pull up to the wrong side of the street where the cell tower was, and immediately get kicked out and ditch me because it was a high use bus stop. When driving myself I would pop several streets over every time a new office tower came into line of sight. When near the beach, my location would fix to some cafe half a mile away with its wifi power up too high.

I assume and hope

It's sad we got the the point the customers are afraid their devices are selling them this badly, because you can't even tell if your settings have the effect you think they should have.

I installed GrapheneOS a few weeks ago. The first thing I said to someone that asked about it is "for the first time my phone isn't my enemy".

OK the second thing was "but I can't do almost anything with it :D "

Many people would be fine with the trade-off _if they knew they have to/they could take it_.

Google and the likes have made it very difficult for you to be even aware that was an option.

I don't agree. The information is there, even the YouTube algorithm (the last part of my life that isn't deggogled) is recommending me degoogling videos!

People just don't care enough, even among my fellow geeks I had to "battle" to get them to install Signal because I couldn't use WhatsApp anymore.

We are bombarded with news about revolting situations and at one point there's so much outrage one can take. So the Evil Big tech spying is very low on the list of most people especially since they don't see the damage.

Private DNS (DNS over TLS) also sends metrics to a Google endpoint on every network change, as a way to detect connectivity. AOSP is truly a surveillance software.

Chrome used to have this neat little "helper" hidden in src/net/dns/host_resolver_impl.cc that would just by coincidence call hardcoded 8.8.8.8 every time DNS reply didnt contain A record, all behind the guise of "helping resolve navigation errors". Propagated to all other browsers using same codebase.

https://www.reddit.com/r/vivaldibrowser/comments/a23071/how_...

Looking it up now they rewrote this part of the browser, and either moved it somewhere else or obfuscated it better.

Hmm, wouldn't in that case Lineage be able to preinstall such service themselves? I'd expect them to?

No, the LineageOS devs say that their project does not aim to completely de-Google the OS, only remove Google Play Services and some Google applications like Maps. Thus, geolocation, DNS and login portal detection in LineageOS still use Google's servers.

Ugh, that's very disappointing then, I've always advised Lineage to people who wanted to deGoogle their phones :/

To be fair, lineage+microg is probably the best you can get while still keeping a reasonable level of convenience (that is, still running android and most popular apps).

agree. Even better with same reasonable level of convenience is iodé

You are literally on a phone that was/is heavily subsidized by Google. They hold all the keys and own all the doors, if you want to degoogle, go Purism/Pinephone/Linuxphone.

There's GrapheneOS if you have a Pixel 2+ or /e/ os for other phones.

/e/ is based on LineageOS, not even the latest at that, and searching on it a bit smells a bit of BS.

What about /e/ ? It's been a while I haven't heard about them.

Least. Fucking. Searchable. Name. Ever.

Arguable worse than R, C, or Word.

"Gee, let's take the most frequently occurring letter in English usage, and bracket it with Web-significant non-text punctuation."

"e Foundation" will find them.

No idea on status/news.

https://e.foundation

I follow Gaël Duval (the founder of /e/OS on Mastodon. https://mastodon.social/@gael

He gives regular status updates and they seem to be making good progress. I played with /e/OS a long time ago when it first came out and found the microg integration to be excellent (have had trouble in the past getting LineageOS + microg to work...). I am planning to flash /e/OS onto a phone again soon to see the latest progress.

And i think its for the best. This ROM is a joke: outdated, the store is full of outdated or non-original apps. Its a lack of respect for their users to market a device as secure with an unencrypted ROM with bootloader unlocked

OK, but it's weird to blame Google for Lineage's philosophical position. As it stands Google has contributed to LineagoOS far far more non-Googlr-dependent stuff than Lineage has.

I am pretty sure MicroG Lineage builds have NLPs other than Google's own preinstalled and being prerooted (or easily rooted with the extra zip) should be easily interchangeable from their settings. Though this is mostly an annoyance since an user installing Lineage should already be a little comfortable with adb and a terminal, it seems another sad step towards locking down Android furthermore.

Do you know how to disable network assisted geolocation on Android 10? I have Lineage OS based on that version and neither following the guide for Android 11 nor for Android 9 makes the option show up, and the guide for Android 10 somehow doesn't exist. Maybe it's disabled because I don't have gapps?

https://support.google.com/accounts/answer/3467281?hl=en

What is the case when you install LineageOS without google services? In my understanding, this takes care of the location provider problem. Of course you still have lots of google in your phone, which is the whole reason of the /e/ foundation for example.

I invite you to try iodéOS, where they stripped out Google's DNS & SUPL servers, and allow you to directly select the location module of your choice ..

Does iodéOS disable sending the IMSI along with all SUPL requests? [0]

What about A-GPS MSA handling? [1]

[0] https://review.lineageos.org/c/LineageOS/android_frameworks_... [1] https://en.wikipedia.org/wiki/A-GPS#Modes_of_operation

Another worst thing about android is giving carte blanche to apps for accessing messages. Most of apps these days use OTP to validate phone number. To read OTP message automatically, they ask permission to access text-messages. I knew few of such apps who keep polling user's text-messages to server daily without user's knowledge.

I have a Huawei without Google, and I can do geolocation, maybe you could try that too ? If you use google for search and huawei for map, they can't cross reference to each other since they're forbidden to talk to each others.

I actually feel so much better without all the google stuff, weird no?

> I have a Huawei without Google, and I can do geolocation, maybe you could try that too ?

I assume that even if Huawei’s Android sold in the West doesn't use Google Play Services, it still uses standard AOSP, and the issue is that Google geolocation (and some other use of Google servers) is hardcoded into AOSP.

I would be astonished if Huawei didn't have any spywares on their phones! Unless they fear the level of scrutiny they'll receive by the West.

And even if the OS isn't spying, the apps you install can spy, albeit less effectively.

Be aware that downloading the GPS almanak, which is how AGPS gets a quick GPS fix when the device has been offline, does not necessarily reveal your location to anyone.

Do you have any links/tips on how to become part of that minority of users that use Mozilla's service?

https://microg.org/ has implemented a pluggable network location provider service. If you flash MicroG on your device, you can then select Mozilla (or Apple or other) location backend providers.

Reply on news.ycombinator.com