4 ms·

This kind of restates what was discussed here yesterday. Android's constant leaking of data to Google is hardly any news, but Qualcomm's firmware doing the same

This kind of restates what was discussed here yesterday. Android's constant leaking of data to Google is hardly any news, but Qualcomm's firmware doing the same in plain text to izatcloud.net is newsworthy. Apparently Apple is doing the same. Someone has a nice geolocation database of practically everyone in the world.

stonekyx 4y ago
> Apparently Apple is doing the same. Just curious, where did you find this?
- mschuster91 4y ago
  Everyone operates an AGPS service these days. Without it, you'd have to wait at least 12.5 minutes from a fully cold start (and likely, if you missed a data packet, double or triple that) until the GPS receiver has all the almanac data [1]. [1] https://en.wikipedia.org/wiki/GPS_signals#Almanac https://en.wikipedia.org/wiki/GPS_signals#Almanac
  - mrfumier 4y ago
    In my old Nokia N95, the AGPS data was downloaded when starting the GPS app. No need to require a constant background download.
    - prmoustache 4y ago
      this. I may actually use gps once or twice a week only, disable geolocalisation when it is possible on all apps I am using. There is no justifiable reason to say gps is not possible without this. Besides you should be able to decide you don't mind waiting 15 minutes to get full gps service.
      - rcxdude 4y ago
        Also there's not really any good justification for the amount of data sent with the AGPS request. It can be a super plain HTTPS request with nothing else, instead of sending basically all of the tracking data from the device, including from what I can tell the IMEI which google doesn't even let app developers access anymore.
        ianburrell 4y ago
        There is no private data in the request. The request is HTTP and authors could have analyzed them and discovered there is nothing in them. Instead, they published a list of things that Qualcomm privacy policy could include.
        rcxdude 4y ago
        Do you have an actual copy of a example request (with all headers) from an manufacturer's ROM? There's a lot of discussion but no-one has actually posted the full HTTP request, but there is a lot of stuff which indicates there might be a lot more information in the request on official ROMs (especially those using qualcomm's daemon). I know grapheneOS keeps it to the bare minimum required.
        ianburrell 4y ago
        The response post I was reading (and got posted here) didn't include any details. I can't tell if they actually looked at the response or were depending on someone else. But that is better than the original article that didn't even look. Why would you expect any private data to be sent when requesting static file? That would slow down both the client and server.
        rcxdude 4y ago
        I don't know why they would do it, apart from the obvious that it allows some tracking. Here's some more detail I managed to find on it (from /e/OS development): https://gitlab.e.foundation/e/backlog/-/issues/5765 https://gitlab.e.foundation/e/backlog/-/issues/5765 . At least it seems the IMEI is not included (at least in this specific example), but a serial number and a bunch of other information about the phone is.
- trustingtrust 4y ago
  iPhone involves a lot of telemetry which Apple sends it to itself. We don’t know what kind of contract Apple has with Qualcomm but if it involves Apple anonymising and sending the data to Qualcomm for using its chips then it’s likely going to be the same just in a different form. I’m pretty sure Qualcomm would like some kind of telemetry from its partners it sells chips to.
  - Bud 4y ago
    That's actually not likely at all. There's no reason for Apple to trash its reputation by doing something stupid like this for Qualcomm's benefit.
    - trustingtrust 4y ago
      Telemetry is something like : this is the history of modem signals etc. Something Qualcomm might have in its contract.
    - smoldesu 4y ago
      The iPhone has plenty of it's own telemetry like OCSP and Find My. No need to play cats vs dogs here.
- jruohonen 4y ago
  I might be wrong; it was merely speculated in the article due to the fact that Qualcomm chips are used also in Apple smartphones. An audit would be needed.
  - circuit10 4y ago
    > Qualcomm chips are used also in Apple smartphones The main SoC definitely isn’t, Apple design their own SoCs, are you talking about some other chip?
    - stacktrust 4y ago
      5G modem.
      - circuit10 4y ago
        I thought it might be something like that, but in this case isn’t it the main SOC doing it?
  - dagmx 4y ago
    The article authors continuously conflate the SoC with the OS distro. it’s almost certainly part of the distro since they claim you can block it. If it was the chipset, you wouldn’t be able to.
dlivingston 4y ago
> Apparently Apple is doing the same. I need a source for this, because my personal security model rests on the idea that Apple is NOT doing something like this.
- 77pt77 4y ago
  Why would they not? Why do you think that is a reasonable assumption?
  - alex_suzuki 4y ago
    Because for Apple, there‘s a financial incentive for keeping the „we care about your privacy“ narrative alive.
    - 0cf8612b2e1e 4y ago
      What do you do if Apple is violating your privacy? Go to Google?
- hospitalJail 4y ago
  Uh... They have 0 transparency and were caught in PRISM handing over data to the government. They have worked with multiple authoritarian regimes to give data on their customers. Number 1 in marketing according to ChatGPT.

stonekyx 4y ago

> Apparently Apple is doing the same. Just curious, where did you find this?

mschuster91 4y ago
Everyone operates an AGPS service these days. Without it, you'd have to wait at least 12.5 minutes from a fully cold start (and likely, if you missed a data packet, double or triple that) until the GPS receiver has all the almanac data [1]. [1] https://en.wikipedia.org/wiki/GPS_signals#Almanac https://en.wikipedia.org/wiki/GPS_signals#Almanac
- mrfumier 4y ago
  In my old Nokia N95, the AGPS data was downloaded when starting the GPS app. No need to require a constant background download.
  - prmoustache 4y ago
    this. I may actually use gps once or twice a week only, disable geolocalisation when it is possible on all apps I am using. There is no justifiable reason to say gps is not possible without this. Besides you should be able to decide you don't mind waiting 15 minutes to get full gps service.
    - rcxdude 4y ago
      Also there's not really any good justification for the amount of data sent with the AGPS request. It can be a super plain HTTPS request with nothing else, instead of sending basically all of the tracking data from the device, including from what I can tell the IMEI which google doesn't even let app developers access anymore.
      - ianburrell 4y ago
        There is no private data in the request. The request is HTTP and authors could have analyzed them and discovered there is nothing in them. Instead, they published a list of things that Qualcomm privacy policy could include.
        rcxdude 4y ago
        Do you have an actual copy of a example request (with all headers) from an manufacturer's ROM? There's a lot of discussion but no-one has actually posted the full HTTP request, but there is a lot of stuff which indicates there might be a lot more information in the request on official ROMs (especially those using qualcomm's daemon). I know grapheneOS keeps it to the bare minimum required.
        ianburrell 4y ago
        The response post I was reading (and got posted here) didn't include any details. I can't tell if they actually looked at the response or were depending on someone else. But that is better than the original article that didn't even look. Why would you expect any private data to be sent when requesting static file? That would slow down both the client and server.
        rcxdude 4y ago
        I don't know why they would do it, apart from the obvious that it allows some tracking. Here's some more detail I managed to find on it (from /e/OS development): https://gitlab.e.foundation/e/backlog/-/issues/5765 https://gitlab.e.foundation/e/backlog/-/issues/5765 . At least it seems the IMEI is not included (at least in this specific example), but a serial number and a bunch of other information about the phone is.
trustingtrust 4y ago
iPhone involves a lot of telemetry which Apple sends it to itself. We don’t know what kind of contract Apple has with Qualcomm but if it involves Apple anonymising and sending the data to Qualcomm for using its chips then it’s likely going to be the same just in a different form. I’m pretty sure Qualcomm would like some kind of telemetry from its partners it sells chips to.
- Bud 4y ago
  That's actually not likely at all. There's no reason for Apple to trash its reputation by doing something stupid like this for Qualcomm's benefit.
  - trustingtrust 4y ago
    Telemetry is something like : this is the history of modem signals etc. Something Qualcomm might have in its contract.
  - smoldesu 4y ago
    The iPhone has plenty of it's own telemetry like OCSP and Find My. No need to play cats vs dogs here.
jruohonen 4y ago
I might be wrong; it was merely speculated in the article due to the fact that Qualcomm chips are used also in Apple smartphones. An audit would be needed.
- circuit10 4y ago
  > Qualcomm chips are used also in Apple smartphones The main SoC definitely isn’t, Apple design their own SoCs, are you talking about some other chip?
  - stacktrust 4y ago
    5G modem.
    - circuit10 4y ago
      I thought it might be something like that, but in this case isn’t it the main SOC doing it?
- dagmx 4y ago
  The article authors continuously conflate the SoC with the OS distro. it’s almost certainly part of the distro since they claim you can block it. If it was the chipset, you wouldn’t be able to.

dlivingston 4y ago

> Apparently Apple is doing the same. I need a source for this, because my personal security model rests on the idea that Apple is NOT doing something like this.

77pt77 4y ago
Why would they not? Why do you think that is a reasonable assumption?
- alex_suzuki 4y ago
  Because for Apple, there‘s a financial incentive for keeping the „we care about your privacy“ narrative alive.
  - 0cf8612b2e1e 4y ago
    What do you do if Apple is violating your privacy? Go to Google?
hospitalJail 4y ago
Uh... They have 0 transparency and were caught in PRISM handing over data to the government. They have worked with multiple authoritarian regimes to give data on their customers. Number 1 in marketing according to ChatGPT.