66 ms·
Google collects cell tower info even if location services are disabled
- iirirjn888 9y agoI’ve always assumed location services = GPS Meaning you can still be triangulated by towers Which I had run legally for LEO at Sprint back in 2003-2005. Towers gotta know where you are to provide service. Don’t want to be tracked? Leave your phone at home. Not saying it’s ideal but it’s how technology works.
- thanksgiving 9y agoIf I turn "airplane mode" on and you still track me, should you face a penalty?
- mtgx 9y agoFigured they would do this and then hide it in Android OS/System so users don't know it was Google's own services draining their battery life the whole time. If only they'd use this data to at least do something useful, like create a machine learning-enabled firewall to block "rogue" cell towers like cell site simulators. But no, of course not, it has to be done only for ads...
- lern_too_spel 9y agoWhere does it say it's for ads? The article says the data was dropped on the floor.
- kop316 9y agoI am running Android 7.1.2. I remember in the older versions of android, when you turned off the GPS, it would have to manually sync the receiver and it would take minutes to get GPS lock. In the current version, when I turned off location services, there is no "dot" indicating your location on Google Maps, but it appears almost instantly when you turn it off. I have long suspected that Android has the "coarse location" and "GPS location" always tracking, but merely just does not give Apps the data until location services is turned on.
- mikeash 9y agoThere are other strategies for getting a lock faster. Most of the slowness for a cold start with a modern receiver is receiving the ephemeris data (i.e. where the satellites are at the moment), which is transmitted at a whopping 50 bits per second, and so takes about 30 seconds to receive. Once you have that, the rest comes quickly. Older receivers with less computational power and less clever techniques could take a long time to work out your position after that, but modern ones can do it pretty much right away as long as the signal strength isn't crap. That ephemeris data is good for 2-4 hours, so one simple technique to improve lock times is to save it, and then if you turn the receiver back on within that window, you can reacquire a lock almost instantly using the saved ephemeris data. Another technique is to download the ephemeris data from a source that can provide it more quickly, such as the cell network. This skips that long transmission at 50bps from the satellites themselves. Pretty much any GPS chip in a cell phone these days will do this. This is called assisted GPS, or A-GPS. (This is not to be confused with another technique also called A-GPS, where the GPS chip captures the signal and sends it to the cell tower to offload the computation. This was a popular approach in older phones to comply with 911 reporting requirements, but doing the computations onboard is cheap now.) Starting with a coarse guess of your location can also help shorten the time to initial lock, although it should be fairly short regardless. That guess can come from looking at cell signals along with known cell tower locations, and a rough altitude estimate can be made from the device's barometer. All of which is to say, getting a dot almost instantly when you turn on location services doesn't necessarily mean too much here.
- kop316 9y agoInteresting, thanks for the info! I knew you could do some tricks to get a lock faster with GPS, but I am not sure of all of them.
- throwaway613834 9y agoThere's a way to test that hypothesis. Install a different version of Android on the same phone and see if the behavior still changes. If not, it's a hardware thing. If it does, then dig into the source code to see if anything explains the change...
- jankotek 9y agoQuestion: If I want Android without google services, what options do I have? So far I know only cheap chinese phones and F-Droid app store.
- juliangoldsmith 9y agoLineageOS, the successor to Cyanogenmod, runs on a lot of devices and doesn't have the Google services installed. There's also a fork with replacements for some of the Google services: https://lineage.microg.org/ https://lineage.microg.org/
- tombrossman 9y agoMany of the custom images you can find on XDA Developers do not require that you install Google Play Services. CopperheadOS is a good choice if security is a priority. If you need proprietary apps without using Google, you can install and use Amazon's app store app, and download them from there instead.
- gpvos 9y agoThe Fairphone 1 was shipped without Google services; don't know about the Fairphone 2.
- yosamino 9y agoIt's shipped with Google services, but the updater lets you change to without Google services without hassle.
- grecy 9y agoI used an android for almost a year without logging into anything Google. I can't download apps, but the phone itself works fine, and it came with a bunch of pre-installed apps anyway.
- dingo_bat 9y agoAnd you're still being tracked in the way described in this article. Google play services just needs to be present on your phone. Doesn't matter if you login or not.
- rgrieselhuber 9y agoCertain options should be hardware disable-able and this is one of them.
- falcolas 9y agoWhile I don't disagree with you on any level, why would a hardware manufacturer ever do that? Their customer is the companies selling us phones, and most of those companies want the ability to collect data on their users to use internally or sell for profit. Shareholder profit > all, remember? /s
- jackhack 9y agoThis is an important distinction and deserves repeating: The employees a of company (from executive level, down) work for the Board of Directors, who are a proxy for the shareholders. The employees do not work for the customer. If there is conflict between what a customer wants and what the Board wants, the Board wins.
- bgun 9y agoIt's not even about shareholders - a manufacturer that tried this would cease to exist. Why would an OEM pay for features they don't need or want?
- izacus 9y agoHow would that work? The "location" was the cell tower ID without which you can't be connected to the cell network.
- CaptSpify 9y agoIf I move the hardware switch into the off position, I expect that the cellular connection won't work. I feel like I'm misunderstanding your question.
- ksk 9y agoCell phone companies will probably hand over such info to any government entity to comply with local laws. I suppose with Google they have it a bit easy, because google links your identity to your phone, email, web search, purchases, maps activity, etc. They don't have to issue 20 different legal requests to each provider, and then combine that data. Other than that I don't see how Google collecting this data is bad (if we're to assume that there is a legitimate reason to do so).
- bob_theslob646 9y agoWhy is this a problem? What is the harm of them collecting cell tower information? Is it possible to provide the same quality of service(s) without the cell tower information?
- legohead 9y agobob_theslob646, we have identified you as being the only person around while a murder was committed. We need you to come into the station.
- chronice70 9y agoThey can do that with or without cell phones tracking you.
- jat850 9y agoNot being purposely obtuse, just confused (or unimaginative). How?
- bob_theslob646 9y agoWhat are you afraid of? Correlation does not equal causation.
- dingo_bat 9y agoProblem is that turning off location makes no difference to this location tracking.
- eps 9y agoThis is not surprising in the slightest.
- mindB 9y agoAnother reason to order a Librem 5. https://puri.sm/shop/librem-5/ https://puri.sm/shop/librem-5/
- Tepix 9y agoOr - available right now - a Google Pixel phone with Copperhead OS https://copperhead.co/android/store https://copperhead.co/android/store
- thissiteblows 9y agoPlease avoid giving Google money.
- chrisper 9y agoHmm.. this is the first time I heard of it. Maybe I will give it a try. After all LineageOS does not work on Pixel yet I think
- foobaw 9y agoI believe this was part of either an E911 requirement or CIQ(Carrier IQ) feature. Nothing new and nothing crazy.
- Tepix 9y agoYou are mistaken.
- csours 9y ago> "Although the data sent to Google is encrypted, it could potentially be sent to a third party if the phone had been compromised with spyware or other methods of hacking. Each phone has a unique ID number, with which the location data can be associated." If the phone is compromised, it doesn't matter what google has access to, the tracking kit can just enable it's own tracking and spoof the system status (depending on the level of the compromise) If you have a concern about your phone tracking you, don't bring your phone with you.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- nvr219 9y agoIf you care about personal privacy and security of your friends and family, you should discourage them from using Android.
- growse 9y agoOf course, this is meaningless without context. Privacy from who? Security from what? What's the perceived threat we're trying to protect against? Everything is a tradeoff. To absolutely protect your privacy, you must never be seen in public or interact with any other party in any way.
- Brakenshire 9y agoThis is sophistry, privacy in the sense that a private company is not continuously compiling a list of every location you visit throughout your life.
- growse 9y agoClaiming sophistry doesn't make it so, you have to try a little harder than that. The original assertion was "If you care about privacy, don't use Android". A more nuanced and useful assertion would be this: If you don't trust a specific private company with your information, don't volunteer it to them. If you don't trust Apple/Google/Microsoft with all of your data, don't buy a device with a radio they have root access on and store all your data on it and carry it with you everywhere you go. This isn't Android-specific.
- Brakenshire 9y agoSophistry in the sense that according to any reasonable idea of privacy, meeting someone in public, so that they know where you are, your name and your face, is distinctly different from a private company knowing exactly where you are at all moments. Imagine if it came out that a company had hired private investigators to follow you around, and collected a list of every location you visited. You tell someone else, and they say "if you really cared about privacy, you should not have come out in public, for instance I met you, and now I know your name, and that you visit this place". It is just nowhere near equivalent.
- malchow 9y agoThis would seem to be a fairly monumental breach of the duty Google owes consumers.
- module0000 9y agoedited summary: The 'duty' is owed to shareholders, not to you. That duty is to generate profits and protect shareholders' investment. That's not how commerce works(anymore). You are technically a consumer...and you are fundamentally the "product". Companies buying advertising are the actual consumer - to which you(ie your data) are for sale. If you cannot look at it that way, modern corporate America/Elsewhere will never make sense. There is no free lunch, no company anywhere wants to help you out of sheer kindness and goodwill. Free software? (sometimes) free phone? ...really?
- flukus 9y agoIs running their brand name into the ground fulfilling their duty to share holders?
- module0000 9y agoYou are looking at the effect and not the cause. The cause is "their behavior", and their behavior is generating profits. The effect you state about their brand name has yet to decrease profits. That means they are fulfilling their duty, even if it's dirty/rotten/etc(doesn't matter, the market doesn't care). edit: I don't mean to come off as "you're wrong! they are awesome!". What I mean is that until share prices stop rising, shareholders will encourage them to do exactly what they have been doing so far. The morality of it is trumped by the increase in share prices. Any feelings of shame or ill-gotten gains are quickly erased as shareholder portfolios increase in value. When in doubt - trust greed to predict behavior.
- dannyw 9y agoFortunately, with the EU GDPR coming into effect mid 2018, companies can be fined up to 4% of their global annual turnover for each breach of a specific provision; and 2% for each breach of other lessor provisions. That should hopefully make these actions uneconomical.
- AdmiralAsshat 9y agoYears ago, I remember CyanogenMod advertising that their "Privacy Guard" feature had something like a data spoof feature, where if an app surreptitiously requested your location or info, the guard would feed it a dummy number, garbage location, etc. I've dug around and it seems like this no longer exists, if it ever did. Privacy Guard now seems to just allow granular controls on what the apps are allowed to request. If it doesn't exist already, someone should definitely work towards implementing something like it. EDIT: I see that the related XPrivacy app has a menu option for "Fake Data", so maybe this is what I'm thinking of. https://github.com/M66B/XPrivacy#features https://github.com/M66B/XPrivacy#features
- nothrabannosir 9y agoI'm way out of my depth here, but as far as I remember, this disappearing coincided with the introduction of Play services. Notably, determining location through WiFi endpoints nearby. I assumed spoofing location worked when getting location was simple, just GPS. But getting it through wifi and play services must have complicated everything a lot and made it harder to spoof from outside. But this is all pure conjecture.
- perlwle 9y agoI was excited when I first heard XPrivacy and tried to use it from 2015-2016. It worked as advertised but boy was it a hassle. I had a template XPrivacy setting which constantly broke app. It was too common to find apps requiring tons of permissions than they need and had to resort toggling the permission to see which work. I got fed up and switched to iPhone late last year. With iPhone, I can at least control which data to share with the app. With Android, I don't have control with either app or google. I feel relieved and have been recommending iPhone to family and friends if possible.
- sarcasmic 9y agoWhen I'm at work, I use my work computer, which has a long lived static IP, to log into my personal Google account. I have configured all of my browsers to clear cookies and storage upon closing. I never use signed-in Google Maps, but I sometimes use it from that computer, from fresh browser while logged out. A week ago, I moved from my previous home that was close to my work, to a different city about 20 miles away. Since I wasn't sure where all the points of interest are, I've been turning on location on my Android phone and using signed-out Google Maps on my phone. Yesterday, my work computer's signed-out Google Maps has centered its default view on my new city, on the exact highway interchange next to which I now live.
- mattrices 9y agoGoogle can use user prediction to guess which account you are with your browser, ip, ism, mac address, and other persistant metadata. Its how their whole 'you signed in from a new location' security scheme works.
- thisacctforreal 9y agoSure, but why would they re-center the map for a logged-out device, even if they can tell it's overwhelmingly likely that it's the same user?
- londons_explore 9y ago'you signed in from a new location' uses a cookie that remains after signout. Clear cookies, and you'll see it again. In Chrome, it also uses the TLS Client Channel ID, which is a persistent unique identifier established between a browser and a server which (on capable platforms) is derived from a key stored in a hardware security module, making it hard to steal. Ie. if you clone the hard drive of a computer, when you use the clone, Google will know you are a suspicious person, even though you have all the right cookies.
- j_s 9y agoThanks for the heads-up re: TLS Client Channel ID. Sounds like another reason to limit my personal use of Google's Chrome browser.
- lerie82 9y agoi thought this was already known.
- lerie82 9y agoi thought this was common knowledge
- opilionesman 9y agoGoogle is newspeak for googol.
- rehemiau 9y agoI am using Android without Google Play Services. Some apps don't give me notifications, but most of them work without an issue. Also, I'm using Firefox with uBlock on this phone. Couldn't be happier with that setup and my phone's battery life.
- eyeareque 9y agoIt’s funny how when asked about it, google instantly stated that it was being removed and all location data was purged. It’s almost as if they saw how bad it looks and how it hurts android’s reputation, but hoped no one would notice/care.
- megy 9y agoOne wonders what other stuff is in there that we do not know about, and would get a similar reaction. That is the first thing I though off.
- alwaysdoit 9y agoIf you're concerned about this level of location tracking, don't carry a cell phone at all. Keeping track of which cell tower your phone is closest to is fundamental to cellular technology. You can't make or receive calls unless Verizon, T-Mobile, or whichever carrier you have knows which cell to communicate with you through. Regardless of whether Google is tracking this, your carrier certainly is, and with a warrant (or a national security letter), law enforcement can definitely access this data. If you're worried about hackers, I can guarantee you Google protects this data more securely than your carrier does.
- malchow 9y ago"Keeping track of which cell tower your phone is closest to is fundamental to cellular technology" But breadcrumbing it and phoning home to the phone vendor/advertising company?
- katastic 9y agoI'm going to make a privacy app and tell everyone it's secure, fight lawsuits if anyone debates it, and then have it phone home with all their details. Oh wait, that's what Google did.
- urda 9y ago> I can guarantee you Google protects this data more securely than your carrier does. This sentence is completely insane in this context, did we read the same article? Google should not have access to this data, and it sure as hell shouldn't be sending it up to itself when disabled by the end-user. It's absurd that you typed that out for an article titled "Google collects cell tower info even if location services are disabled". In what world does one operate in if you consider this as "Google protects this data more securely than your carrier does"? Your carrier is supposed to have this information (and in fact needs it), it's a complete privacy violation for Google to be collecting it though.
- aeorgnoieang 9y agoThey were making a related but cogent point about the security implications of Google having this info versus the cell phone carriers. It did not, directly or even by implication, contradict anything you wrote – you're right that this is a privacy violation, but I didn't interpret the comment to which you replied as denying that.
- preordained 9y agoYah, if you thought changing privacy settings in $big_company software would really be honored, I have a bridge to sell you.
- IBM 9y agoIt's amazing to me how many comments here excuse Google's behavior by offering the impractical "solution" of just not using a smartphone (a false dilemma) when the obvious answer is to get an iPhone. That's the advice of pretty much everyone in the infosec field and I'm sure some of them will attest to that in this thread.
- baxtr 9y agoTrue. The big difference between Apple and google is that Apple sells you pricey hardware, that just works. In the case of google they sell you. Thus, but Business Model alone you should not trust google if you care about privacy. It doesn’t make sense for them to stop collecting data points about you.
- dragonwriter 9y ago> Apple and google is that Apple sells you pricey hardware, that just works Well, pricey hardware, at least. > In the case of google they sell you No, they aren't in the slave trade; they sell ad placement, not people.
- zitterbewegung 9y agoThey sell ad placement by observing all of your behaviors and figuring out what you want to do. (Refining the other statement ).
- evanlivingston 9y agoDuring the height of slavery it was widely accepted, culturally and legally, that slaves wern't people. Slavers sold implements of labor, not people.
- victor106 9y agoAbout Price: the google Pixel phones are not much cheaper than an iPhone. The last I checked Pixel xl 2 was 10% cheaper than an iPhone X
- pob1234 9y agoVPN is the way to go. With tunnelbear they think I am in Jersey.
- mtarnovan 9y agoHave you read the article? They collect cell tower info, you can't fool that with a VPN...
- on_and_off 9y ago>It is not clear how cell-tower addresses, transmitted as a data string that identifies a specific cell tower Couldn't it be used to avoid faulty towers ? I am not an expert at all, but I was told several times that it was a problematic issue. Not that it would be an excuse for collecting it when location sharing is off but I am curious to know why I can be helpful to FCM I am really curious to know how Qz determined that Google was collecting this data.
- mtarnovan 9y agoI soon have to buy a new (smart)phone. Looks like this might just be the straw that pushes me over to iPhone.
- dingo_bat 9y agoI'd buy the new iphones in a heartbeat but I simply cannot spend that kind of money and put up with weird compromises like no haedphone jack or no fingerprint reader. I wish Samsung would have an option to run tizen on its flagships.
- maccard 9y ago> I simply cannot spend that kind of money and put up with weird compromises like no haedphone jack or no fingerprint reader That category no longer applies solely to apple. Google's flagship phone [0] is just as expensive as Apple's, has no headphone jack and no fingerprint reader. [0] https://store.google.com/product/pixel_2 https://store.google.com/product/pixel_2
- scott_karana 9y agoBuy a new 6S then. Apple doesn't immediately abandon their phones, so there's no need to buy the newest out of habit.
- dingo_bat 9y ago
- yndoendo 9y ago"The revelation comes as Google and other internet companies are under fire from lawmakers and regulators, including for the extent to which they vacuum up data about users." Since the FCC is taking the Alan Greenspan approach to a self-regulating market / ISP, which nearly every Republican legislative office support. Which lawmakers and regulators are up in arms?
- olegkikin 9y agoJust get one of those cases that block GPS signal, or even the one that blocks all signals (but you won't be able to receive calls). They are only a few bucks.
- chiefalchemist 9y agoThis could trigger a new line of wearables, one with a Faraday Cage sewn right in. Right pocket is open, left pocket is a cage ;)
- ksenzee 9y agoMy first instinct was to laugh. My second was "I want this."
- mxuribe 9y agoI had the same exact reaction as you! :-)
- ZenoArrow 9y agoIt's not impossible to do. You could weave a lightweight signal-blocking mesh into a pocket without impacting wearability.
- chiefalchemist 9y agoMy point exactly ;)
- wakkaflokka 9y agoThis is actually a fantastic idea. Please make it materialize!
- jm238 9y agoPun intended!
- steanne 9y agohmm.. found a kickstarter from 2014 https://www.kickstarter.com/projects/zoltancsaki/1984-stealth-fashion-for-the-under-surveillance-so https://www.kickstarter.com/projects/zoltancsaki/1984-stealt...
- tanilama 9y agoThis is a non issue.
- throw2016 9y agoThis is the kind of creepy stalking behavior that Google and its apologists have normalized and seek to further extend. It's ok to need a job but no responsible individual can defend this massive, intensive and extensive invasion of people's privacy.
- xnx 9y agoAfter watching Google closely for years, I'm pretty sure this was not intentional or malicious. Isn't this almost identical to what Apple was doing in 2011: https://arstechnica.com/gadgets/2011/04/how-apple-tracks-your-location-without-your-consent-and-why-it-matters/ https://arstechnica.com/gadgets/2011/04/how-apple-tracks-you...
- blub 9y agoAfter watching Google's privacy violations closely for more than a decade, I'm pretty sure this was intentional and someone got a bonus for coming up with the idea and implementing it. Google's real motto is more user data == good. Saving location history in a local file is not the same as sending it to Google, just like cutting your finger is not the same as getting your hand blown off.
- chrisblackwell 9y agoGoogle...stop being that guy
- afrophysics1 9y agoJesus christ has this thread lowered my expectations of this community.
- sctb 9y agoThe way to improve things is to post civilly and substantively yourself, please. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- yoran 9y ago...and the company is now taking steps to end the practice after being contacted by Quartz. Classic example of Google's "ask for forgiveness, not permission" mode of operation.
- dingo_bat 9y agoAs I noted on reddit, I am not surprised by this at all. Google's entire incentive to maintain Android is the troves of data they collect about users. Why would they let you turn it off? It doesn't make any sense. If you're surprised as a user, you've been really naïve. Imagine this: would apple ever let you not pay for a new iPhone? Its entire incentive in making iphones is to sell them for money. So it will never allow you to get phones for free.
- cisanti 9y agoGoogle is an immoral and sick company, if you work for the gestspo machine you should be ashamed of yourself no excuses.
- blub 9y agoI agree with you about Google, but it's more than fine for the people to be surprised and/or outraged. That's how this gets fixed... Google said they're taking steps to fix it. Surely they wouldn't lie to us.
- dingo_bat 9y ago> Surely they wouldn't lie to us. They kind of lied when they made the location tracking work even when you disable it.
- bprasanna 9y agoNot so surprising! It gave away the entire OS free just because it can use the OS and applications living on top of it to mine people's personal data!
- gokvokbok 9y agoArgh shit. Google feel like a cancer on my phone now, it'll be the shove I needed to try out whatever the open source one is now, Cynagon's successor. Whenever a company goes public, it turns into a shiteating, environment-killing, public-interest-killing monolith. Or is that just some of them?
- arca_vorago 9y agoOnce again, when do I start hearing apologies from the supporters of closed source and mit/bsd (which allow tivoization like google did with android)? When do we finally realize RMS was right all along?
- deleted 9y ago[deleted]
- cmurf 9y agoI'm moving up my research on migrating to Nextcloud, or some combination of it and maybe FastMail. I'm sick of this kind of bullshit. And the thing is, Google, Apple, Microsoft, are less still evil than Time Warner, Verizon, Road Runner, Xfinity, etc. But I'm concerned they are not sufficiently opposed to that fiefdom to maintain a neutral balance on the internet.
- kgarten 9y agoThat might be a digression, but overall you have to "trust" a company or software provider to some extend. Even if you have all source-code etc. there are always possibilities to include a backdoor or similar if there's one binary involved (in this case the compiler): http://wiki.c2.com/?TheKenThompsonHack http://wiki.c2.com/?TheKenThompsonHack
- alexasmyths 9y ago"Do no evil" There was a misprint, it was : "Do no evil?"
- j_s 9y agoGoogle is definitely pushing location services hard. I was happy to learn it's possible to disable Google Now yesterday: https://news.ycombinator.com/item?id=15743055 https://news.ycombinator.com/item?id=15743055 Another option besides an iPhone is to replace Google Play Services: https://news.ycombinator.com/item?id=15617615 https://news.ycombinator.com/item?id=15617615 (supported devices: https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/)
- fimdomeio 9y agoMaybe this problem should also be viewed from a different perspective. This companies are using the internet connections we pay for, for communications we didn't really allowed. They should be forced to pay us for the unauthorized use of our internet connections, and obviously for our data. if the costs where high enough this kind of "hacking" would just stop.
- deleted 9y ago[deleted]
- tempodox 9y agoGoogle really does have the Creep routine down by now.
- a_imho 9y agoThe section of Google’s privacy policy that covers location sharing says the company will collect location information from devices that use its services, but does not indicate whether it will collect data from Android devices when location services are disabled So why isn't Google is slapped with a fine then?
- exabrial 9y agoUser: clicks "No location tracking" Google: "Yah, ok, I know no means no, but...."
- danjoc 9y agoFollow the money. Location information, ads viewed, and offline credit card purchase information. Google now has all three. Google uses this to determine which ads led you to spend and sells more of those ads. https://consumerist.com/2017/05/23/google-following-your-offline-credit-card-spending-to-tell-advertisers-if-their-ads-work/ https://consumerist.com/2017/05/23/google-following-your-off... They're not going to stop collecting location information, even if you tell them to.
- codedokode 9y agoI am surprised that this is legal in all countries where Google products are used. And by the way, I think Google won't be able to collect data from China.
- jm238 9y agoSo, about that Linux smartphone... It doesn't have to be perfect: calls and texts should work, a camera and browser would be nice, and the complete freedom to use it and control it in the way the user wants. The first run to sell maybe 1,000 or 10,000 units? My cash is waiting...