7 ms·

One of the most disappointing changes in Android recently is that any network-assisted geolocation plugins must now be installed as a system app, not a user app

One of the most disappointing changes in Android recently is that any network-assisted geolocation plugins must now be installed as a system app, not a user app. That means that even if you use LineageOS where most Google stuff has been stripped out, getting a GPS fix through network assistance still sends data to Google servers. Only a tiny minority of users are comfortable working with the command line and will install e.g. Mozilla geolocation to the right place on disk. Just one of many changes Google has pushed into AOSP that end up strengthening its own monopoly.

izacus 6y ago
Hmm, wouldn't in that case Lineage be able to preinstall such service themselves? I'd expect them to?
- Mediterraneo10 6y ago
  No, the LineageOS devs say that their project does not aim to completely de-Google the OS, only remove Google Play Services and some Google applications like Maps. Thus, geolocation, DNS and login portal detection in LineageOS still use Google's servers.
  - izacus 6y ago
    Ugh, that's very disappointing then, I've always advised Lineage to people who wanted to deGoogle their phones :/
    - andrepd 6y ago
      To be fair, lineage+microg is probably the best you can get while still keeping a reasonable level of convenience (that is, still running android and most popular apps).
      - andysch 6y ago
        agree. Even better with same reasonable level of convenience is iodé
    - prox 6y ago
      You are literally on a phone that was/is heavily subsidized by Google. They hold all the keys and own all the doors, if you want to degoogle, go Purism/Pinephone/Linuxphone.
    - jmnicolas 6y ago
      There's GrapheneOS if you have a Pixel 2+ or /e/ os for other phones.
      - orestarod 6y ago
        /e/ is based on LineageOS, not even the latest at that, and searching on it a bit smells a bit of BS.
  - cassepipe 6y ago
    What about /e/ ? It's been a while I haven't heard about them.
    - dredmorbius 6y ago
      Least. Fucking. Searchable. Name. Ever. Arguable worse than R, C, or Word. "Gee, let's take the most frequently occurring letter in English usage, and bracket it with Web-significant non-text punctuation." "e Foundation" will find them. No idea on status/news. https://e.foundation https://e.foundation
    - jlkuester7 6y ago
      I follow Gaël Duval (the founder of /e/OS on Mastodon. https://mastodon.social/@gael https://mastodon.social/@gael He gives regular status updates and they seem to be making good progress. I played with /e/OS a long time ago when it first came out and found the microg integration to be excellent (have had trouble in the past getting LineageOS + microg to work...). I am planning to flash /e/OS onto a phone again soon to see the latest progress.
    - javierseballos 6y ago
      And i think its for the best. This ROM is a joke: outdated, the store is full of outdated or non-original apps. Its a lack of respect for their users to market a device as secure with an unencrypted ROM with bootloader unlocked
  - srtjstjsj 6y ago
    OK, but it's weird to blame Google for Lineage's philosophical position. As it stands Google has contributed to LineagoOS far far more non-Googlr-dependent stuff than Lineage has.
- 0x_rs 6y ago
  I am pretty sure MicroG Lineage builds have NLPs other than Google's own preinstalled and being prerooted (or easily rooted with the extra zip) should be easily interchangeable from their settings. Though this is mostly an annoyance since an user installing Lineage should already be a little comfortable with adb and a terminal, it seems another sad step towards locking down Android furthermore.
raxxorrax 6y ago
I always deactivate geolocation and I assume and hope it doesn't phone home to Google in that case. I still deactivate network if I don't need it. Android devices cannot really be trusted and it seems to be getting worse. Of course I am not using contact tracing either in this case, but I certainly won't allow Google to trace my location.
- maxmunzel 6y ago
  If I understand it correctly, contact tracing should rely on bluetooth only. Does it require location services and/or network on Android?
  - raxxorrax 6y ago
    Sadly yes. It is probably a software component problem that bluetooth is bundled with location services, but without the separation from GPS, I have serious concerns about privacy, even if I think that I only use well behaved apps.
    - Phemist 6y ago
      Bluetooth and location services being bundled is a policy decision by Google. If one has a database filled with historical correlations between bluetooth devices "in range" and GPS coordinates, it is possible to get a pretty accurate fix on someone's location from the current devices that are in range. This is the reason why Google has bundled Bluetooth and GPS in one permission. Of course, the very fact that these permissions are bundled is the reason why it's feasible to keep such databases up-to-date, and why up-to-date databases provide a continuously stronger case why Bluetooth should be considered a type of location permission.. It would be totally possible to separate location permissions between "passive" location (e.g. triangulation through received GPS coordinates), and "active" location, e.g. inference of location through indirect measures and correlations with historical databases. Afaik it's now a system-wide setting to disallow said correlations, but offering app developers more fine-grained control would be better for all of us. Why does, for example, my Sony Bluetooth headset need my location just for updating some firmware..
est31 6y ago
Do you know how to disable network assisted geolocation on Android 10? I have Lineage OS based on that version and neither following the guide for Android 11 nor for Android 9 makes the option show up, and the guide for Android 10 somehow doesn't exist. Maybe it's disabled because I don't have gapps? https://support.google.com/accounts/answer/3467281?hl=en https://support.google.com/accounts/answer/3467281?hl=en
cassepipe 6y ago
Do you have any links/tips on how to become part of that minority of users that use Mozilla's service?
- ForHackernews 6y ago
  https://microg.org/ https://microg.org/ has implemented a pluggable network location provider service. If you flash MicroG on your device, you can then select Mozilla (or Apple or other) location backend providers.
dingaling 6y ago
> getting a GPS fix through network assistance still sends data to Google servers Well, that's not a GPS fix. If you want a traceless position fix, use GPS Navstar / Glonass / Beidu / Galileo. Yes it takes longer from cold start, but that's the trade-off for privacy.
- nickcw 6y ago
  Assuming it is the system I'm thinking of, it is all about sepeeding up the time to a first fix. Without it can be quite a few minutes to get a fix. https://en.m.wikipedia.org/wiki/Assisted_GPS https://en.m.wikipedia.org/wiki/Assisted_GPS
npteljes 6y ago
What is the case when you install LineageOS without google services? In my understanding, this takes care of the location provider problem. Of course you still have lots of google in your phone, which is the whole reason of the /e/ foundation for example.
xwolfi 6y ago
I have a Huawei without Google, and I can do geolocation, maybe you could try that too ? If you use google for search and huawei for map, they can't cross reference to each other since they're forbidden to talk to each others. I actually feel so much better without all the google stuff, weird no?
- Mediterraneo10 6y ago
  > I have a Huawei without Google, and I can do geolocation, maybe you could try that too ? I assume that even if Huawei’s Android sold in the West doesn't use Google Play Services, it still uses standard AOSP, and the issue is that Google geolocation (and some other use of Google servers) is hardcoded into AOSP.
- jmnicolas 6y ago
  I would be astonished if Huawei didn't have any spywares on their phones! Unless they fear the level of scrutiny they'll receive by the West. And even if the OS isn't spying, the apps you install can spy, albeit less effectively.
ignoramous 6y ago
Private DNS (DNS over TLS) also sends metrics to a Google endpoint on every network change, as a way to detect connectivity. AOSP is truly a surveillance software.
- rasz 6y ago
  Chrome used to have this neat little "helper" hidden in src/net/dns/host_resolver_impl.cc that would just by coincidence call hardcoded 8.8.8.8 every time DNS reply didnt contain A record, all behind the guise of "helping resolve navigation errors". Propagated to all other browsers using same codebase. https://www.reddit.com/r/vivaldibrowser/comments/a23071/how_private_is_vivaldi/eawqqg9/ https://www.reddit.com/r/vivaldibrowser/comments/a23071/how_... Looking it up now they rewrote this part of the browser, and either moved it somewhere else or obfuscated it better.
andysch 6y ago
I invite you to try iodéOS, where they stripped out Google's DNS & SUPL servers, and allow you to directly select the location module of your choice ..
- SubzeroCarnage 6y ago
  Does iodéOS disable sending the IMSI along with all SUPL requests? [0] What about A-GPS MSA handling? [1] [0] https://review.lineageos.org/c/LineageOS/android_frameworks_base/+/249219 https://review.lineageos.org/c/LineageOS/android_frameworks_... [1] https://en.wikipedia.org/wiki/A-GPS#Modes_of_operation https://en.wikipedia.org/wiki/A-GPS#Modes_of_operation
  - deleted 6y ago
    [deleted]
  - deleted 6y ago
    [deleted]
tinus_hn 6y ago
Be aware that downloading the GPS almanak, which is how AGPS gets a quick GPS fix when the device has been offline, does not necessarily reveal your location to anyone.
- kordlessagain 6y ago
  Vice was started by a madman who supports a tyrant. Why are we still allowing articles posted there to appear here?
croh 6y ago
Another worst thing about android is giving carte blanche to apps for accessing messages. Most of apps these days use OTP to validate phone number. To read OTP message automatically, they ask permission to access text-messages. I knew few of such apps who keep polling user's text-messages to server daily without user's knowledge.

izacus 6y ago

Hmm, wouldn't in that case Lineage be able to preinstall such service themselves? I'd expect them to?

Mediterraneo10 6y ago
No, the LineageOS devs say that their project does not aim to completely de-Google the OS, only remove Google Play Services and some Google applications like Maps. Thus, geolocation, DNS and login portal detection in LineageOS still use Google's servers.
- izacus 6y ago
  Ugh, that's very disappointing then, I've always advised Lineage to people who wanted to deGoogle their phones :/
  - andrepd 6y ago
    To be fair, lineage+microg is probably the best you can get while still keeping a reasonable level of convenience (that is, still running android and most popular apps).
    - andysch 6y ago
      agree. Even better with same reasonable level of convenience is iodé
  - prox 6y ago
    You are literally on a phone that was/is heavily subsidized by Google. They hold all the keys and own all the doors, if you want to degoogle, go Purism/Pinephone/Linuxphone.
  - jmnicolas 6y ago
    There's GrapheneOS if you have a Pixel 2+ or /e/ os for other phones.
    - orestarod 6y ago
      /e/ is based on LineageOS, not even the latest at that, and searching on it a bit smells a bit of BS.
- cassepipe 6y ago
  What about /e/ ? It's been a while I haven't heard about them.
  - dredmorbius 6y ago
    Least. Fucking. Searchable. Name. Ever. Arguable worse than R, C, or Word. "Gee, let's take the most frequently occurring letter in English usage, and bracket it with Web-significant non-text punctuation." "e Foundation" will find them. No idea on status/news. https://e.foundation https://e.foundation
  - jlkuester7 6y ago
    I follow Gaël Duval (the founder of /e/OS on Mastodon. https://mastodon.social/@gael https://mastodon.social/@gael He gives regular status updates and they seem to be making good progress. I played with /e/OS a long time ago when it first came out and found the microg integration to be excellent (have had trouble in the past getting LineageOS + microg to work...). I am planning to flash /e/OS onto a phone again soon to see the latest progress.
  - javierseballos 6y ago
    And i think its for the best. This ROM is a joke: outdated, the store is full of outdated or non-original apps. Its a lack of respect for their users to market a device as secure with an unencrypted ROM with bootloader unlocked
- srtjstjsj 6y ago
  OK, but it's weird to blame Google for Lineage's philosophical position. As it stands Google has contributed to LineagoOS far far more non-Googlr-dependent stuff than Lineage has.
0x_rs 6y ago
I am pretty sure MicroG Lineage builds have NLPs other than Google's own preinstalled and being prerooted (or easily rooted with the extra zip) should be easily interchangeable from their settings. Though this is mostly an annoyance since an user installing Lineage should already be a little comfortable with adb and a terminal, it seems another sad step towards locking down Android furthermore.

raxxorrax 6y ago

I always deactivate geolocation and I assume and hope it doesn't phone home to Google in that case. I still deactivate network if I don't need it. Android devices cannot really be trusted and it seems to be getting worse. Of course I am not using contact tracing either in this case, but I certainly won't allow Google to trace my location.

maxmunzel 6y ago
If I understand it correctly, contact tracing should rely on bluetooth only. Does it require location services and/or network on Android?
- raxxorrax 6y ago
  Sadly yes. It is probably a software component problem that bluetooth is bundled with location services, but without the separation from GPS, I have serious concerns about privacy, even if I think that I only use well behaved apps.
  - Phemist 6y ago
    Bluetooth and location services being bundled is a policy decision by Google. If one has a database filled with historical correlations between bluetooth devices "in range" and GPS coordinates, it is possible to get a pretty accurate fix on someone's location from the current devices that are in range. This is the reason why Google has bundled Bluetooth and GPS in one permission. Of course, the very fact that these permissions are bundled is the reason why it's feasible to keep such databases up-to-date, and why up-to-date databases provide a continuously stronger case why Bluetooth should be considered a type of location permission.. It would be totally possible to separate location permissions between "passive" location (e.g. triangulation through received GPS coordinates), and "active" location, e.g. inference of location through indirect measures and correlations with historical databases. Afaik it's now a system-wide setting to disallow said correlations, but offering app developers more fine-grained control would be better for all of us. Why does, for example, my Sony Bluetooth headset need my location just for updating some firmware..

est31 6y ago

Do you know how to disable network assisted geolocation on Android 10? I have Lineage OS based on that version and neither following the guide for Android 11 nor for Android 9 makes the option show up, and the guide for Android 10 somehow doesn't exist. Maybe it's disabled because I don't have gapps? https://support.google.com/accounts/answer/3467281?hl=en https://support.google.com/accounts/answer/3467281?hl=en

cassepipe 6y ago

Do you have any links/tips on how to become part of that minority of users that use Mozilla's service?

ForHackernews 6y ago
https://microg.org/ https://microg.org/ has implemented a pluggable network location provider service. If you flash MicroG on your device, you can then select Mozilla (or Apple or other) location backend providers.

dingaling 6y ago

> getting a GPS fix through network assistance still sends data to Google servers Well, that's not a GPS fix. If you want a traceless position fix, use GPS Navstar / Glonass / Beidu / Galileo. Yes it takes longer from cold start, but that's the trade-off for privacy.

nickcw 6y ago
Assuming it is the system I'm thinking of, it is all about sepeeding up the time to a first fix. Without it can be quite a few minutes to get a fix. https://en.m.wikipedia.org/wiki/Assisted_GPS https://en.m.wikipedia.org/wiki/Assisted_GPS

npteljes 6y ago

What is the case when you install LineageOS without google services? In my understanding, this takes care of the location provider problem. Of course you still have lots of google in your phone, which is the whole reason of the /e/ foundation for example.

xwolfi 6y ago

I have a Huawei without Google, and I can do geolocation, maybe you could try that too ? If you use google for search and huawei for map, they can't cross reference to each other since they're forbidden to talk to each others. I actually feel so much better without all the google stuff, weird no?

Mediterraneo10 6y ago
> I have a Huawei without Google, and I can do geolocation, maybe you could try that too ? I assume that even if Huawei’s Android sold in the West doesn't use Google Play Services, it still uses standard AOSP, and the issue is that Google geolocation (and some other use of Google servers) is hardcoded into AOSP.
jmnicolas 6y ago
I would be astonished if Huawei didn't have any spywares on their phones! Unless they fear the level of scrutiny they'll receive by the West. And even if the OS isn't spying, the apps you install can spy, albeit less effectively.

ignoramous 6y ago

Private DNS (DNS over TLS) also sends metrics to a Google endpoint on every network change, as a way to detect connectivity. AOSP is truly a surveillance software.

rasz 6y ago
Chrome used to have this neat little "helper" hidden in src/net/dns/host_resolver_impl.cc that would just by coincidence call hardcoded 8.8.8.8 every time DNS reply didnt contain A record, all behind the guise of "helping resolve navigation errors". Propagated to all other browsers using same codebase. https://www.reddit.com/r/vivaldibrowser/comments/a23071/how_private_is_vivaldi/eawqqg9/ https://www.reddit.com/r/vivaldibrowser/comments/a23071/how_... Looking it up now they rewrote this part of the browser, and either moved it somewhere else or obfuscated it better.

andysch 6y ago

I invite you to try iodéOS, where they stripped out Google's DNS & SUPL servers, and allow you to directly select the location module of your choice ..

SubzeroCarnage 6y ago
Does iodéOS disable sending the IMSI along with all SUPL requests? [0] What about A-GPS MSA handling? [1] [0] https://review.lineageos.org/c/LineageOS/android_frameworks_base/+/249219 https://review.lineageos.org/c/LineageOS/android_frameworks_... [1] https://en.wikipedia.org/wiki/A-GPS#Modes_of_operation https://en.wikipedia.org/wiki/A-GPS#Modes_of_operation
- deleted 6y ago
  [deleted]
- deleted 6y ago
  [deleted]

tinus_hn 6y ago

Be aware that downloading the GPS almanak, which is how AGPS gets a quick GPS fix when the device has been offline, does not necessarily reveal your location to anyone.

kordlessagain 6y ago
Vice was started by a madman who supports a tyrant. Why are we still allowing articles posted there to appear here?

croh 6y ago

Another worst thing about android is giving carte blanche to apps for accessing messages. Most of apps these days use OTP to validate phone number. To read OTP message automatically, they ask permission to access text-messages. I knew few of such apps who keep polling user's text-messages to server daily without user's knowledge.