Hacker News Reader

Comment by karmakaze | Hacker News Reader

On my Android 12 phone, I have the following things disabled:

  - [ ] Location
    - Improve location accuracy
      [ ] Wi-Fi scanning
      [ ] Bluetooth scanning
  - [ ] Google location accuracy
  - [ ] Google location history
  - [ ] Google location sharing
  - App-level permissions
    - Allowed all the time: None
    - Allowed only while using app: Maps, Lyft, Uber, Uber Eats

What's funny is when searching "location" in settings is that the "Google ..." ones aren't listed and have to be hunted down manually under Location/Location services.

I sometimes temporarily enable Location, but most often I'll just enter addresses manually into the apps and dismiss any requests for location access.

Of course anything with internet access can still guess location based on the public IP address used to connect to any server. Maybe a VPN could help, but then you have to trust that party too.

View on HN

Regardless of all of that, your phone provider is selling your location data derived from triangulated cell tower positioning.

https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wire...

I don’t see enough talk about this. I thought someone would have hacked up a solution to this by now.

But a solution is basically not possible, short of running your own cellular network. By definition the the carrier has to know where to send the data that your handset wants, and once they know which tower you are going out of, they know your location to within a small degree.

No SIM card in your main phone (now only a "pocket computer"), burner phone for calls.

How does this work for eSIM?

American Privacy Rights Act of 2024 is a potential solution.

https://www.commerce.senate.gov/2024/4/committee-chairs-cant...

https://www.commerce.senate.gov/services/files/3F5EEA76-5B18...

For Americans in America, maybe. Hardly a solution for most people though.

Have a loot at Purism AweSIM service.

Also see https://en.wikipedia.org/wiki/Simjacker which was being exploited by bounty hunters and all kinds of adversaries

> anything with internet access can still guess location based on the public IP address used to connect to any server.

Not to mention Chrome & friends will gladly provide wifi-based location lookup to any site that asks for location. You can have GPS off, using a VPN, and still the website will know where you are. Turn it off, sure, then the site can block you.

Tried to get around my states online casino restrictions a few months back. Not a fun time.

> Turn it off, sure, then the site can block you.

Yes? Is this a problem?

> Tried to get around my states online casino restrictions a few months back. Not a fun time.

How is any casino both (A) following state restrictions and (B) not validating based on both your geo location and the address you must validate via some KYC document? Or are you also entering a fake address somehow?

> Yes? Is this a problem?

Yes, because I am trying to use the site. If they block me, I can't use it.

They validate, usually via a backend SSN lookup or via an identity document like ID or passport, but only on registration. Sometimes they make you take a selfie with your ID. Sometimes you get flagged and have to identify again.

In Michigan you are allowed to use the site from any location, there are restricted actions which must be location verified. Sports wagering and any casino gambling obviously, but I think deposits or withdraws might be location limited as well.

The location verification is accomplished via both a dedicated program you must install on your device + giving location permission in the web browser, which uses GPS + Cellular + Wi-FI triangulation.

> Or are you also entering a fake address somehow?

You are allowed to use the online casino's with an out-of-state ID or address. You must simply be in the state for location verification. There is a little industry of people taking road or train trips to travel through all the online gambling states in order to sign up for the free promotion money.

For anyone wanting to know what I tried and how it ended:

This was on a laptop with no built-in GPS and no cellular.

Paid VPN - nope, they probably have a list of all the VPN providers IP addresses.

Self-VPN in cloud - no, again they probably have an IP list

Self-VPN in target state on residential IP - nope, something else causing the fail

Spoofing WiFi names & IDs in the environment of the residential IP above, both from online databases and having someone there do a scan - nope, I think the problem here was the networks in range of the laptop were lowering the confidence of the location check

Finding a browser that doesn't incorporate WIFI triangulation - none that I could find, including all the privacy-focused browsers like Brave. They let you turn off location, but none let you disable the wifi component.

At this point my thoughts were that I would have to find/write a custom driver or find some other way to get the wireless card to lie about which networks are nearby.... or find a way to crack the casino location service executable AND patch a browser not to rat on me.

There is no other sources of leaks from what I could tell. No other signals being detected by my laptop, no DNS or VPN leaks, it had to be the Wi-Fi triangulation.

I didn't want to do all that so instead just left a PC at home hooked up to a PiKVM and it worked perfectly.

edit: Forgot to mention you must have Wifi on the device or else it will block and ask you to enable it.

Did you try on a laptop without wifi enabled?

I added an edit at the bottom, not sure if you caught that on your page load. Wifi off or disabled is insta blocked.

Oh yeah I missed that. So a desktop computer can't play? Lame.

Ya know what, I didn't actually test that but I would assume. I've been on a laptop for awhile and all my desktops have either a wifi card or its build into the motherboard.

I did disable the driver and tried to make my laptop act as if it didnt have WIFI at all, but I don't see how they could protect a desktop from what I was attempted above without WiFi access.

>Self-VPN in target state on residential IP - nope, something else causing the fail

might be caused by the VPN connection reducing the MTU, and the server detecting that.

Oh yes, good point. I'll try when I'm back home, currently in a no-online-gambling state.

As a tangent, I know there are googlers here, but I have always been curious to how low-level google and the rest of FAANG inspects connections.

There is ton's of data being leaked about which device or library or application or network you are using to connect to a service via these low level protocols and encryption schemes.

examplelib1.0 might reply to an ICMP before completing some other part of the state diagram while in 2.0 its reversed. Or maybe the 2.0 handshake takes 2x as long on average. Quirks they might be called elsewhere.

Most people and developers aren't going to care or research or profile this, but I can only imagine with enough resources and risk on the line - this becomes important information to stopping spam or fraud and abuse.

Can you run the betting app in an Android emulator, and then control all aspects of the environment?

I did not but this could work too. I'll have to give it a try. Seems to be a bunch of methods to detect if an app is being run inside an emulator but it does appear they can all be faked as well.

I must have been so focused on getting access to the desktop sites I didn't even think about the app.

To be fair, apple has a similar approach, you can't fully turn off Bluetooth or wifi if you press on their corresponding widgets (they only become inactive), you have to go to the settings to turn them off. As for location, you can't even do so without going to the settings.

I've done the same. It is extremely annoying that there's no concept of graceful fallback in modern operating systems. For example, Google Pay on Android can work without location enabled but whenever you start the app, it is the first thing that it prompts you for (even before asking fingerprint or passcode unlock that you've set on it)

You're still giving it away by which merchant you're transacting with.

Be 100% sure by leaving your smartphone at home. Checking WhatsApp & Co once daily is enough.

This just isn’t practical for anyone with kids, etc.

I wonder how people checked in on their kids in the 90s, before smartphones were a thing?

Tried it, alas, without success -Two big factors: 1. the infrastructure that made this possible in the 90s isn’t there anymore (at least in my part of the world). 2. The surrounding world requires information exchange at physical boundaries. These too have now been “digitized”.

Where might we turn to?

The family could all get their amateur radio certification/license and communicate over great distances, for free, without any subscription fees, tracking, etc. :) Sounds like I'm joking but honestly with the presence of repeaters everywhere around any metropolitan area, establishing communication would be trivially easy (especially with agreed-upon "time windows" during which to listen for each other and/or to check in).

I grew up in the 90s. If plans deviated from what we decided before I left the house, it was a huge chore to communicate with parents. It involved finding a pay phone, then calling a list of different numbers to try to catch parents at the office or home or wherever they might be. And it sucked.

It’s weird to think that anyone would hold this up as an example of the good old days. Rose colored glasses in effect.

Notably, pay phones don’t exist anymore, so you couldn’t actually replicate the 90s era communication if you wanted to.

Pay phones are not prevalent in the USA, but they do exist. https://www.payphone-project.com/numbers/usa/

Some countries actually support pay phones. They're amazingly useful during disasters when mobile networks may not be functioning.

Example: Japan, but they're contemplating reduction. "city areas are required to have a public pay phone installed every 500 square meters, with non-city areas every kilometer. " https://japantoday.com/category/features/lifestyle/the-end-o...

If your local region doesn't have a lot of pay phones perhaps it is time to consult the local government. Change can start at the bottom.

OP was almost certainly saying "don’t exist anymore" to indicate that you can't rely on them to be at every corner gas station (or similar) anymore, thus making them obsolete for such a purpose as checking in with relatives. Their obscurity means you'll be unlikely to find them unless you're close enough to something like a full-service truck stop, which I've observed tend to still have payphones.

also grew up in the 90s and plans usually didn't deviate from the plan because there was no way to communicate.

ppl just showed up, or didn't

> Checking WhatsApp & Co once daily is enough.

That is strongly dependent on your social circles, and is also a rather small subset of what smartphones are used for.

Reply on news.ycombinator.com