10 ms·

I doubt it, I bought a new Sonicare toothbrush and it came with an app to supposedly help you track your brushing or whatever; I was curious so I installed it.

by enlyth 5y ago

I doubt it, I bought a new Sonicare toothbrush and it came with an app to supposedly help you track your brushing or whatever; I was curious so I installed it. After updating my toothbrush firmware, I got a prompt on my phone asking for it to track my location. Why does my toothbrush need to know my location constantly?

1ris 5y ago
because bluetooth and gps are still not separate permissions, i guess?
- 542458 5y ago
  On Android at least this seems to be the case. Bluetooth leaks data that can be used to locate you, so Android just ties the two permissions together. https://android.stackexchange.com/questions/160479/why-do-i-need-to-turn-on-location-services-to-pair-with-a-bluetooth-device https://android.stackexchange.com/questions/160479/why-do-i-... IMO this is counterintuitive for users. It would be like telling people on windows “This app wants to wipe your C drive” every time an app asks for admin permissions - it could wipe your C drive, but that’s not what it’s asking for. IMO the permissions should be separate, but the approval modal should note that info about leaking location.
  - gruez 5y ago
    >IMO this is counterintuitive for users. It would be like telling people on windows “This app wants to wipe your C drive” every time an app asks for admin permissions - it could wipe your C drive, but that’s not what it’s asking for. Well the flip side is that they don't warn the users enough, and they get roasted by the media for "not sufficiently warning the users" or "being complicit in user tracking" or whatever.
  - freeone3000 5y ago
    By granting an app a permission, it can then do that thing. There's no intent detection possible. Any app with full filesystem access could wipe your C drive. A new Bluetooth API and access model needs to be devised to fix the information leakage present in scanning and beacons -- how can we prevent fixed-position radio beacons from being picked up by people scanning for new gadgets?
deleted 5y ago
[deleted]
anyfoo 5y ago
I got that, too. I said "okay, let's try it out", but the App wanted me to register and log in before even being able to use it. Even with refusing location tracing, I just don't feel like telling Philips when I brush my teeth, and how. Luckily the toothbrush works perfectly without the App or any Bluetooth connection at all, wouldn't have even noticed it had Bluetooth if I hadn't looked at the packaging. My treadmill was a bit different: While unpacking and building, I saw what was probably 8 or 9 notices claiming that the treadmill is "locked", has to be unlocked by registering it with iFit, and will not work otherwise. It was everywhere: On the packaging, as a piece of paper inside, in the manual, on the treadmill itself... New York Times had an article mentioning you just have to hold down the "iFit" button for 20 or 30 seconds, and that unlocked it permanently. Without having to pair with anything. Weird world.
shadilay 5y ago
What model is it? I recently bought a sonicare and it didn't come with an app.
- enlyth 5y ago
  DiamondClean 9000
GeneralTspoon 5y ago
Bluetooth permissions are grouped in under the Location permissions on both iOS & Android. This is because Bluetooth _could_ be used to determine a user's location by using beacons and constantly scanning or whatever. But this has led to nothing but endless confusion for users (and constantly gets highlighted as suspicious in online forums), so they really need to come up with better wording. Like "This app is requesting Bluetooth permissions, which _could_ be used to determine your location".
- ajsnigrutin 5y ago
  This should be a separate permission, asking to do a one-time scan for bluetooth devices with limited scope (predefined OUIs). Same for wifi scanning. I have no idea why google bundled those together, instead of treating them as separate things alltogether.
- sjtindell 5y ago
  Today I learned, thank you. I’ve denied many an app for this reason.
- inetknght 5y ago
  > so they really need to come up with better wording. No, they need to come up with a better way of communication that doesn't involve leaking permission.
  - RandomBK 5y ago
    We can thank Google and the various other companies mapping out wireless IDs for this being an uphill battle. Generally speaking, if you want wireless communication, you'll need some way of uniquely identifying each participant in the wireless space. Data aggregators can then drive around on the streets and associate device IDs with physical addresses. A bluetooth communications setup (or future alternative) will want to be able to know what device IDs are around it. (You want to connect to your wireless toothbrush - not your neighbors). A malicious developer can then use that access to the ID list, compare it against databases of known ID locations, and get a really good guesstimate of your location.
bordercases 5y ago
Go back to the old ways: keep a paper and make tick marks.

by enlyth 5y ago

1ris 5y ago

because bluetooth and gps are still not separate permissions, i guess?

542458 5y ago
On Android at least this seems to be the case. Bluetooth leaks data that can be used to locate you, so Android just ties the two permissions together. https://android.stackexchange.com/questions/160479/why-do-i-need-to-turn-on-location-services-to-pair-with-a-bluetooth-device https://android.stackexchange.com/questions/160479/why-do-i-... IMO this is counterintuitive for users. It would be like telling people on windows “This app wants to wipe your C drive” every time an app asks for admin permissions - it could wipe your C drive, but that’s not what it’s asking for. IMO the permissions should be separate, but the approval modal should note that info about leaking location.
- gruez 5y ago
  >IMO this is counterintuitive for users. It would be like telling people on windows “This app wants to wipe your C drive” every time an app asks for admin permissions - it could wipe your C drive, but that’s not what it’s asking for. Well the flip side is that they don't warn the users enough, and they get roasted by the media for "not sufficiently warning the users" or "being complicit in user tracking" or whatever.
- freeone3000 5y ago
  By granting an app a permission, it can then do that thing. There's no intent detection possible. Any app with full filesystem access could wipe your C drive. A new Bluetooth API and access model needs to be devised to fix the information leakage present in scanning and beacons -- how can we prevent fixed-position radio beacons from being picked up by people scanning for new gadgets?

deleted 5y ago

[deleted]

anyfoo 5y ago

I got that, too. I said "okay, let's try it out", but the App wanted me to register and log in before even being able to use it. Even with refusing location tracing, I just don't feel like telling Philips when I brush my teeth, and how. Luckily the toothbrush works perfectly without the App or any Bluetooth connection at all, wouldn't have even noticed it had Bluetooth if I hadn't looked at the packaging. My treadmill was a bit different: While unpacking and building, I saw what was probably 8 or 9 notices claiming that the treadmill is "locked", has to be unlocked by registering it with iFit, and will not work otherwise. It was everywhere: On the packaging, as a piece of paper inside, in the manual, on the treadmill itself... New York Times had an article mentioning you just have to hold down the "iFit" button for 20 or 30 seconds, and that unlocked it permanently. Without having to pair with anything. Weird world.

shadilay 5y ago

What model is it? I recently bought a sonicare and it didn't come with an app.

enlyth 5y ago
DiamondClean 9000

GeneralTspoon 5y ago

Bluetooth permissions are grouped in under the Location permissions on both iOS & Android. This is because Bluetooth _could_ be used to determine a user's location by using beacons and constantly scanning or whatever. But this has led to nothing but endless confusion for users (and constantly gets highlighted as suspicious in online forums), so they really need to come up with better wording. Like "This app is requesting Bluetooth permissions, which _could_ be used to determine your location".

ajsnigrutin 5y ago
This should be a separate permission, asking to do a one-time scan for bluetooth devices with limited scope (predefined OUIs). Same for wifi scanning. I have no idea why google bundled those together, instead of treating them as separate things alltogether.
sjtindell 5y ago
Today I learned, thank you. I’ve denied many an app for this reason.
inetknght 5y ago
> so they really need to come up with better wording. No, they need to come up with a better way of communication that doesn't involve leaking permission.
- RandomBK 5y ago
  We can thank Google and the various other companies mapping out wireless IDs for this being an uphill battle. Generally speaking, if you want wireless communication, you'll need some way of uniquely identifying each participant in the wireless space. Data aggregators can then drive around on the streets and associate device IDs with physical addresses. A bluetooth communications setup (or future alternative) will want to be able to know what device IDs are around it. (You want to connect to your wireless toothbrush - not your neighbors). A malicious developer can then use that access to the ID list, compare it against databases of known ID locations, and get a really good guesstimate of your location.

bordercases 5y ago

Go back to the old ways: keep a paper and make tick marks.