8 ms·

Android location service cache dumper.

69 points by packetlss 15y ago

abofh 15y ago
I don't think anyones concerned that it tracks you with cached data (47 entries in github example, date spread would imply ~ 1 month) -- the concern w/r/t apple is that there seems to be no limit to the amount of logging retained. I won't get into paranoia mode, or conspiracy theories, _but_ I am fine with either phone being aware of my location, and even my recent movements (subject to disclosure) -- I am NOT fine with that log being undisclosed and perpetual
- benbeltran 15y ago
  Except it's not tracking your location, it's tracking cell towers. I'm sure a lot of cell phones do this, to a different degree of "log length". The issue I have with a perpetual log of cell towers is not a privacy one, it's a space one (how long will the log be in a couple of years). But hey, I'm not stopping anyone from hopping into the most recent episode of the iPhone hating bandwagon. It's what makes the internet go round (any hate bandwagon for that matter)
  - kefs 15y ago
    Granted.. it is not tracking your fine location, but rather the location of the towers you connect to. Your location, however, is still reliable to within 200-1000m with triangulation. http://www.skyhookwireless.com/howitworks/cellid.php http://www.skyhookwireless.com/howitworks/cellid.php
  - Saavedro 15y ago
    And it'd be fine if I didn't track your location, but simply timing data you are receiving from a few GPS satellites?
  - skoob 15y ago
    > Except it's not tracking your location, it's tracking cell towers. That's true in the sense that mercury thermometers do not measure temperature -- they measure the height of a column of mercury.
bediger 15y ago
As the owner and user of an Android phone, great, just great. Let's ask the so-far unasked question: Why? Both Google and Apple built in location-caching. Seems mighty suggestive of something, maybe something like the color printer Mysterious Yellow Ink dots (http://www.instructables.com/id/Yellow-Dots-of-Mystery-Is-Your-Printer-Spying-on-/ http://www.instructables.com/id/Yellow-Dots-of-Mystery-Is-Yo...).
- watty 15y ago
  I'm assuming caching cell towers and wifi improves performance. An unlimted cache is a bad thing, a limited cache is a good thing.
  - Calabane 15y ago
    I'd argue that is it neither, but is instead so that both Apple and Google can eventually offer localized and personalized marketing dependent on the area that your phone is reporting that you are in or have been in fairly frequently. An example would be giving you a discount code for that restaurant that you have passed by 4 times in the last 2 weeks at around dinner time. This is part of my theory about why apple is building the enormous data center in NC.
    - KirinDave 15y ago
      Do you have any evidence for this interpretation over the technical explanation offered? Why believe this hypothesis over any others?
    - watty 15y ago
      I may be wrong but looking at the code and example data it seems that the Android cache only keeps track of the latest time stamp at a given cell tower so it wouldn't know the frequency of visits in an area. This is definitely a possibility for the iOS cache but I can't imagine this would bode well for the privacy-conscious folks.
      - 15y ago
watty 15y ago
http://netmite.com/android/mydroid/frameworks/base/location/java/com/android/internal/location/LocationCache.java http://netmite.com/android/mydroid/frameworks/base/location/... It appears that unlike Apple, this isn't unlimited: // Cache sizes private static final int MAX_CELL_RECORDS = 50; private static final int MAX_WIFI_RECORDS = 200; Edit: Seems like another very important difference is that the Android cache only keeps track of your last timestamp at a given tower. Even if this cache was unlimited it couldn't be used to plot someones position over time.
- mvalle 15y ago
  Isn't it possible to plot someone's position over time, no matter what phone you have? I mean the carriers know which towers you've connected to and when, they have all the info you need to track someone, even across multiple phones.
  - lallysingh 15y ago
    sure, but physical access to someone's phone is a lot easier than being a carrier.
- packetlss 15y ago
  The unlimited size of Apple's cache is probably just a mistake. It makes no sense to store it on the device for tracking purposes. I assume they log this info when the device requests the info from Skyhook (or whatever location provider they have now) anyway.
  - Relwal 15y ago
    Apple's consolidated.db is not a "mistake". A mistake would not have gotten rewritten for iOS 4 when the database got converted from XML to SQLite and moved to user data. http://alexlevinson.wordpress.com/2011/04/21/3-major-issues-with-the-latest-iphone-tracking-discovery/ http://alexlevinson.wordpress.com/2011/04/21/3-major-issues-... Also iOS no longer uses Skyhook as of iOS 3.2. Plus Skyhook is for Wifi access point location data, not cell-tower location data. Apple uses its own database for that now which you consent to update with your location data. http://www.f-secure.com/weblog/archives/00002145.html http://www.f-secure.com/weblog/archives/00002145.html
drivebyacct2 15y ago
"You will need root access to the device to read this directory." It's not even in the same realm.
- ceejayoz 15y ago
  Why? You need the user's iPhone or their computer in your physical possession to read the iOS location cache.
  - notJim 15y ago
    I thought normal users (who haven't rooted their phones) wouldn't have easy access to the root filesystem. I just looked on my phone (just by plugging it into my computer and putting it in filesystem mode), and looked, and I don't see the folder he's talking about. Am I wrong? I'm not really sure about this.
  - drivebyacct2 15y ago
    Because I can grab your phone, plug it in and have all of your history. If you grabbed my phone running 2.3.3 on the Nexus S... it would be impossible to get to that data without going through the entire bootloader unlock process which is obviously invasive. Imagine scenarios where people are reading your location data. Authorities, governments, espionage... all of them would be largely foiled due to the fact that root access is required and gaining that root access would leave trails. Do I really have to explain the difference between data easily accessed via usb and data that is stored in protected areas of the rom on an Android device? Spot on with your comment voting there HN. Thanks as usual.
    - ceejayoz 15y ago
      > Because I can grab your phone, plug it in and have all of your history OK, but you've already got my phone! Authorities and governments aren't foiled, they just got to AT&T and get the data from its source (where, incidentally, I can't have tampered with it). As for espionage, I rather suspect the CIA and its foreign counterparts can figure out a way to root my phone quietly.
cjoh 15y ago
I don't understand the outrage on this-- your wireless carrier probably has an identical file somewhere as well. At least you have a copy of it. My suggestion: for the next YC application, invent a way for people to sell this data back to marketeers. I'll sell my data for a lot less than what Apple's or AT&T are charging.
- cryptoz 15y ago
  > your wireless carrier and only your wireless carrier. Now anyone who you lend your phone to while you take a bite to eat can read your location data. Or Apple. Perhaps if it's not encrypted, and there's an iOS vulnerability, anyone could read the data. Not just your wireless carrier. That's why this is a big deal. Why store this data? If it most be stored, why has no effort been put in to keeping it safe? Just because one company could read it before doesn't mean that it's okay others can too. We naturally assume (and rightly so) that our wireless carriers can and do track our every move. But we "trust" them; we sure as hell don't trust anyone else. Edit: And it's even creepier that this was secret. It's not like we're getting mad at official Apple TOS or policy; they didn't tell us they were tracking our location and storing the data forever and ever. Fuck that, that's scary and unpleasant.
  - cjoh 15y ago
    The FBI has my FBI file and only the FBI file. By this logic, I shouldn't FOIA for my FBI file because someone could break into my house and steal it. Also, I carry a lot more sensitive information on my phone than the cellphone towers it talks to-- I suspect this is the same for most people. Anybody that's installed, say "Mint" on their iphone, has used the "email" application, or sent the occasional drunken SMS message probably has a lot more to worry about than the location data stored on their phone. I guarantee you I protect the data on my phone a lot more than Apple does. Apple sells it. Here's an opportunity for me to sell it too.
- gonk 15y ago
  At least we now know what kind of precision our carriers can track us with, and we have our own copy of the data for verification/legal reasons if its ever needed..
darrikmazey 15y ago
the problem i have with this is given the recent michigan ruling saying police can dump, retain, and peruse data from a cell phone during a traffic stop, this gives access to far more data than should be possible without a warrant, without "physical possession of the phone" in the sense of actual seizure.
fedd 15y ago
during the cold war the secret police job was at least somehow interesting and romantic now it's all about a pair of sql queries or regexps.

69 points by packetlss 15y ago

abofh 15y ago

I don't think anyones concerned that it tracks you with cached data (47 entries in github example, date spread would imply ~ 1 month) -- the concern w/r/t apple is that there seems to be no limit to the amount of logging retained. I won't get into paranoia mode, or conspiracy theories, _but_ I am fine with either phone being aware of my location, and even my recent movements (subject to disclosure) -- I am NOT fine with that log being undisclosed and perpetual

benbeltran 15y ago
Except it's not tracking your location, it's tracking cell towers. I'm sure a lot of cell phones do this, to a different degree of "log length". The issue I have with a perpetual log of cell towers is not a privacy one, it's a space one (how long will the log be in a couple of years). But hey, I'm not stopping anyone from hopping into the most recent episode of the iPhone hating bandwagon. It's what makes the internet go round (any hate bandwagon for that matter)
- kefs 15y ago
  Granted.. it is not tracking your fine location, but rather the location of the towers you connect to. Your location, however, is still reliable to within 200-1000m with triangulation. http://www.skyhookwireless.com/howitworks/cellid.php http://www.skyhookwireless.com/howitworks/cellid.php
- Saavedro 15y ago
  And it'd be fine if I didn't track your location, but simply timing data you are receiving from a few GPS satellites?
- skoob 15y ago
  > Except it's not tracking your location, it's tracking cell towers. That's true in the sense that mercury thermometers do not measure temperature -- they measure the height of a column of mercury.

bediger 15y ago

As the owner and user of an Android phone, great, just great. Let's ask the so-far unasked question: Why? Both Google and Apple built in location-caching. Seems mighty suggestive of something, maybe something like the color printer Mysterious Yellow Ink dots (http://www.instructables.com/id/Yellow-Dots-of-Mystery-Is-Your-Printer-Spying-on-/ http://www.instructables.com/id/Yellow-Dots-of-Mystery-Is-Yo...).

watty 15y ago
I'm assuming caching cell towers and wifi improves performance. An unlimted cache is a bad thing, a limited cache is a good thing.
- Calabane 15y ago
  I'd argue that is it neither, but is instead so that both Apple and Google can eventually offer localized and personalized marketing dependent on the area that your phone is reporting that you are in or have been in fairly frequently. An example would be giving you a discount code for that restaurant that you have passed by 4 times in the last 2 weeks at around dinner time. This is part of my theory about why apple is building the enormous data center in NC.
  - KirinDave 15y ago
    Do you have any evidence for this interpretation over the technical explanation offered? Why believe this hypothesis over any others?
  - watty 15y ago
    I may be wrong but looking at the code and example data it seems that the Android cache only keeps track of the latest time stamp at a given cell tower so it wouldn't know the frequency of visits in an area. This is definitely a possibility for the iOS cache but I can't imagine this would bode well for the privacy-conscious folks.
    - 15y ago

watty 15y ago

http://netmite.com/android/mydroid/frameworks/base/location/java/com/android/internal/location/LocationCache.java http://netmite.com/android/mydroid/frameworks/base/location/... It appears that unlike Apple, this isn't unlimited: // Cache sizes private static final int MAX_CELL_RECORDS = 50; private static final int MAX_WIFI_RECORDS = 200; Edit: Seems like another very important difference is that the Android cache only keeps track of your last timestamp at a given tower. Even if this cache was unlimited it couldn't be used to plot someones position over time.

mvalle 15y ago
Isn't it possible to plot someone's position over time, no matter what phone you have? I mean the carriers know which towers you've connected to and when, they have all the info you need to track someone, even across multiple phones.
- lallysingh 15y ago
  sure, but physical access to someone's phone is a lot easier than being a carrier.
packetlss 15y ago
The unlimited size of Apple's cache is probably just a mistake. It makes no sense to store it on the device for tracking purposes. I assume they log this info when the device requests the info from Skyhook (or whatever location provider they have now) anyway.
- Relwal 15y ago
  Apple's consolidated.db is not a "mistake". A mistake would not have gotten rewritten for iOS 4 when the database got converted from XML to SQLite and moved to user data. http://alexlevinson.wordpress.com/2011/04/21/3-major-issues-with-the-latest-iphone-tracking-discovery/ http://alexlevinson.wordpress.com/2011/04/21/3-major-issues-... Also iOS no longer uses Skyhook as of iOS 3.2. Plus Skyhook is for Wifi access point location data, not cell-tower location data. Apple uses its own database for that now which you consent to update with your location data. http://www.f-secure.com/weblog/archives/00002145.html http://www.f-secure.com/weblog/archives/00002145.html

drivebyacct2 15y ago

"You will need root access to the device to read this directory." It's not even in the same realm.

ceejayoz 15y ago
Why? You need the user's iPhone or their computer in your physical possession to read the iOS location cache.
- notJim 15y ago
  I thought normal users (who haven't rooted their phones) wouldn't have easy access to the root filesystem. I just looked on my phone (just by plugging it into my computer and putting it in filesystem mode), and looked, and I don't see the folder he's talking about. Am I wrong? I'm not really sure about this.
- drivebyacct2 15y ago
  Because I can grab your phone, plug it in and have all of your history. If you grabbed my phone running 2.3.3 on the Nexus S... it would be impossible to get to that data without going through the entire bootloader unlock process which is obviously invasive. Imagine scenarios where people are reading your location data. Authorities, governments, espionage... all of them would be largely foiled due to the fact that root access is required and gaining that root access would leave trails. Do I really have to explain the difference between data easily accessed via usb and data that is stored in protected areas of the rom on an Android device? Spot on with your comment voting there HN. Thanks as usual.
  - ceejayoz 15y ago
    > Because I can grab your phone, plug it in and have all of your history OK, but you've already got my phone! Authorities and governments aren't foiled, they just got to AT&T and get the data from its source (where, incidentally, I can't have tampered with it). As for espionage, I rather suspect the CIA and its foreign counterparts can figure out a way to root my phone quietly.

cjoh 15y ago

I don't understand the outrage on this-- your wireless carrier probably has an identical file somewhere as well. At least you have a copy of it. My suggestion: for the next YC application, invent a way for people to sell this data back to marketeers. I'll sell my data for a lot less than what Apple's or AT&T are charging.

cryptoz 15y ago
> your wireless carrier and only your wireless carrier. Now anyone who you lend your phone to while you take a bite to eat can read your location data. Or Apple. Perhaps if it's not encrypted, and there's an iOS vulnerability, anyone could read the data. Not just your wireless carrier. That's why this is a big deal. Why store this data? If it most be stored, why has no effort been put in to keeping it safe? Just because one company could read it before doesn't mean that it's okay others can too. We naturally assume (and rightly so) that our wireless carriers can and do track our every move. But we "trust" them; we sure as hell don't trust anyone else. Edit: And it's even creepier that this was secret. It's not like we're getting mad at official Apple TOS or policy; they didn't tell us they were tracking our location and storing the data forever and ever. Fuck that, that's scary and unpleasant.
- cjoh 15y ago
  The FBI has my FBI file and only the FBI file. By this logic, I shouldn't FOIA for my FBI file because someone could break into my house and steal it. Also, I carry a lot more sensitive information on my phone than the cellphone towers it talks to-- I suspect this is the same for most people. Anybody that's installed, say "Mint" on their iphone, has used the "email" application, or sent the occasional drunken SMS message probably has a lot more to worry about than the location data stored on their phone. I guarantee you I protect the data on my phone a lot more than Apple does. Apple sells it. Here's an opportunity for me to sell it too.
gonk 15y ago
At least we now know what kind of precision our carriers can track us with, and we have our own copy of the data for verification/legal reasons if its ever needed..

darrikmazey 15y ago

the problem i have with this is given the recent michigan ruling saying police can dump, retain, and peruse data from a cell phone during a traffic stop, this gives access to far more data than should be possible without a warrant, without "physical possession of the phone" in the sense of actual seizure.

fedd 15y ago

during the cold war the secret police job was at least somehow interesting and romantic now it's all about a pair of sql queries or regexps.