3 ms·

I heard on an interview somewhere a security advocate mention that android phones "phones home" basically everything you do every so often (GPS location, app da

by bko 5y ago

I heard on an interview somewhere a security advocate mention that android phones "phones home" basically everything you do every so often (GPS location, app data, even voices recordings). But I couldn't find that anywhere apart from a few "malfunctioning" google nest devices. Is there any resource about what exactly is communicated to google while using android phones? Everything I read is either conspiracy theories or corporate speak. [edit] The interview in which the claims were made was with Dr Robert Epstein if that makes any difference https://open.spotify.com/episode/4q0cNkAHQQMBTu4NmeNW7E https://open.spotify.com/episode/4q0cNkAHQQMBTu4NmeNW7E

sixothree 5y ago
I think one of the problems is "what is google" and "what is phoning home". So many of these services make simple requests that wouldn't be considered "phoning home" but absolutely fall into that category. Additionally, the number of google products and the number of calls being made is vast.
- bko 5y ago
  I don't expect apps to be collecting data when not in the app. I think I get a permission warning like "this device uses GPS - allow when in app, allow in background, etc" But with android, I just want to know if there is a log of every place I go for instance and does this get sent to Google periodically. This is outside of the map app. Also, I definitely want to know if it's recording data any time apart for when the microphone indicator is on. This is on an OS level. I know there's some nuances, but I think what I am asking for is pretty basic.
  - izacus 5y ago
    > But with android, I just want to know if there is a log of every place I go for instance and does this get sent to Google periodically. This is outside of the map app. There's two ways this can happen: - There's a feature called "Location History" which does exactly what it says - reports your location periodically to Google. You can disable it under Location settings on Android. - Your location may leak via IP requests in background - the most common way would be via persistent connection to FCM servers (servers that provide push messages, analogous to Apples Push notification services) or when the phone background syncs. Similarlly, you can leak your location to websites by simply browsing with your phone. > Also, I definitely want to know if it's recording data any time apart for when the microphone indicator is on. This is on an OS level. As far as I know there new microphone switches and notifications are implemented deep enough in AOSP code that a piece of software can't easily open the microphones without triggering that notification.
    - 1vuio0pswjnm7 5y ago
      What about IP geolocation "leaks" to time.android.com and time.apple.com It can be periodic. No way to turn it off.
      - izacus 5y ago
        About the same thing - same for internet connectivity checks which go to Apple/Google as well.
fsflover 5y ago
https://news.ycombinator.com/item?id=26639261 https://news.ycombinator.com/item?id=26639261
kllrnohj 5y ago
Android & iOS both phone home your GPS location combined with things like wifi points that were visible in that area. And on iOS also things like nearby bluetooth devices - this is how eg. AirTags work. Apple re-purposed their entire userbase to be GPS & bluetooth phone-home minions to power that network, and nobody was asked if they were OK with that. For both Android & iOS there's an "off" setting buried somewhere to disable this phone-home tracking. As for "phones home" app data... I mean, that's what cloud sync & backups are. It doesn't necessarily mean that Google or Apple have access to that data, the device could encrypt it with your user passphrase before sending it. In theory. In practice they probably both do because otherwise password recovery systems kinda don't really work. If you can do a password reset and still access your data, then so could the company hosting that data. But for both of those this is that awkward spot where very useful features necessarily require something that can sound very malicious depending on how it's described (and could actually be very malicious depending on how it's actually used)

by bko 5y ago

sixothree 5y ago

I think one of the problems is "what is google" and "what is phoning home". So many of these services make simple requests that wouldn't be considered "phoning home" but absolutely fall into that category. Additionally, the number of google products and the number of calls being made is vast.

bko 5y ago
I don't expect apps to be collecting data when not in the app. I think I get a permission warning like "this device uses GPS - allow when in app, allow in background, etc" But with android, I just want to know if there is a log of every place I go for instance and does this get sent to Google periodically. This is outside of the map app. Also, I definitely want to know if it's recording data any time apart for when the microphone indicator is on. This is on an OS level. I know there's some nuances, but I think what I am asking for is pretty basic.
- izacus 5y ago
  > But with android, I just want to know if there is a log of every place I go for instance and does this get sent to Google periodically. This is outside of the map app. There's two ways this can happen: - There's a feature called "Location History" which does exactly what it says - reports your location periodically to Google. You can disable it under Location settings on Android. - Your location may leak via IP requests in background - the most common way would be via persistent connection to FCM servers (servers that provide push messages, analogous to Apples Push notification services) or when the phone background syncs. Similarlly, you can leak your location to websites by simply browsing with your phone. > Also, I definitely want to know if it's recording data any time apart for when the microphone indicator is on. This is on an OS level. As far as I know there new microphone switches and notifications are implemented deep enough in AOSP code that a piece of software can't easily open the microphones without triggering that notification.
  - 1vuio0pswjnm7 5y ago
    What about IP geolocation "leaks" to time.android.com and time.apple.com It can be periodic. No way to turn it off.
    - izacus 5y ago
      About the same thing - same for internet connectivity checks which go to Apple/Google as well.

fsflover 5y ago

https://news.ycombinator.com/item?id=26639261 https://news.ycombinator.com/item?id=26639261

kllrnohj 5y ago

Android & iOS both phone home your GPS location combined with things like wifi points that were visible in that area. And on iOS also things like nearby bluetooth devices - this is how eg. AirTags work. Apple re-purposed their entire userbase to be GPS & bluetooth phone-home minions to power that network, and nobody was asked if they were OK with that. For both Android & iOS there's an "off" setting buried somewhere to disable this phone-home tracking. As for "phones home" app data... I mean, that's what cloud sync & backups are. It doesn't necessarily mean that Google or Apple have access to that data, the device could encrypt it with your user passphrase before sending it. In theory. In practice they probably both do because otherwise password recovery systems kinda don't really work. If you can do a password reset and still access your data, then so could the company hosting that data. But for both of those this is that awkward spot where very useful features necessarily require something that can sound very malicious depending on how it's described (and could actually be very malicious depending on how it's actually used)