10 ms·

What data do the Google Dialer and Messages apps on Android send to Google? [pdf]

233 points by exceptione 5y ago

anotherhue 5y ago
What's extra embarrassing is that none of us did this ourselves. Maybe we can look forward to a "consumer reports" style organisation or CI/CD system that tests and tracks apps. It wouldn't be used of course, but a little sunlight can do wonders.
Melatonic 5y ago
Does messages still do this if you uncheck the box for "help make messages better" ? Because that seems like it COULD be the opt out for this. Or not - hard to say.
exceptione 5y ago
This is a serious report from a serious research institute (Trinity College Dublin). There was previously not much insight into data harvesting by Google Play Services. The terrifying result is that google can easily see (1) which sender sends (2) what (3) to who at (4) what time, and (5) when the user uses the app (6) for how long. It does so by even sending phone numbers and Android ID. Reportedly, Google will clarify something in some legal text after this report came out. I would expect this would be totally illegal in at least the EU. It is about time top executives will receive jail time for these kind of breaches. From the abstract: We report on measurements of the data sent to Google by the Google Messages and Google Dialer apps on an Android hand- set. We find that these apps tell Google when message/phone calls are made/received. The data sent by Google Messages includes a hash of the message text, allowing linking of sender and receiver in a message exchange, and by Google Dialer the call time and duration, again allowing linking of the two handsets engaged in a phone call. Phone numbers are also sent to Google. In addition, the timing and duration of user interactions with the apps are sent to Google. There is no opt out from this data collection. The data is sent via two channels, the Google Play Services (i) Clearcut logger and (ii) Google/Firebase Analytics. This study is therefore one of the first to cast light on the actual telemetry data sent by Google Play Services, which to date has largely been opaque.
- Tepix 5y ago
  > It is about time top executives will receive jail time for these kind of breaches. I'm afraid jail time is not yet provided for in the GDPR.
  - exceptione 5y ago
    The lack of serious consequences of doing harmful business is indeed one of the big issues we have got in western society imho. Breaching human rights like privacy is just a risk trade-off where the company makes a cold calculation of weighted costs. Companies are well protected against individuals by means of juridical and financial power imbalance. Fines are usually something to laugh at and well worth the cost. Even if not, the burden is on the company and not the executive. We need to have a system where the current executives get jail time for these kind of crimes. This ensures that executives will only accept such a role when they are certain that the company is "clean", i.e. they wont risk jail time because of previous CEO's fuckups.
    - hamsamrma 5y ago
      not to disagree, but imo it is the main purpose of a corporation to shield individuals from consequences hence increasing the level of acceptable risk and with it the velocity of business developement. (all for the greater good)
      - mikem170 5y ago
        The liability shield may have made better sense when corporations were actually given charters because they were expected to serve a public good. it doesn't seem to be the case where that is true any more. If it ever was? Now it seems that corporations only exist to make money. Public good be damned.
  - arianvanp 5y ago
    Gross negligence of Data Protection can be prosecuted under Computer Criminality acts by the respective Data Protection Office. There is precedent for this in the UK. However this is not laid out in the European directives but usually in the local implementations of the directives.
londons_explore 5y ago
Thankyou to whoever did this research and wrote it up... I feel like this is the start of Google being another billion dollars poorer, and EU taxpayers being each a few euros richer...
- kenoph 5y ago
  I did some research on PII being harvested by Android apps. TL;DR: The EU could pay a couple of reverse engineers for 2 months and print money out of fines. I was shocked to discover that (back then?) apps could just straight up read the list of user accounts on the phone without any special permission... Which is mostly fine, except many apps use your email/phone-number as account name or description. Same goes for Wi-Fi SSID and other things.
dang 5y ago
The submitted title broke the site guidelines about editorializing. (Submitted title was 'Google Dialer and SMS App steal all conversation metadata and content hashes [pdf]'.) The rule, from https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html, is: "Please use the original title, unless it is misleading or linkbait; don't editorialize." If you want to say what you think is important about an article, that's fine, but do it by adding a comment to the thread. Then your view will be on a level playing field with everyone else's: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&sort=byDate&type=comment&query=%22level%20playing%20field%22%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
- Tepix 5y ago
  I think the original title is less informative than the editorialized one. Is it link bait? Probably not.
gundamdoubleO 5y ago
For sending SMS using Android I heavily recommend QKSMS over the Google/Android defaults.(https://github.com/moezbhatti/qksms https://github.com/moezbhatti/qksms) I'm sure there are other OSS alternatives but this one just works for me.
- deleted 5y ago
  [deleted]
- Gasp0de 5y ago
  I use Signal as my only messaging app. If someone doesn't have Signal installed it will automagically fall back to unencrypted SMS and show this using an open lock symbol and a grey send button.
- exceptione 5y ago
  Does this function without the Google Play Service?
  - greazy 5y ago
    It doesn't from what i can see on f-driod
  - easrng 5y ago
    I used it without Google Play Services before, but now I just use Signal (Works with SMS too) and it also works without Play Services. Note that if your ROM includes Play Services and you used adb to uninstall it you'll need to reinstall and disable it to get through setup (Something about their detection logic is off).
- maxloh 5y ago
  Why not the one in aosp?
  - cf100clunk 5y ago
    QKMS has a richer feature set than any AOSP sms/mms apps I've seen.
CamelRocketFish 5y ago
Fantastic research. Thank you to the researchers.
throwaway473825 5y ago
Basically nobody uses Google Messages in Europe. Still, if Google breaks the law, there will be consequences.
- tgv 5y ago
  But do we know that it's the app and not an underlying library that other messaging apps use too?
- mathieubordere 5y ago
  I use it because I quite like the spam detection feature.
  - kettleballroll 5y ago
    What kind of spam detection do you mean, isn't this a messaging service?
    - tompagenet2 5y ago
      Yes. You can (and sadly do) receive spam SMS. Google Messages is quite good at spotting them
  - andrew_ 5y ago
    This is also why I still use it. Of all the SMS apps I've tried, it also has the most visually pleasing UX (for me personally). I get an incredible amount of spoofed SMS spam, most of it related to off-market real estate nonsense. Messages has been the only app successful in blocking them.
- simsla 5y ago
  Source? I'm in Europe, and it's on my phone.
  - IshKebab 5y ago
    Yeah but what do you use it for apart from receiving verification codes?
mysterydip 5y ago
What would the purpose of collecting such information be from a "we only use this for better targeting ads" perspective? Establishing relationships in the case of "if someone you talk to regularly is interested in xyz you might be too"?
- charcircuit 5y ago
  From the article: >Google also provided clarification on the purposes of some of the data collection observed. Namely: >1) The message hash is collected for detecting message sequencing bugs. >2) Phone numbers are collected to improve regex pattern matching for automatic recognition of one-time pass- words sent over RCS. Messages automatically recognizes incoming One-Time Password (OTP) codes to avoid the user having to fill them in. This can be a frequent point of failure and the phone number data is used to improve recognition by providing ground-truth based on known OTP sender numbers. > 3) The ICCID data is used to support Google Fi. > 4) Firebase Analytics logging of events (not including phone numbers) is used to measure the effectiveness of app download promotions (for Messages and Dialer specif- ically). Namely, to measure not only whether the app was downloaded but also whether it was used once downloaded.
  - everdrive 5y ago
    >Messages automatically recognizes incoming One-Time Password (OTP) codes to avoid the user having to fill them in. It's a shame that user laziness is cause for lack of privacy.
    - ThePowerOfFuet 5y ago
      >It's a shame that user laziness is cause for lack of privacy. This detection is done entirely on-device. In what way is it injurious to the user's privacy?
      - TingPing 5y ago
        As they said, they collect phone numbers and this feature was the excuse.
random_dork1 5y ago
εxodus (privacy audit platform for Android applications) has good reporting on this kind of stuff: https://reports.exodus-privacy.eu.org/en/reports/com.google.android.dialer/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.google....
lelandfe 5y ago
> It is not possible to proceed to view the Messages app privacy policy without first agreeing to the additional Google Chrome terms and conditions This entire report is damning, but I thought this was an especially silly tidbit towards the bottom of the report. I wonder if this is even legal.
pdenton 5y ago
I recently tcpdump'd an Android 11 device going through the initial setup. About 60MiB was downloaded just to get to the launcher. It contacts not only Google, but the manufacturer and Microsoft, as well as a few domains I couldn't recognize. It's impossible to install privacy tools (like AFWall) before being subjected to built-in spyware. The bootloader was locked by default and could only be unlocked after creating a Google account (which involves accepting their terms and conditions). It was also impossible to go through initial setup using a proxy server. It did use the proxy server I had setup to contact Google, but it wouldn't accept the connection as having internet connectivity (and refuse to go any further) until traffic was routed through the default gateway. I think it would be reasonable to add warnings to so-called "smart" devices the same way as packs of cigarettes. It'll never happen, sadly. If anything, the Powers That Be would rather make it illegal to "circumvent" or "tamper" with the locked-down computers that we used to own.
- sdoering 5y ago
  Offtopic: I recently tried to setup a Bluetooth speaker my mom had bought (with me at her side). I had carefully looked at the packaging and there were no red flags visible. At her flat I tried to connect it to her laptop. It just wasn't visible. I looked at the user manual. For initial setup you had to install the vendors app (and accept it to transmit any filename you listen to, any streaming account, any song/audiobook/radio station you are listening to. There was now way of getting it to just connect via Bluetooth without allowing full data harvesting. It instantly went back into its packaging, back to the shop. In hindsight I should probably have filed a GDPR complaint as this goes against the GDPR as the data tracking is not necessary for the functionality (Bluetooth connection). And was not available as information before I bought it.
  - frankzander 5y ago
    What manufacturer did you buy?
    - denysvitali 5y ago
      I remember reading somewhere that Bose did something similar, but take this with a bit of salt as I might be confusing them. What I know for sure is that Sonos does it as well - but they aren't bluetooth speakers
nerdjon 5y ago
This is what I hate most about Google and Facebook. If you want to choose to let them gather all of your data, fine. I disagree with it but it is ultimately your choice. But as someone who has made every effort to remove both of these companies from my life as much as possible, if I communicate with someone who uses Android or someone who allows Facebook complete access to their contacts and other data... those companies still get MY data without my consent. Somehow it has become legal for these companies to allow someone else to consent for them to get my data.
- Tijdreiziger 5y ago
  > I disagree with it but it is ultimately your choice. Is it? If you want a modern smartphone experience (I don't mean one from 2005) you only get to choose which option you find 'less bad' between Apple and Google.
  - Vixel 5y ago
    Apple (without any Google or FB apps installed) is definitely the lesser of two evils in that scenario.
    - deleted 5y ago
      [deleted]
    - Tijdreiziger 5y ago
      Apple collects less data, but they definitely still collect a lot. They're also extremely user-hostile (you can't choose what you want to install, only what Apple wants you to install). In fact, the author of the present study published an article on the former topic last year: > We investigate what data iOS on an iPhone shares with Apple and what data Google Android on a Pixel phone shares with Google. We find that even when minimally configured and the handset is idle both iOS and Google Android share data with Apple/Google on average every 4.5 mins. The phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc are shared with Apple and Google. Both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this. When a SIM is inserted both iOS and Google Android send details to Apple/Google. iOS sends the MAC addresses of nearby devices, e.g. other handsets and the home gateway, to Apple together with their GPS location. Users have no opt out from this and currently there are few, if any, realistic options for preventing this data sharing. Leith, D. J. (2021, September). Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google. URL: https://www.scss.tcd.ie/doug.leith/apple_google.pdf https://www.scss.tcd.ie/doug.leith/apple_google.pdf
aasasd 5y ago
Personally I'm waiting for a report showing that Google still swipes the location in some ways even when ‘location history’ and whatever the other toggle is, are both turned off. Because of course they do. Reminder: US police use Google as a database of people who were at a particular place at a certain time. Of which people by definition most aren't subjects of investigation: https://www.nytimes.com/2019/04/13/technology/google-sensorvault-location-tracking.html https://www.nytimes.com/2019/04/13/technology/google-sensorv...
zibzab 5y ago
Question: what happens if you use a third party dialer (e.g. Samsung)?
sizzle 5y ago
I hope the EU slaps google down hard for this egregious spying of their citizen and claiming ignorance is not a get out of jail free card. Now please audit iMessage and iPhone’s dialer, I’ll pay to help commission this important work!
briandear 5y ago
Is anyone surprised?
- veam 5y ago
  No one should be.
- HWR_14 5y ago
  I was a tad surprised by: > when a request was made through Google Takeout for the Google Account data associated with the apps used for testing, the data Google provided did not include the telemetry data observed. That google collects it is unsurprising. That they deny having it is somewhat surprising to me.
WaxedChewbacca 5y ago
hn_go_brrrrr 5y ago
I'm normally pretty tolerant of Google's data collection because I've seen the internal privacy protections firsthand. Yes, some collection of ML jobs know everything about you. No, humans don't get the same access. That said, this is disgraceful. I'm amazed that someone thought this was a good idea. I already use Signal for SMS, but I guess I need to find a new dialer app now. Anyone have suggestions?
- dheera 5y ago
  For talking to businesses, claim you're deaf and that you need to communicate by e-mail or chat interface. Use Signal for voice calls with friends.
  - alexb_ 5y ago
    The fact that you would even begin to consider this anywhere close to a viable option shows how insanely out of touch with actual people you are.
    - dheera 5y ago
      Have you tried? I had to cancel a Comcast account once by e-mail and they kept referring me to call their retention department so I told them I was deaf and wasn't able to call. It worked. You can also threaten to get lawyers involved, that often helps deal with shitty customer service and they just give you what you want. Honestly this is the kind of stuff Google Assistant should be automating with piles of conversational data, not some stupid haircut appointment. They have the data to know when is the optimal time to mention some hypothetical lawyers and can leverage that data to engineer the conversation on behalf of and in favor of the user.
      - alexb_ 5y ago
        >engineer the conversation on behalf of and in favor of the user. I wish I had your optimism... should a system exist, businesses will be the one using it to find the optimal time to charge you more money. Just look at what they are doing with Crisis Text Line - your brain is being completely engineered by big tech. Proprietary technology is developed not to solve problems or make the world better, it is developed to make as much money for businesses as they possibly can.
ghoward 5y ago
Thank you for the link! Dumb shill, but I have a Twitter account to collect instances of tech companies doing shady stuff. It's called "Programmers Against Humanity" (@software_crimes), and I would love if people could send me more. I want to bring awareness to how tech companies harm us.

233 points by exceptione 5y ago

What's extra embarrassing is that none of us did this ourselves. Maybe we can look forward to a "consumer reports" style organisation or CI/CD system that tests and tracks apps. It wouldn't be used of course, but a little sunlight can do wonders.

Melatonic 5y ago

Does messages still do this if you uncheck the box for "help make messages better" ? Because that seems like it COULD be the opt out for this. Or not - hard to say.

exceptione 5y ago

This is a serious report from a serious research institute (Trinity College Dublin). There was previously not much insight into data harvesting by Google Play Services. The terrifying result is that google can easily see (1) which sender sends (2) what (3) to who at (4) what time, and (5) when the user uses the app (6) for how long. It does so by even sending phone numbers and Android ID. Reportedly, Google will clarify something in some legal text after this report came out. I would expect this would be totally illegal in at least the EU. It is about time top executives will receive jail time for these kind of breaches. From the abstract: We report on measurements of the data sent to Google by the Google Messages and Google Dialer apps on an Android hand- set. We find that these apps tell Google when message/phone calls are made/received. The data sent by Google Messages includes a hash of the message text, allowing linking of sender and receiver in a message exchange, and by Google Dialer the call time and duration, again allowing linking of the two handsets engaged in a phone call. Phone numbers are also sent to Google. In addition, the timing and duration of user interactions with the apps are sent to Google. There is no opt out from this data collection. The data is sent via two channels, the Google Play Services (i) Clearcut logger and (ii) Google/Firebase Analytics. This study is therefore one of the first to cast light on the actual telemetry data sent by Google Play Services, which to date has largely been opaque.

Tepix 5y ago
> It is about time top executives will receive jail time for these kind of breaches. I'm afraid jail time is not yet provided for in the GDPR.
- exceptione 5y ago
  The lack of serious consequences of doing harmful business is indeed one of the big issues we have got in western society imho. Breaching human rights like privacy is just a risk trade-off where the company makes a cold calculation of weighted costs. Companies are well protected against individuals by means of juridical and financial power imbalance. Fines are usually something to laugh at and well worth the cost. Even if not, the burden is on the company and not the executive. We need to have a system where the current executives get jail time for these kind of crimes. This ensures that executives will only accept such a role when they are certain that the company is "clean", i.e. they wont risk jail time because of previous CEO's fuckups.
  - hamsamrma 5y ago
    not to disagree, but imo it is the main purpose of a corporation to shield individuals from consequences hence increasing the level of acceptable risk and with it the velocity of business developement. (all for the greater good)
    - mikem170 5y ago
      The liability shield may have made better sense when corporations were actually given charters because they were expected to serve a public good. it doesn't seem to be the case where that is true any more. If it ever was? Now it seems that corporations only exist to make money. Public good be damned.
- arianvanp 5y ago
  Gross negligence of Data Protection can be prosecuted under Computer Criminality acts by the respective Data Protection Office. There is precedent for this in the UK. However this is not laid out in the European directives but usually in the local implementations of the directives.

londons_explore 5y ago

Thankyou to whoever did this research and wrote it up... I feel like this is the start of Google being another billion dollars poorer, and EU taxpayers being each a few euros richer...

kenoph 5y ago
I did some research on PII being harvested by Android apps. TL;DR: The EU could pay a couple of reverse engineers for 2 months and print money out of fines. I was shocked to discover that (back then?) apps could just straight up read the list of user accounts on the phone without any special permission... Which is mostly fine, except many apps use your email/phone-number as account name or description. Same goes for Wi-Fi SSID and other things.

dang 5y ago

The submitted title broke the site guidelines about editorializing. (Submitted title was 'Google Dialer and SMS App steal all conversation metadata and content hashes [pdf]'.) The rule, from https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html, is: "Please use the original title, unless it is misleading or linkbait; don't editorialize." If you want to say what you think is important about an article, that's fine, but do it by adding a comment to the thread. Then your view will be on a level playing field with everyone else's: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&sort=byDate&type=comment&query=%22level%20playing%20field%22%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...

Tepix 5y ago
I think the original title is less informative than the editorialized one. Is it link bait? Probably not.

gundamdoubleO 5y ago

For sending SMS using Android I heavily recommend QKSMS over the Google/Android defaults.(https://github.com/moezbhatti/qksms https://github.com/moezbhatti/qksms) I'm sure there are other OSS alternatives but this one just works for me.

deleted 5y ago
[deleted]
Gasp0de 5y ago
I use Signal as my only messaging app. If someone doesn't have Signal installed it will automagically fall back to unencrypted SMS and show this using an open lock symbol and a grey send button.
exceptione 5y ago
Does this function without the Google Play Service?
- greazy 5y ago
  It doesn't from what i can see on f-driod
- easrng 5y ago
  I used it without Google Play Services before, but now I just use Signal (Works with SMS too) and it also works without Play Services. Note that if your ROM includes Play Services and you used adb to uninstall it you'll need to reinstall and disable it to get through setup (Something about their detection logic is off).
maxloh 5y ago
Why not the one in aosp?
- cf100clunk 5y ago
  QKMS has a richer feature set than any AOSP sms/mms apps I've seen.

CamelRocketFish 5y ago

Fantastic research. Thank you to the researchers.

throwaway473825 5y ago

Basically nobody uses Google Messages in Europe. Still, if Google breaks the law, there will be consequences.

tgv 5y ago
But do we know that it's the app and not an underlying library that other messaging apps use too?
mathieubordere 5y ago
I use it because I quite like the spam detection feature.
- kettleballroll 5y ago
  What kind of spam detection do you mean, isn't this a messaging service?
  - tompagenet2 5y ago
    Yes. You can (and sadly do) receive spam SMS. Google Messages is quite good at spotting them
- andrew_ 5y ago
  This is also why I still use it. Of all the SMS apps I've tried, it also has the most visually pleasing UX (for me personally). I get an incredible amount of spoofed SMS spam, most of it related to off-market real estate nonsense. Messages has been the only app successful in blocking them.
simsla 5y ago
Source? I'm in Europe, and it's on my phone.
- IshKebab 5y ago
  Yeah but what do you use it for apart from receiving verification codes?

mysterydip 5y ago

What would the purpose of collecting such information be from a "we only use this for better targeting ads" perspective? Establishing relationships in the case of "if someone you talk to regularly is interested in xyz you might be too"?

charcircuit 5y ago
From the article: >Google also provided clarification on the purposes of some of the data collection observed. Namely: >1) The message hash is collected for detecting message sequencing bugs. >2) Phone numbers are collected to improve regex pattern matching for automatic recognition of one-time pass- words sent over RCS. Messages automatically recognizes incoming One-Time Password (OTP) codes to avoid the user having to fill them in. This can be a frequent point of failure and the phone number data is used to improve recognition by providing ground-truth based on known OTP sender numbers. > 3) The ICCID data is used to support Google Fi. > 4) Firebase Analytics logging of events (not including phone numbers) is used to measure the effectiveness of app download promotions (for Messages and Dialer specif- ically). Namely, to measure not only whether the app was downloaded but also whether it was used once downloaded.
- everdrive 5y ago
  >Messages automatically recognizes incoming One-Time Password (OTP) codes to avoid the user having to fill them in. It's a shame that user laziness is cause for lack of privacy.
  - ThePowerOfFuet 5y ago
    >It's a shame that user laziness is cause for lack of privacy. This detection is done entirely on-device. In what way is it injurious to the user's privacy?
    - TingPing 5y ago
      As they said, they collect phone numbers and this feature was the excuse.

random_dork1 5y ago

εxodus (privacy audit platform for Android applications) has good reporting on this kind of stuff: https://reports.exodus-privacy.eu.org/en/reports/com.google.android.dialer/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.google....

lelandfe 5y ago

> It is not possible to proceed to view the Messages app privacy policy without first agreeing to the additional Google Chrome terms and conditions This entire report is damning, but I thought this was an especially silly tidbit towards the bottom of the report. I wonder if this is even legal.

pdenton 5y ago

I recently tcpdump'd an Android 11 device going through the initial setup. About 60MiB was downloaded just to get to the launcher. It contacts not only Google, but the manufacturer and Microsoft, as well as a few domains I couldn't recognize. It's impossible to install privacy tools (like AFWall) before being subjected to built-in spyware. The bootloader was locked by default and could only be unlocked after creating a Google account (which involves accepting their terms and conditions). It was also impossible to go through initial setup using a proxy server. It did use the proxy server I had setup to contact Google, but it wouldn't accept the connection as having internet connectivity (and refuse to go any further) until traffic was routed through the default gateway. I think it would be reasonable to add warnings to so-called "smart" devices the same way as packs of cigarettes. It'll never happen, sadly. If anything, the Powers That Be would rather make it illegal to "circumvent" or "tamper" with the locked-down computers that we used to own.

sdoering 5y ago
Offtopic: I recently tried to setup a Bluetooth speaker my mom had bought (with me at her side). I had carefully looked at the packaging and there were no red flags visible. At her flat I tried to connect it to her laptop. It just wasn't visible. I looked at the user manual. For initial setup you had to install the vendors app (and accept it to transmit any filename you listen to, any streaming account, any song/audiobook/radio station you are listening to. There was now way of getting it to just connect via Bluetooth without allowing full data harvesting. It instantly went back into its packaging, back to the shop. In hindsight I should probably have filed a GDPR complaint as this goes against the GDPR as the data tracking is not necessary for the functionality (Bluetooth connection). And was not available as information before I bought it.
- frankzander 5y ago
  What manufacturer did you buy?
  - denysvitali 5y ago
    I remember reading somewhere that Bose did something similar, but take this with a bit of salt as I might be confusing them. What I know for sure is that Sonos does it as well - but they aren't bluetooth speakers

nerdjon 5y ago

This is what I hate most about Google and Facebook. If you want to choose to let them gather all of your data, fine. I disagree with it but it is ultimately your choice. But as someone who has made every effort to remove both of these companies from my life as much as possible, if I communicate with someone who uses Android or someone who allows Facebook complete access to their contacts and other data... those companies still get MY data without my consent. Somehow it has become legal for these companies to allow someone else to consent for them to get my data.

Tijdreiziger 5y ago
> I disagree with it but it is ultimately your choice. Is it? If you want a modern smartphone experience (I don't mean one from 2005) you only get to choose which option you find 'less bad' between Apple and Google.
- Vixel 5y ago
  Apple (without any Google or FB apps installed) is definitely the lesser of two evils in that scenario.
  - deleted 5y ago
    [deleted]
  - Tijdreiziger 5y ago
    Apple collects less data, but they definitely still collect a lot. They're also extremely user-hostile (you can't choose what you want to install, only what Apple wants you to install). In fact, the author of the present study published an article on the former topic last year: > We investigate what data iOS on an iPhone shares with Apple and what data Google Android on a Pixel phone shares with Google. We find that even when minimally configured and the handset is idle both iOS and Google Android share data with Apple/Google on average every 4.5 mins. The phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc are shared with Apple and Google. Both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this. When a SIM is inserted both iOS and Google Android send details to Apple/Google. iOS sends the MAC addresses of nearby devices, e.g. other handsets and the home gateway, to Apple together with their GPS location. Users have no opt out from this and currently there are few, if any, realistic options for preventing this data sharing. Leith, D. J. (2021, September). Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google. URL: https://www.scss.tcd.ie/doug.leith/apple_google.pdf https://www.scss.tcd.ie/doug.leith/apple_google.pdf

aasasd 5y ago

Personally I'm waiting for a report showing that Google still swipes the location in some ways even when ‘location history’ and whatever the other toggle is, are both turned off. Because of course they do. Reminder: US police use Google as a database of people who were at a particular place at a certain time. Of which people by definition most aren't subjects of investigation: https://www.nytimes.com/2019/04/13/technology/google-sensorvault-location-tracking.html https://www.nytimes.com/2019/04/13/technology/google-sensorv...

zibzab 5y ago

Question: what happens if you use a third party dialer (e.g. Samsung)?

sizzle 5y ago

I hope the EU slaps google down hard for this egregious spying of their citizen and claiming ignorance is not a get out of jail free card. Now please audit iMessage and iPhone’s dialer, I’ll pay to help commission this important work!

briandear 5y ago

Is anyone surprised?

veam 5y ago
No one should be.
HWR_14 5y ago
I was a tad surprised by: > when a request was made through Google Takeout for the Google Account data associated with the apps used for testing, the data Google provided did not include the telemetry data observed. That google collects it is unsurprising. That they deny having it is somewhat surprising to me.

WaxedChewbacca 5y ago

hn_go_brrrrr 5y ago

I'm normally pretty tolerant of Google's data collection because I've seen the internal privacy protections firsthand. Yes, some collection of ML jobs know everything about you. No, humans don't get the same access. That said, this is disgraceful. I'm amazed that someone thought this was a good idea. I already use Signal for SMS, but I guess I need to find a new dialer app now. Anyone have suggestions?

dheera 5y ago
For talking to businesses, claim you're deaf and that you need to communicate by e-mail or chat interface. Use Signal for voice calls with friends.
- alexb_ 5y ago
  The fact that you would even begin to consider this anywhere close to a viable option shows how insanely out of touch with actual people you are.
  - dheera 5y ago
    Have you tried? I had to cancel a Comcast account once by e-mail and they kept referring me to call their retention department so I told them I was deaf and wasn't able to call. It worked. You can also threaten to get lawyers involved, that often helps deal with shitty customer service and they just give you what you want. Honestly this is the kind of stuff Google Assistant should be automating with piles of conversational data, not some stupid haircut appointment. They have the data to know when is the optimal time to mention some hypothetical lawyers and can leverage that data to engineer the conversation on behalf of and in favor of the user.
    - alexb_ 5y ago
      >engineer the conversation on behalf of and in favor of the user. I wish I had your optimism... should a system exist, businesses will be the one using it to find the optimal time to charge you more money. Just look at what they are doing with Crisis Text Line - your brain is being completely engineered by big tech. Proprietary technology is developed not to solve problems or make the world better, it is developed to make as much money for businesses as they possibly can.

ghoward 5y ago

Thank you for the link! Dumb shill, but I have a Twitter account to collect instances of tech companies doing shady stuff. It's called "Programmers Against Humanity" (@software_crimes), and I would love if people could send me more. I want to bring awareness to how tech companies harm us.