Hacker News Reader

Comment by raxxorrax | Hacker News Reader

I always deactivate geolocation and I assume and hope it doesn't phone home to Google in that case. I still deactivate network if I don't need it. Android devices cannot really be trusted and it seems to be getting worse.

Of course I am not using contact tracing either in this case, but I certainly won't allow Google to trace my location.

View on HN

Even if you disable geolocation, Google can learn your location via Wifi/Access points nearby easily. It should be easy to cross references you (geolocation disabled) and others (one of them enabled geolocation) in the same network for Google.

> Google retains a detailed map of known Wi-Fi networks and access points. By knowing the exact location of these networks, and your proximity to them, its location services can gauge your location with roughly 30 feet of accuracy. [0]

[0] https://slate.com/technology/2018/06/how-google-uses-wi-fi-n...

It should be noted that by using WiFi (or Bluetooth) triangulation you can actually get much higher location accuracy, like a foot or two

30 feet sounds like cell tower triangulation.

Using cell tower and wifi location actually made my location much less accurate when I was living in SF. Rideshares would pull up to the wrong side of the street where the cell tower was, and immediately get kicked out and ditch me because it was a high use bus stop. When driving myself I would pop several streets over every time a new office tower came into line of sight. When near the beach, my location would fix to some cafe half a mile away with its wifi power up too high.

If I understand it correctly, contact tracing should rely on bluetooth only. Does it require location services and/or network on Android?

On a Pixel 4 with android 11 I was able to run the covid contact tracing app without location services. If I turn off bluetooth a notification appears that says exposure notifications is inactive until bluetooth is turned back on.

Sadly yes. It is probably a software component problem that bluetooth is bundled with location services, but without the separation from GPS, I have serious concerns about privacy, even if I think that I only use well behaved apps.

Bluetooth and location services being bundled is a policy decision by Google. If one has a database filled with historical correlations between bluetooth devices "in range" and GPS coordinates, it is possible to get a pretty accurate fix on someone's location from the current devices that are in range. This is the reason why Google has bundled Bluetooth and GPS in one permission.

Of course, the very fact that these permissions are bundled is the reason why it's feasible to keep such databases up-to-date, and why up-to-date databases provide a continuously stronger case why Bluetooth should be considered a type of location permission..

It would be totally possible to separate location permissions between "passive" location (e.g. triangulation through received GPS coordinates), and "active" location, e.g. inference of location through indirect measures and correlations with historical databases.

Afaik it's now a system-wide setting to disallow said correlations, but offering app developers more fine-grained control would be better for all of us. Why does, for example, my Sony Bluetooth headset need my location just for updating some firmware..

It's practical and also Apple does, but it's confusing for most users. I wish both platform explaining why it's bundled on the screen. Maybe create a permission only able to connect specific OUI would be a solution?

I believe that with the latest version of Android, and on supporting handsets, only Bluetooth is needed. Fraid I can't recall where I read it.

I assume and hope

It's sad we got the the point the customers are afraid their devices are selling them this badly, because you can't even tell if your settings have the effect you think they should have.

I installed GrapheneOS a few weeks ago. The first thing I said to someone that asked about it is "for the first time my phone isn't my enemy".

OK the second thing was "but I can't do almost anything with it :D "

Many people would be fine with the trade-off _if they knew they have to/they could take it_.

Google and the likes have made it very difficult for you to be even aware that was an option.

I don't agree. The information is there, even the YouTube algorithm (the last part of my life that isn't deggogled) is recommending me degoogling videos!

People just don't care enough, even among my fellow geeks I had to "battle" to get them to install Signal because I couldn't use WhatsApp anymore.

We are bombarded with news about revolting situations and at one point there's so much outrage one can take. So the Evil Big tech spying is very low on the list of most people especially since they don't see the damage.

Reply on news.ycombinator.com