5 ms·

According to Google Bluetooth requires location, because it van be used to find your location. So there is some reasoning behind this decisions, although I wwou

According to Google Bluetooth requires location, because it van be used to find your location. So there is some reasoning behind this decisions, although I wwould be mutch happier with something like: Location (Bluetooth), location (GPS), location (WiFi) >A location permission is required because Bluetooth scans can be used to gather information about the location of the user. This information may come from the user's own devices, as well as Bluetooth beacons in use at locations such as shops and transit facilities. https://developer.android.com/guide/topics/connectivity/bluetooth.html#Permissions https://developer.android.com/guide/topics/connectivity/blue...

panpanna 7y ago
Please take a step back and look at this again. What is the cause and what is the effect here? Is Google's solution making it better or worse from a practical privacy point of view? (Also, don't buy Google's explanation that this is just to inform users of potential misuse - they actually log your location and even wait for a GPS lock when you pair a new device)
- baybal2 7y ago
  Even APIs of J2ME applets and symbian s60 did not reveal hardware addresses to the program. I felt that google was lazy and simply mapped bluez 1-to-1 to public api.
- anticensor 7y ago
  What happens when you disable GPS system-level and allowed Bluetooth? Does discovery fail?
  - panpanna 7y ago
    Yes
- the_jeremy 7y ago
  Why shouldn't I buy Google's explanation? If an app that uses bluetooth can get my location via beacons or etc., then bluetooth should be wrapped in location privileges. An app that I do not want having my location should not be allowed to use bluetooth, and I have to accept that any app that does use bluetooth could get my location. While it does mean that apps that use bluetooth now have a slightly easier way of getting location (i.e., via phone GPS, not just bluetooth), we shouldn't obfuscate that bluetooth is another way to get that information. In the end, you are trusting the app developer with the privilege of knowing your location. If you don't trust them with that, then they can't be allowed to use bluetooth, full stop.
  - altfredd 7y ago
    > Why shouldn't I buy Google's explanation? Because Google is notorious for coming up with bogus explanations whenever they get caught red-handed. Every month there is a bunch of news articles, where high-ranked Google employee claims to spy on everyone to "protect people from electric pigs", "lower the danger of Confucian Jihad", "enrich e-mail UX with hefty data-harvesting" or something along those lines. > If an app that uses bluetooth can get my location via beacons or etc., then bluetooth should be wrapped in location privileges. There is no reason why apps have to be able to "get location from beacons" in order to connect with another phone over Bluetooth. Same for P2P Wi-Fi API — pairing with another device already requires exchanging tokens via graphical dialog with explicit user approval on both devices. Removing ability to read scan results from API would be enough to fix the underlying data leak. Once two devices are paired, they should be able to exchange data without need for any permissions or user actions. Instead Google forces users to keep Location enabled long after initial connection is made. Even if there is no underlying bad intention, they should be ashamed of forcing such garbage UX upon people.

panpanna 7y ago

Please take a step back and look at this again. What is the cause and what is the effect here? Is Google's solution making it better or worse from a practical privacy point of view? (Also, don't buy Google's explanation that this is just to inform users of potential misuse - they actually log your location and even wait for a GPS lock when you pair a new device)

baybal2 7y ago
Even APIs of J2ME applets and symbian s60 did not reveal hardware addresses to the program. I felt that google was lazy and simply mapped bluez 1-to-1 to public api.
anticensor 7y ago
What happens when you disable GPS system-level and allowed Bluetooth? Does discovery fail?
- panpanna 7y ago
  Yes
the_jeremy 7y ago
Why shouldn't I buy Google's explanation? If an app that uses bluetooth can get my location via beacons or etc., then bluetooth should be wrapped in location privileges. An app that I do not want having my location should not be allowed to use bluetooth, and I have to accept that any app that does use bluetooth could get my location. While it does mean that apps that use bluetooth now have a slightly easier way of getting location (i.e., via phone GPS, not just bluetooth), we shouldn't obfuscate that bluetooth is another way to get that information. In the end, you are trusting the app developer with the privilege of knowing your location. If you don't trust them with that, then they can't be allowed to use bluetooth, full stop.
- altfredd 7y ago
  > Why shouldn't I buy Google's explanation? Because Google is notorious for coming up with bogus explanations whenever they get caught red-handed. Every month there is a bunch of news articles, where high-ranked Google employee claims to spy on everyone to "protect people from electric pigs", "lower the danger of Confucian Jihad", "enrich e-mail UX with hefty data-harvesting" or something along those lines. > If an app that uses bluetooth can get my location via beacons or etc., then bluetooth should be wrapped in location privileges. There is no reason why apps have to be able to "get location from beacons" in order to connect with another phone over Bluetooth. Same for P2P Wi-Fi API — pairing with another device already requires exchanging tokens via graphical dialog with explicit user approval on both devices. Removing ability to read scan results from API would be enough to fix the underlying data leak. Once two devices are paired, they should be able to exchange data without need for any permissions or user actions. Instead Google forces users to keep Location enabled long after initial connection is made. Even if there is no underlying bad intention, they should be ashamed of forcing such garbage UX upon people.