5 ms·

As a slightly related side note, I pretty much only turn on bluetooth when I actually need to use it (which is rarely, such as syncing my Garmin every now and t

As a slightly related side note, I pretty much only turn on bluetooth when I actually need to use it (which is rarely, such as syncing my Garmin every now and then). It's a waste of battery power to keep it on, and Bluetooth is also often used to track people. For example, it's used by traffic monitoring systems to measure the speed of traffic[1] by storing and tracking the MAC address. It would be nice if Android and iOS provided a convenient way to activate Bluetooth temporarily, only when needed. [1]: http://www.tyco-its.com/products-and-services/urban-traffic-control/bluetooth-travel-timespeed-measurement-system http://www.tyco-its.com/products-and-services/urban-traffic-...

sillysaurus3 9y ago
It's already patched Well, yes. But how long has the exploit been effective? It's certainly noteworthy. A coworker once demo'd a metasploit module capable of taking over a Windows 7 machine. The vuln had long since been patched, but apparently it was still useful in the field sometimes because people hadn't bothered to upgrade every workstation.
flachsechs 9y ago
> convenient way to activate Bluetooth temporarily, only when needed the slide-up menu in ios is pretty convenient.... you can do it when the phone is locked, even. i use it all the time to disable and enable wifi and bluetooth and use the flashlight.
- brndnmtthws 9y ago
  It'd be nice to use NFC to temporarily activate Bluetooth for a given device, for the duration of use. Even better if it generated a random MAC address every time you established the connection, and handle auth entirely in userspace through encrypted channels. You could bypass the stupid Bluetooth auth.
  - tedunangst 9y ago
    Plus an option to temporarily enable and disable the NFC radio!
- Ajedi32 9y ago
  I assume GP must mean even _more_ convenient than that, since Android also has a settings panel you can pull down with the same functionality.
- retox 9y ago
  >you can [activate bluetooth] when the phone is locked Is there any way to disable that 'feature'? Seems like an unnecessary risk.
barrkel 9y ago
The battery power wasted is negligible (it's unnoticeable in the noise that makes me go from 100% at midnight to ~55% by the end of the day). I connect to two different bluetooth devices; my helmet intercom (for phone calls, podcasts and music while commuting) and my headphones (normally for podcasts while doing housework or motorcycle maintenance). Needing to toggle settings on two different devices before connection would be more tedious than just one.
- TeMPOraL 9y ago
  Same here. I keep BT on for the Pebble I use, and the battery usage is negligible.
rando444 9y ago
It's slightly related, and only to people with your specific use case. The amount of people that would use "temporary bluetooth" is so small, that adding it would not be wise as it would confuse the majority of average users. Most people that leave their bluetooth on do so because they have bluetooth headphones or devices they use regularly like their car stereo/phone link. If you're worried about tracking or power consumption, turn your bluetooth off when you're not using it. Trying to get the rest of the world to conform to your use case is not practical and would only introduce problems with little benefit.
- brndnmtthws 9y ago
  That sounds like an opinion rather than a fact. Do you have any data that shows most people actually use Bluetooth 100% of the time? Speaking anecdotally, none of my friends use it, except occasionally. Most people I know (including myself) don't give a shit about Bluetooth, or computer gadgetry for that matter. People just want their battery to last until the end of the day so they can keep refreshing Instagram, send/receive chats, and check the time.
  - djrogers 9y ago
    First of all, this attack sin't constrained to smartphones - it would be folly to ignore the hundreds of millions of laptops/desktops that use bluetooth mice and keyboards in every office. Second, most people I know with smartphones have bluetooth headsets, car stereos, or Apple watches that use bluetooth. Turning BT on every time you want to use those isn't terrible (swipe up control center, tap BT icon), but it does get old.
    - brndnmtthws 9y ago
      Fair enough, although I don't think I've ever used Bluetooth on my Macbook. It's unreliable and a pain to pair devices, so it's pretty much always easier to just plug a cable in, or connect over WiFi (if possible). Bluetooth is the Microsoft Bob of connectivity.
notduncansmith 9y ago
Not that there aren't other signals, but iOS will periodically change your MAC address for privacy. It's still good to keep WiFi and Bluetooth off for battery and security.
- pat2man 9y ago
  BLE uses so little power its insignificant. WiFi can actually save power if you are using cellular data. There is not one size fits all solution here.
jhoechtl 9y ago
What do you mean by temporarily? You mean automatically? Because both on iOS as well as Android its both very accessible to turn it of or on.
- flanbiscuit 9y ago
  My guess is that allow an app to turn it on/off as needed. I have a Pebble watch so I need the bluetooth on. Right now it's either always have the Bluetooth on or I don't use the watch. So I'm assuming that they meant that there could be a way to allow an app (or the OS handles this) to start up bluetooth, pair, send its message, then turn off. Like some form of Push Notification style Bluetoothing. That seems like it'll just add a whole bunch of more problems but I'm sure there are smart people out there that can figure it out.
ams6110 9y ago
I do the same, because as a general security practice, if I don't need it, I disable it. I can't recall the last time I used bluetooth for anything.
fencepost 9y ago
> It would be nice if Android and iOS provided a convenient way to activate Bluetooth temporarily, only when needed. I can't speak about iOS, but if you're willing to do a little tweaking there are multiple ways to do this on Android devices. The simplest is probably with "Llama - Location Profiles" though it's no longer actively developed. Disable or edit the default profiles that shift your phone to quiet, etc. and create your own that toggle wifi, Bluetooth, etc based on events or on a widget you create. The Bluetooth toggle action lets you specify on/off/on for X minutes, etc. The only issue I might see there is if a fitness tracker is seen as a connected device as far as Android is concerned. I'll note that mine does not show up on the list of devices. The more maintained option would be doing something similar with Tasker, but I haven't tried it. Tasker can be triggered by NFC using something like "NFC ReTag Pro", and Llama can have a trigger based on an NFC tag as well.
BrandoElFollito 9y ago
I use Tasker on android for this and many other similar tasks.
rcthompson 9y ago
I think a reasonable implementation of this would be a "manual connections only" mode, where Bluetooth is always kept off until you enter the Bluetooth connection menu, at which point it turns on and scan, and connects only to the specific device(s) you tell it to connect to. And then once the last Bluetooth device is disconnected, Bluetooth is deactivated once again (perhaps after a short delay to allow for reestablishment of a shaky connection).

sillysaurus3 9y ago

It's already patched Well, yes. But how long has the exploit been effective? It's certainly noteworthy. A coworker once demo'd a metasploit module capable of taking over a Windows 7 machine. The vuln had long since been patched, but apparently it was still useful in the field sometimes because people hadn't bothered to upgrade every workstation.

flachsechs 9y ago

> convenient way to activate Bluetooth temporarily, only when needed the slide-up menu in ios is pretty convenient.... you can do it when the phone is locked, even. i use it all the time to disable and enable wifi and bluetooth and use the flashlight.

brndnmtthws 9y ago
It'd be nice to use NFC to temporarily activate Bluetooth for a given device, for the duration of use. Even better if it generated a random MAC address every time you established the connection, and handle auth entirely in userspace through encrypted channels. You could bypass the stupid Bluetooth auth.
- tedunangst 9y ago
  Plus an option to temporarily enable and disable the NFC radio!
Ajedi32 9y ago
I assume GP must mean even _more_ convenient than that, since Android also has a settings panel you can pull down with the same functionality.
retox 9y ago
>you can [activate bluetooth] when the phone is locked Is there any way to disable that 'feature'? Seems like an unnecessary risk.

barrkel 9y ago

The battery power wasted is negligible (it's unnoticeable in the noise that makes me go from 100% at midnight to ~55% by the end of the day). I connect to two different bluetooth devices; my helmet intercom (for phone calls, podcasts and music while commuting) and my headphones (normally for podcasts while doing housework or motorcycle maintenance). Needing to toggle settings on two different devices before connection would be more tedious than just one.

TeMPOraL 9y ago
Same here. I keep BT on for the Pebble I use, and the battery usage is negligible.

rando444 9y ago

It's slightly related, and only to people with your specific use case. The amount of people that would use "temporary bluetooth" is so small, that adding it would not be wise as it would confuse the majority of average users. Most people that leave their bluetooth on do so because they have bluetooth headphones or devices they use regularly like their car stereo/phone link. If you're worried about tracking or power consumption, turn your bluetooth off when you're not using it. Trying to get the rest of the world to conform to your use case is not practical and would only introduce problems with little benefit.

brndnmtthws 9y ago
That sounds like an opinion rather than a fact. Do you have any data that shows most people actually use Bluetooth 100% of the time? Speaking anecdotally, none of my friends use it, except occasionally. Most people I know (including myself) don't give a shit about Bluetooth, or computer gadgetry for that matter. People just want their battery to last until the end of the day so they can keep refreshing Instagram, send/receive chats, and check the time.
- djrogers 9y ago
  First of all, this attack sin't constrained to smartphones - it would be folly to ignore the hundreds of millions of laptops/desktops that use bluetooth mice and keyboards in every office. Second, most people I know with smartphones have bluetooth headsets, car stereos, or Apple watches that use bluetooth. Turning BT on every time you want to use those isn't terrible (swipe up control center, tap BT icon), but it does get old.
  - brndnmtthws 9y ago
    Fair enough, although I don't think I've ever used Bluetooth on my Macbook. It's unreliable and a pain to pair devices, so it's pretty much always easier to just plug a cable in, or connect over WiFi (if possible). Bluetooth is the Microsoft Bob of connectivity.

notduncansmith 9y ago

Not that there aren't other signals, but iOS will periodically change your MAC address for privacy. It's still good to keep WiFi and Bluetooth off for battery and security.

pat2man 9y ago
BLE uses so little power its insignificant. WiFi can actually save power if you are using cellular data. There is not one size fits all solution here.

jhoechtl 9y ago

What do you mean by temporarily? You mean automatically? Because both on iOS as well as Android its both very accessible to turn it of or on.

flanbiscuit 9y ago
My guess is that allow an app to turn it on/off as needed. I have a Pebble watch so I need the bluetooth on. Right now it's either always have the Bluetooth on or I don't use the watch. So I'm assuming that they meant that there could be a way to allow an app (or the OS handles this) to start up bluetooth, pair, send its message, then turn off. Like some form of Push Notification style Bluetoothing. That seems like it'll just add a whole bunch of more problems but I'm sure there are smart people out there that can figure it out.

ams6110 9y ago

I do the same, because as a general security practice, if I don't need it, I disable it. I can't recall the last time I used bluetooth for anything.

fencepost 9y ago

> It would be nice if Android and iOS provided a convenient way to activate Bluetooth temporarily, only when needed. I can't speak about iOS, but if you're willing to do a little tweaking there are multiple ways to do this on Android devices. The simplest is probably with "Llama - Location Profiles" though it's no longer actively developed. Disable or edit the default profiles that shift your phone to quiet, etc. and create your own that toggle wifi, Bluetooth, etc based on events or on a widget you create. The Bluetooth toggle action lets you specify on/off/on for X minutes, etc. The only issue I might see there is if a fitness tracker is seen as a connected device as far as Android is concerned. I'll note that mine does not show up on the list of devices. The more maintained option would be doing something similar with Tasker, but I haven't tried it. Tasker can be triggered by NFC using something like "NFC ReTag Pro", and Llama can have a trigger based on an NFC tag as well.

BrandoElFollito 9y ago

I use Tasker on android for this and many other similar tasks.

rcthompson 9y ago

I think a reasonable implementation of this would be a "manual connections only" mode, where Bluetooth is always kept off until you enter the Bluetooth connection menu, at which point it turns on and scan, and connects only to the specific device(s) you tell it to connect to. And then once the last Bluetooth device is disconnected, Bluetooth is deactivated once again (perhaps after a short delay to allow for reestablishment of a shaky connection).