Oops: Google admits failing to wipe all Android apps with location-tracking X-Mo | Hacker News Reader

Oops: Google admits failing to wipe all Android apps with location-tracking X-Mo

theregister.com

87 pointsbased226 comments

This is whack-a-mole at best. Another lib will replace this one.

The real problem is corporations trying the destroy the open web, again. We had AOL and CompuServe, now we have app stores. Consumers have been conditioned to install apps for basic things, just so they can slurp up their data.

Unfortunately this round of internet-killers are much better funded. The open web won in the past, but there is no guarantee it will win this time.

The same companies that gave us the App Stores gave us a switch that lets us disable all location functionality on our device.

After literally years of ignoring obvious abuse. But yeah, we finally have it.

No, the ability to completely disable GPS and location has been in every mobile OS since the beginning, as far as I can recall.

Ah, that's what you were referring to. Fair enough.

Though TBH I suspect that was added purely because it's a significant source of battery-drain.

> Consumers have been conditioned to install apps for basic things

It's an unfortunate development, but I wouldn't call it "conditioning", it didn't really look like a coordinated plan - just a textbook case of people with good intentions paving a shiny road to hell. Native apps are intrinsically superior to the web experience; this is true on mobile and desktop alike. The push to native apps came before tracking was so widespread, developers just wanted people to have a great experience.

Unfortunately, the amount of private data exposed by mobile platforms (and one of the two platforms being owned by an advertiser interested in such data) is so much more valuable than what was ever exposed on desktop... when this fact became common knowledge, consumers were screwed.

Google has nothing to gain from people being conditioned to use apps. Google makes most of its money from people using the real web.

They get 30% of sales made on all apps

Which is a minuscule fraction of what they make from ads on the web.

One question: On Android, when I disable access to location for a specific app, does the library have a way to access the location anyway? My belief is that no, that it can't do that, but I may be wrong.

What if library "A" is included in a background app with access to location services, it then locally broadcasts via UDP or listens on a TCP port for incoming local connections, so that a library "B" can either listen to those UDP broadcasts or connects to the local TCP port of library "A" to receive the location data. Is this a possible scenario? Is Android monitoring such a behavior?

Sure it's possible, and I don't think that's part of the security model. If you're letting app/library "A" access your location, you're trusting it. If you're worried that it might send that data to your worst enemy, you should disable access for library A.

And run that application in a different Android profile - very valuable step.

It is becoming increasingly evident to me that having location APIs enabled on smartphones is an accident waiting to happen. As of about a year ago, location services are disabled at the OS level on all of my mobile devices.

There’s situations where it makes sense. Third party mapping software for one. Imagine the uproar (and possible lawsuit) if Apple allowed their Maps app access to the location, but not third party apps like Google’s.

The solution isn’t to turn off location services, but to use permissions so that only apps I approve can have access to it. Both iOS and Android have that feature.

Personally I wasn't losing any sleep before knowing apps might be sending location data to advertisers. Why should I even care? But now what I find obnoxious is being nagged about explicitly approving every little permission to every app, even having to wait until the app wants to use it to approve it which was an especially stupid change. And now I don't even get to let apps use location data all the time from most menus, and when I do I get nagging reminders from Samsung trying to scare me into turning it back to "only when in use." The model on Windows where a program can do things a program should be able to do without asking was completely fine and discrete permissions for apps are an obnoxious waste of time in my opinion.

The problem is people just hit accept without understanding what is happening. The problem requires a legal solution. It should just be plain illegal to collect the users location for anything other than providing the features the user expects and any extra use of that data should not be permitted.

There is no way or permission on (standard) Android to grant a trusted app access to your location, without granting it to Google first.

LineageOS as an alternative os?

LineageOS ships with Google’s location services. Plus, Google has changed the way that third-party location services have to be installed in Android. Now, they have to be installed as a system app, not as a normal app. This requires knowledge of how to use the command line over ADB, and you also have to install some special files that allow your custom-installed location services to survive system upgrades.

So, I have Mozilla location services running on my LineageOS phone instead of Google’s, but only because I'm that tiny minority of nerds who knows how to do all that. Ordinary people might prefer to simply install MicroG’s fork of LineageOS, which avoids Google outright and provides third-party location services.

I wonder how it works on Huawei phones that shipped with Android after they weren't allowed to ship with Google services. I think P40 was the last phone to ship with Google services?

Lineage breaks the Android security model.

I'd use GrapheneOS where possible. Consider making it possible where it's not.

Really? That sounds downright abusive. What next, not allowing disk read/write permission, without also giving it to Google?

There's a very interesting thing going on with this: what they mean is, Android location requests go through the location API provider on the phone, and Android phones the US is familiar with are content to roll with Google's location API

Does that mean Google also gets that location data?

No, systemwide location stays off. It transmits your ip+location mapping to Apple or Google whenever it's on (via the WiFi triangulation lookup), even if you've granted no apps location permission. Any subsequent requests from that IP for the next while can be assumed to be in the same location, precisely geolocating requests from your other devices on the same connection as well.

I would prefer Apple and Google not receive my 24/7 tracklog. I don't believe that I need to have anything to hide to say that I don't think it's reasonable for an advertising company to know where I am 24/7/365.

App stores protect the products built by OS vendors, they do nothing for users.

Reply on news.ycombinator.com