Hacker News Reader

Comment by huhtenberg | Hacker News Reader

Here's a funny bit.

Roomba iOS app refuses to go past its welcome screen unless its granted access to the location info.

This is unreasonable, they don't need this info for their app to function.

However their devices are all but unusable without an app, so they ultimately blackmail people into giving location data to them.

Meaning they don't really give a sh#t about users' privacy, so it's not that "they are watching you", but that they won't think twice about hooking up to a random Roomba and shooting a video with it. Consent or not.

View on HN

And, so, did you do the right thing and return it or did you just accept and therefore effectively indicate to Roomba by your actions that you're ok with it?

I've returned several "smart" devices that required an app and an account. One example is GoVee smart blubs. As soon as they refused to work without an account I sent them back. Another is some Meross smart outlets. I retuned them for Eve Energy outlets.

An approach that has worked for me is to ensure that any smart devices I buy are supported by Tasmota. I just flash the Tasmota firmware as step-1, then pair the devices with HomeAssistant. Doesn't necessarily send the direct message that returning it does, but at least I can avoid the unnecessary telemetry/tracking.

> And, so, did you do the right thing and return it or did you just accept and therefore effectively indicate to Roomba by your actions that you're ok with it?

The burden is on them to not perform those actions, not on me.

I should be fully entitled to make use of the product without agreeing to any additional contracts or permissions.

You should be, but you’re not.

Many consumer protection laws would disagree. Also check out the Andino v. Apple ongoing lawsuit

How I deal with this: I don't install the app. They still work pretty well without. I did recently buy one that has great Valetudo support, but for now the flash instructions are a bit too complicated with respect to the fact it works well without setting up apps or internet connection.

I returned my $4000 LG TV after 2 years of use, as they suddenly tried to force me to agree to a new set of T&Cs and privacy policy. I called them and they told me that there's no way for me to continue using the TV without agreeing. Incredibly illegal (in my country), but I doubt most people notice or care.

The app always tries to explain that location is “required” for Bluetooth/WiFi pairing in my experience, can someone more knowledgeable confirm if this is an iOS/Android limitation or are app developers blowing smoke to get this data from users during setup/onboarding networked devices

I don't have a Roomba (or have used their app) but when something annoyingly insists on my location to setup/install, I just hit "Allow Once" with "Precise: Off" just to get past that screen. Then you can turn off the Location Services to "Never" for that app in Settings straight after. Not perfect but good enough?

This can be fixed by an app update as they may check each time you open the app whether they have the required permissions or not.

Turning off “Precise location” can help with those apps, they’ll just get a vague location

I was talking about the parent comment's workaround to disallowing the location access permission after allowing it the first time.

Pair the roomba with home assistant and you wont need the app at least for day to day activities. Home Assistant is more responsible because its talking direct to the device IP address instead of using cloud retrocombulators.

Didn't Android have a feature at some point where you could opt to supply it with a fake location? Maybe that was 'hacked' Android phones.

Either way, Android (and iOS) should be stricter about these things; apps should work without any permissions. I mean a navigation app without location access won't work very well and permission can be denied by accident, but that can be resolved.

The dishwasher I got was the same, the app wanted access to location at all times (precise not approximate).

If I disabled the permission it would stop working.

So I switched to the home assistant integration for it and removed the app from my phone.

Why on earth would a dishwasher need an app? You have to load it before you start it... later, you walk by, it's done, you unload it.

My friend's stove has an app... "Oh shit the milk is boiling over, quick get the phone, unlock it, tap the app icon, wait until it's loaded, navigate to the proper submenu and turn it off!"

Best thing it's he didn't even know at first. He bought a new washing machine that had app support, so out of curiosity he installed the app and scanned for devices, but the app only found his stove.

Technology was a mistake.

The main use cases are around notifications - it's done, it needs X/Y consumable, A/B maintenance, etc.

And with location data, turning it on when leaving the house.

Another smart scenario I can think of, link it with energy prices and a real-time dynamic energy contract, and/or solar panel output or battery charge levels, to only run it when it's cheapest to do so.

Of course, that means having it stand-by to run at all times, meaning it may run half-empty and you need to keep the door closed which will cause mold etc.

I'm pretty sure it's to enable a feature where it can turn on when you leave the house. However, that should be an optional feature, with them only asking for location tracking when you actually enable the option.

Should be, but here's the thing: they don't want to build the best app or customer experience through convenient features, they want your (location) data, because aggregated, that shit is worth more than the stupid dishwasher.

They don't make money on selling dishwashers anymore; components, shipping, marketing and middle men will swallow up any profit. But location data and subscriptions will bring in the real money, over a long and continuous period of time.

See also this story from a Twitter engineer who talked to mobile phone companies that were prepared to pay big money for location data; I can't find the source anymore, but it's been reposted on various outlets: https://hindupost.in/media/an-ex-twitter-engineer-reveals-ho...

> Roomba iOS app refuses to go past its welcome screen unless its granted access to the location info.

Does anyone know, is this like Android where some bluetooth functionality is behind the location permission?

Not Bluetooth, but you need(ed?) location permission to send/receive some broadcasts. I have a remote app that needs location permission to send a broadcast searching for TVs, so I have it set to “ask me every time” and imprecise location. (Which on iOS is about a whole city wide)

There’s a specific “local network” permission nowadays so maybe it was the older permission API because you can deduce location from MAC addresses?

You need location to scan for Bluetooth in app, because scanning for Bluetooth was how advertisers got your location. You don’t need this to interact with a Bluetooth device, the user can connect to it from the settings.

And if it's a Bluetooth Low Energy device that doesn't use connections?

Especially if it's BLE. Commercial sites are full of tags that advertise their MACs. Phone app reads this and use it to deduce where you are. You can try something similar yourself with WiFi using Google geolocation API.

Not sure about iPhone, but on Android, the permission to let apps pair things in surroundings using BT/WiFi is included in the location permission.

You can't pair anything with an app unless you turn the location on. Main feature of the Roomba app is to pair a vacuuming robot using phone's wifi and a special wifi network between phone and vacuum.

So while it's not a perfect solution to block you from going further, you can't really be that paranoid about them asking for that access. And ofc, I'm sure your location flew to the iRobot servers along with your other details that could've been scraped from starting the app on your phone.

edit: added paragraphs for readability.

You can pair Bluetooth with location off, but not Bluetooth Low Energy devices. But it's even more complex in reality, depending on the Android version, see here:

https://source.android.com/docs/core/connect/bluetooth/ble

I have a few Roombas and no app. I just hit the button and the robot does its thing.

More often than not just one or two rooms need cleaning, but not the whole place. Can't do that with a button press.

I see. I don't live in big enough place, perhaps. I just fire it off and don't think.

I close a door or put a box in its way. No app.

Has that happen to me with a gifted watch. I returned it and got a basic casio

This sucks, and it would normally be Apple's App Store duty to remove an app that requests unreasonable access to the device's details.

Is iOS like Android where Bluetooth permissions are a part of the location info permissions?

No.

Out of spite I took the iPad to a friend's house, enabled location, clicked through the welcome screen and disabled it again. Then came back home and hooked up the device.

So, no, it's not linked to its BT needs at all.

How did you connect your device to your wireless network?

Friend clearly didn't live very far away

And therefore the location was within range of the WiFi network, not really netting a privacy gain, if at all? Especially since SSID databases exist and are used for more accurate location detection.

iPad with mobile data?

You connect to it via BT first and then configure WiFi details.

That actually changed in Android 12. Now there is a nearby devices permission that doesn't require GPS access

Meanwhile, privacy watchdogs are sleeping. They have responsibility too.

That’s really annoying but can’t you use use the “while using the app” permission? Or do they insist on “Always”.

And I am not sure I buy the “anyone who does one bad thing will necessarily do all of the bad things” view.

Why would I want them to know where I live? It's just a thing that sucks dirt of my floor.

And that's without getting into why it must have an Internet connection (to enable a large chunk of its functionality). It has a Bluetooth, it is perfectly capable of talking to the smartphone using it, but it can't be controlled that way.

Re: bad thing - not a "bad thing" per se, just a very cavalier attitude, which is as troubling.

Bluetooth won’t cover my whole house, but wifi can. It’s a heck of a lot easier and cheaper to route through the internet.

Reply on news.ycombinator.com