3 ms·

As a matter of fact I default to explicitly turning off all location permissions. I've gone to great pains to practice clean opsec. This is effectively a forced

As a matter of fact I default to explicitly turning off all location permissions. I've gone to great pains to practice clean opsec. This is effectively a forced breach. I clicked on something cool expecting to be promoted for a zip code.

pault 7y ago
That's fine, but as GP said, the browser geolocation API asks for location data from the device, and this is what it gives you back. Every app and website that has a "use my location" button will provide your latitude and longitude as accurately as possible, which is usually high enough to know not only your address, but also that you are currently in your downstairs bathroom. I'm also a bit surprised that you are technically savvy enough to maintain strict opsec but you didn't know how geolocation services work on a smartphone. Regardless, the developer of the website does not deserve your ire for using a common browser API. The app could be improved by offering a UI for entering a zip code, but they didn't set out to steal your PII.
oarsinsync 7y ago
For this to be a forced breach, the website must be intentionally exploiting a security issue on the device to expose exact location coordinates. If so, I’d suggest perusing the source code, as there might be bug bounty money there. Or patching your device. EDIT: to be clear, this would also be a dick move by the website author and they should be publicly shamed more than this. Alternatively, they may be accidentally triggering a vulnerability (more bug bounty money or reasons to patch) Alternatively, you accidentally gave the permission for location services when prompted. Alternatively, your IP has a GeoIP location that is at / very close to your home address. If this is the case, GeoIP databases are like telephone directories of yore. Except not only are they globally public, you also cant opt out. Sorry!

pault 7y ago

That's fine, but as GP said, the browser geolocation API asks for location data from the device, and this is what it gives you back. Every app and website that has a "use my location" button will provide your latitude and longitude as accurately as possible, which is usually high enough to know not only your address, but also that you are currently in your downstairs bathroom. I'm also a bit surprised that you are technically savvy enough to maintain strict opsec but you didn't know how geolocation services work on a smartphone. Regardless, the developer of the website does not deserve your ire for using a common browser API. The app could be improved by offering a UI for entering a zip code, but they didn't set out to steal your PII.

oarsinsync 7y ago

For this to be a forced breach, the website must be intentionally exploiting a security issue on the device to expose exact location coordinates. If so, I’d suggest perusing the source code, as there might be bug bounty money there. Or patching your device. EDIT: to be clear, this would also be a dick move by the website author and they should be publicly shamed more than this. Alternatively, they may be accidentally triggering a vulnerability (more bug bounty money or reasons to patch) Alternatively, you accidentally gave the permission for location services when prompted. Alternatively, your IP has a GeoIP location that is at / very close to your home address. If this is the case, GeoIP databases are like telephone directories of yore. Except not only are they globally public, you also cant opt out. Sorry!