3 ms·

This seems like a really shallow dive into what’s going on, and seems to exist largely to plug their own hardware? For example, how is the chipset getting “Lis

by dagmx 4y ago

This seems like a really shallow dive into what’s going on, and seems to exist largely to plug their own hardware? For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculation. Also, why didn’t they try GrapheneOS which is what their own devices use? Surely if the goal is to try and deduce that the chipset is involved, rather than a driver, then that’s the logical place to start?

mschuster91 4y ago
> They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculation. That's enough under GDPR, which is the point of the article. Even though the GDPR requires active informed consent, there are still so many layers openly sharting on that requirement, and no one holds the big players accountable.
- bogle 4y ago
  NOYB [https://noyb.eu/en https://noyb.eu/en] do their best to hold big tech's feet to the fire (and they exist on donations so we can all help out).
solarkraft 4y ago
> how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? The chipset is aware of the operating system, or rather the other way around. Manufacturers use kernel modifications and user space libraries provided by Qualcomm for their chipsets.
- MichaelZuo 4y ago
  Right, it's the OS that is bolted on top, so the chipset is aware of everything that the OS is and some more besides.
- dagmx 4y ago
  Yeah I just mean they blame the chipset, but in reality it’s something in the OS stack. Qualcomm drivers are blobs, and they’re basically the main game in town for android, so the drivers would be shared by even their own device. They stopped short of investigating what was causing the pull of the A-GPS data. It could have been something in the distro they used, that the other distro didn’t. It’s such a hand waivy piece overall
veeti 4y ago
According to GrapheneOS: "HTTPS connections are made to fetch PSDS information to assist with satellite based location. These are static files and are downloaded automatically to improve location resolution speed and accuracy. No query or data is sent to these servers". https://grapheneos.org/faq#default-connections https://grapheneos.org/faq#default-connections
ajross 4y ago
> For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? This surely isn't "the chip" doing this. It's the driver suite provided by Qualcomm, which is (obviously) required for a functioning device. The open Android distros still need drivers, and are essentially copying these files verbatim without review. Somewhere Qualcomm has a privileged daemon able to get this info.
- usrusr 4y ago
  Or it's some GPS receiver state visible through the requests that might allow identification of certain apps that leave some form of characteristic fingerprints in the receiver. Could be "why can't Android allow bluetooth without GPS permissions!" all over again.
usrusr 4y ago
Idle speculation, idle speculation that picks up just where the compliance handwaving stops: the legal team takes the better safe than sorry approach of listing everything they might perhaps infer from the particulars of aGPS refresh, and the blogger basically continues that line of thought: wow, that would be pretty wild. The "no packet analysis" is an interesting angle, because it would take all the fun out of complaining about plain http: would we prefer open messages with a known low amount of things to hide, or hidden messages with an unknown amount of secrets?
strictnein 4y ago
100% this. I was assuming we'd see some Wireshark showing this "personal" data being transferred and some proof that it was the Qualcomm chip doing it. What we ended with was a "trust me bro" explanation and a sales pitch.
kevin_nisbet 4y ago
Yea, I'm pretty confused by this write up and a bit skeptical. I would really like to see better information about what they're seeing to conclude that the allegations are credible. I worked with aGPS a bit when I started my career. As I recall at that time, the chipsets only accessed the aGPS service if something asked the chipset for the current GPS coordinates of the device. The chipset could avoid the long load times of the locations by using the network to assist the GPS and get the current state. And because this is part of the cellular network standards, this would just be another thing the chipset did when working with the network, like receiving an SMS, or registering with the network so it can be notified of an incoming call or packet of data. I wasn't aware that aGPS could also be done over WIFI, but I suppose it makes sense that it can. That might involve the OS as well, as other comments have pointed out to get to the WIFI network. So I'm not ready to jump on that Qualcomm chipset is the culprit, or this is nefarious, unless we're sure there is no software process asking the chipset for the GPS coordinates / triggering an aGPS call, and that the identifying information alleged is actually in those messages and this isn't just some generic policy statement. And that this actually always goes over wifi, and when connected to a cellular network, it doesn't use the network operators aGPS. The network operator already knows all the alleged details based on the global standards of how a cellular device communicates with the network.
rcxdude 4y ago
Yeah, it manages to subvert its own message by transparently trying to be as scary as possible by being vague and jumping to its own conclusions, in what is clearly a sales pitch. It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information? Our phone doesn't do that", instead of saying "oh, this phone makes a connection to a Qualcomm, server even on an open-source ROM, but we couldn't find which bit was making that connection so it must be the firmware. Also we won't actually show what data the phone was sending despite it being unencrypted. buy our phone instead!". I don't know what they did to investigate what was going on in the ROM they used but it clearly wasn't very much as it's something the ROM authors are clearly aware of: https://community.e.foundation/t/connections-to-izatcloud-net/19219/7 https://community.e.foundation/t/connections-to-izatcloud-ne... (this is the first result on google for "e/OS" "izatcloud"). It's annoying because it's pretty unnecessary to add the unsubstantiated claims to actually deliver their core marketing message, they just felt the need to put down the use of open-source ROMs on other hardware.
- palata 4y ago
  Agreed. I'm a bit disappointed by Nitrokey, because I would expect a security/privacy-oriented company to be experts. This all seems very shallow (even the explanation of what A-GPS is seems to show that they don't really understand it). A company that sells trust should know better than posting ads disguised as an approximate technical blog.
- tpmx 4y ago
  > It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information? Someone credible: please write and submit such a blog post to HN so that we can have the discussion from that perspective instead. The current perspective is broken; discussion-wise.
  - dagmx 4y ago
    That assumes there’s really anything to discuss here. This is just A-GPS to work and has been like that for over a decade. The Wikipedia page has about as much information as a blog post would https://en.wikipedia.org/wiki/Assisted_GNSS?wprov=sfti1 https://en.wikipedia.org/wiki/Assisted_GNSS?wprov=sfti1 Or better yet, from the GrapheneOS devs themselves https://reddit.com/r/privacy/comments/12yii9u/_/jhojlr7/?context=1 https://reddit.com/r/privacy/comments/12yii9u/_/jhojlr7/?con...

by dagmx 4y ago

mschuster91 4y ago

> They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculation. That's enough under GDPR, which is the point of the article. Even though the GDPR requires active informed consent, there are still so many layers openly sharting on that requirement, and no one holds the big players accountable.

bogle 4y ago
NOYB [https://noyb.eu/en https://noyb.eu/en] do their best to hold big tech's feet to the fire (and they exist on donations so we can all help out).

solarkraft 4y ago

> how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? The chipset is aware of the operating system, or rather the other way around. Manufacturers use kernel modifications and user space libraries provided by Qualcomm for their chipsets.

MichaelZuo 4y ago
Right, it's the OS that is bolted on top, so the chipset is aware of everything that the OS is and some more besides.
dagmx 4y ago
Yeah I just mean they blame the chipset, but in reality it’s something in the OS stack. Qualcomm drivers are blobs, and they’re basically the main game in town for android, so the drivers would be shared by even their own device. They stopped short of investigating what was causing the pull of the A-GPS data. It could have been something in the distro they used, that the other distro didn’t. It’s such a hand waivy piece overall

veeti 4y ago

According to GrapheneOS: "HTTPS connections are made to fetch PSDS information to assist with satellite based location. These are static files and are downloaded automatically to improve location resolution speed and accuracy. No query or data is sent to these servers". https://grapheneos.org/faq#default-connections https://grapheneos.org/faq#default-connections

ajross 4y ago

> For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? This surely isn't "the chip" doing this. It's the driver suite provided by Qualcomm, which is (obviously) required for a functioning device. The open Android distros still need drivers, and are essentially copying these files verbatim without review. Somewhere Qualcomm has a privileged daemon able to get this info.

usrusr 4y ago
Or it's some GPS receiver state visible through the requests that might allow identification of certain apps that leave some form of characteristic fingerprints in the receiver. Could be "why can't Android allow bluetooth without GPS permissions!" all over again.

usrusr 4y ago

Idle speculation, idle speculation that picks up just where the compliance handwaving stops: the legal team takes the better safe than sorry approach of listing everything they might perhaps infer from the particulars of aGPS refresh, and the blogger basically continues that line of thought: wow, that would be pretty wild. The "no packet analysis" is an interesting angle, because it would take all the fun out of complaining about plain http: would we prefer open messages with a known low amount of things to hide, or hidden messages with an unknown amount of secrets?

strictnein 4y ago

100% this. I was assuming we'd see some Wireshark showing this "personal" data being transferred and some proof that it was the Qualcomm chip doing it. What we ended with was a "trust me bro" explanation and a sales pitch.

kevin_nisbet 4y ago

Yea, I'm pretty confused by this write up and a bit skeptical. I would really like to see better information about what they're seeing to conclude that the allegations are credible. I worked with aGPS a bit when I started my career. As I recall at that time, the chipsets only accessed the aGPS service if something asked the chipset for the current GPS coordinates of the device. The chipset could avoid the long load times of the locations by using the network to assist the GPS and get the current state. And because this is part of the cellular network standards, this would just be another thing the chipset did when working with the network, like receiving an SMS, or registering with the network so it can be notified of an incoming call or packet of data. I wasn't aware that aGPS could also be done over WIFI, but I suppose it makes sense that it can. That might involve the OS as well, as other comments have pointed out to get to the WIFI network. So I'm not ready to jump on that Qualcomm chipset is the culprit, or this is nefarious, unless we're sure there is no software process asking the chipset for the GPS coordinates / triggering an aGPS call, and that the identifying information alleged is actually in those messages and this isn't just some generic policy statement. And that this actually always goes over wifi, and when connected to a cellular network, it doesn't use the network operators aGPS. The network operator already knows all the alleged details based on the global standards of how a cellular device communicates with the network.

rcxdude 4y ago

Yeah, it manages to subvert its own message by transparently trying to be as scary as possible by being vague and jumping to its own conclusions, in what is clearly a sales pitch. It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information? Our phone doesn't do that", instead of saying "oh, this phone makes a connection to a Qualcomm, server even on an open-source ROM, but we couldn't find which bit was making that connection so it must be the firmware. Also we won't actually show what data the phone was sending despite it being unencrypted. buy our phone instead!". I don't know what they did to investigate what was going on in the ROM they used but it clearly wasn't very much as it's something the ROM authors are clearly aware of: https://community.e.foundation/t/connections-to-izatcloud-net/19219/7 https://community.e.foundation/t/connections-to-izatcloud-ne... (this is the first result on google for "e/OS" "izatcloud"). It's annoying because it's pretty unnecessary to add the unsubstantiated claims to actually deliver their core marketing message, they just felt the need to put down the use of open-source ROMs on other hardware.

palata 4y ago
Agreed. I'm a bit disappointed by Nitrokey, because I would expect a security/privacy-oriented company to be experts. This all seems very shallow (even the explanation of what A-GPS is seems to show that they don't really understand it). A company that sells trust should know better than posting ads disguised as an approximate technical blog.
tpmx 4y ago
> It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information? Someone credible: please write and submit such a blog post to HN so that we can have the discussion from that perspective instead. The current perspective is broken; discussion-wise.
- dagmx 4y ago
  That assumes there’s really anything to discuss here. This is just A-GPS to work and has been like that for over a decade. The Wikipedia page has about as much information as a blog post would https://en.wikipedia.org/wiki/Assisted_GNSS?wprov=sfti1 https://en.wikipedia.org/wiki/Assisted_GNSS?wprov=sfti1 Or better yet, from the GrapheneOS devs themselves https://reddit.com/r/privacy/comments/12yii9u/_/jhojlr7/?context=1 https://reddit.com/r/privacy/comments/12yii9u/_/jhojlr7/?con...