Hacker News Reader

Comment by ecabuk | Hacker News Reader

Just using GMail could help Google to find your approx. location 7/24. Your phone checking emails all the time, so google knows your ip.

View on HN

IPV4 geolocation is based on maintained databases (e.g. Ma Mind) that usually are city or street accurate.

The popular rhetoric that having an IP is having the location is most often wrong unless Your users have static IPs registered to them. The way law enforcement does it is by subpoening the owner of the IP of pointing to the user associated with the IP at specific time but that still is prone to errors because of NATs - many distinct clients behind a single address.

All in all fingerprinting is using IPs pretty rarely nowadays.

If other devices in your network send data to Google, the network is uniquely identifiable by Google, no matter what individual devices of guests etc. do.

CGNAT means sometimes an IP just identifies an entire ISP and nothing more.

The combination of occasional GPS/Wifi location data and continuous IP data is pretty powerful though.

There's a setting hidden away in android allowing apps to scan local wifi/bluetooth networks even when wifi is turned "off". Enabled by default of course.

What settings is that?

Settings > Location > Improve Accuracy

2 settings, one for Wi-Fi scanning and one for Bluetooth

Security & Location -> Privacy -> Location -> Scanning

(Supposedly; I don't own an up-to-date Android device.)

I bet Google can do better job than the MaxMind but even the city accuracy isn’t that enough? I think it is enough to effect your localized ads.

Phones actually use push services (Googles FCM and Apples APNS among others) to get notifications. They don't really "check email" like your desktop PC does with a cron job.

Having said that, both Apple APNS and Google FCM do send regular heartbeat to their respective servers which make your positional tracking possible by both companies.

Not just your current location, but where you've been and where you will be going. If you are traveling, moving, changing jobs, etc, you probably had some interaction via emails.

If you had access to a significant portion of a country/world's emails, imagine the power you truly have.

Behind a CGNAT, which most mobiles devices are, makes that point fairly moot. When I look up "my ip" on the phone it's always in a capital city 6 hours away.

Your mileage may vary of course.

There are only three mobile carriers in the US, which means at most three organizations controlling the CGNATs. I can assure you that they are selling the reverse port-to-user mapping to the highest bidders.

Don't know much about US carriers apart from brief interactions but I thought it was clear they were selling that data to 3rd parties for years and then got Government blessing to do it after being called out?

Seems insane to me, it's one of those thing you take for granted elsewhere, yeah of course my mobile ISP knows my location, as does the govt if they ask the ISP in an email, that's fine. (Quite sure most carriers have no qualms just handing it over on request)

But just selling that info for cents to any third party seems so utterly egregious and a massive betrayal of consumer trust.

Why would they sell to the highest bidder? The make more money from non-exclusive sales.

>I can assure you that they are selling the reverse port-to-user mapping to the highest bidders.

Based on what evidence?

> Your phone checking emails all the time

I turned off mail sync, I only trigger it manually, so there is a way to avoid the constant checking.

Reply on news.ycombinator.com