Hacker News Reader

Comment by sneak | Hacker News Reader

It is becoming increasingly evident to me that having location APIs enabled on smartphones is an accident waiting to happen. As of about a year ago, location services are disabled at the OS level on all of my mobile devices.

View on HN

There’s situations where it makes sense. Third party mapping software for one. Imagine the uproar (and possible lawsuit) if Apple allowed their Maps app access to the location, but not third party apps like Google’s.

The solution isn’t to turn off location services, but to use permissions so that only apps I approve can have access to it. Both iOS and Android have that feature.

There is no way or permission on (standard) Android to grant a trusted app access to your location, without granting it to Google first.

Really? That sounds downright abusive. What next, not allowing disk read/write permission, without also giving it to Google?

There's a very interesting thing going on with this: what they mean is, Android location requests go through the location API provider on the phone, and Android phones the US is familiar with are content to roll with Google's location API

Does that mean Google also gets that location data?

LineageOS as an alternative os?

LineageOS ships with Google’s location services. Plus, Google has changed the way that third-party location services have to be installed in Android. Now, they have to be installed as a system app, not as a normal app. This requires knowledge of how to use the command line over ADB, and you also have to install some special files that allow your custom-installed location services to survive system upgrades.

So, I have Mozilla location services running on my LineageOS phone instead of Google’s, but only because I'm that tiny minority of nerds who knows how to do all that. Ordinary people might prefer to simply install MicroG’s fork of LineageOS, which avoids Google outright and provides third-party location services.

I wonder how it works on Huawei phones that shipped with Android after they weren't allowed to ship with Google services. I think P40 was the last phone to ship with Google services?

Lineage breaks the Android security model.

I'd use GrapheneOS where possible. Consider making it possible where it's not.

No, systemwide location stays off. It transmits your ip+location mapping to Apple or Google whenever it's on (via the WiFi triangulation lookup), even if you've granted no apps location permission. Any subsequent requests from that IP for the next while can be assumed to be in the same location, precisely geolocating requests from your other devices on the same connection as well.

I would prefer Apple and Google not receive my 24/7 tracklog. I don't believe that I need to have anything to hide to say that I don't think it's reasonable for an advertising company to know where I am 24/7/365.

The problem is people just hit accept without understanding what is happening. The problem requires a legal solution. It should just be plain illegal to collect the users location for anything other than providing the features the user expects and any extra use of that data should not be permitted.

Personally I wasn't losing any sleep before knowing apps might be sending location data to advertisers. Why should I even care? But now what I find obnoxious is being nagged about explicitly approving every little permission to every app, even having to wait until the app wants to use it to approve it which was an especially stupid change. And now I don't even get to let apps use location data all the time from most menus, and when I do I get nagging reminders from Samsung trying to scare me into turning it back to "only when in use." The model on Windows where a program can do things a program should be able to do without asking was completely fine and discrete permissions for apps are an obnoxious waste of time in my opinion.

Reply on news.ycombinator.com