6 ms·

I'm actually not sure what exactly is accomplished by toggling Location Services off. For example, I have Android 11, and AIUI, several methods are used to get

I'm actually not sure what exactly is accomplished by toggling Location Services off. For example, I have Android 11, and AIUI, several methods are used to get a fix on location. Does the LS button turn off the GPS/GNSS radios only? What about WiFi location services? Are those disabled by the button too? Bluetooth, is that a thing?

brookst 4y ago
It just means the system location APIs won't return a location. There's no attempt to detect if an app is using e.g. inertial guidance or a database of SSIDs to estimate locatiom.
- bmicraft 4y ago
  Scanning ssids requires the location permission on Android. Turning location off temporarily revokes the location permission for all apps (system included)
  - brookst 4y ago
    Thanks, did not know that!
CharlesW 4y ago
> I'm actually not sure what exactly is accomplished by toggling Location Services off. I couldn't find an analogous article by Google, but Apple does a pretty good job of explaining this: https://www.apple.com/legal/privacy/data/en/location-services/ https://www.apple.com/legal/privacy/data/en/location-service...
jeroenhd 4y ago
It depends on the settings on your phone. There's the location toggle, which will limit almost all location API access to apps on your phone. There's a toggle for WiFi/Bluetooth scanning in the background, which is used to quickly connect to devices that come into range and to help get a quicker fix on your location once you do enable it. This type of scanning will continue even if you disable location services through the default button, though apps on your phone won't be able to use them. I'm not entirely sure how the Bluetooth thing is supposed to work, I'm guessing some places have Bluetooth beacons? Disabling location services should also disable the GPS/GLONASS/etc. chip because it's not useful. In theory the Android system could activate the chip of course, but in any clean ROM it won't. If you're trying to protect your location from the apps on your phone, you'll most likely be fine just disabling location services. Pay attention: some phones have a location toggle that actually only disables GPS, you may need to long press the toggle to get it to turn off all location services. IP geolocation is also easy to implement, so consider using a VPN to make it hard to track you through your internet connection. If you try to protect yourself from external factors, you're in for a challenge. Overrides may exist, for example when you call the emergency services; location services and GPS will turn on and send a GPS fix to the emergency services. Furthermore, if your phone has even a semblance of a cellular connection, triangulation from the ISP side becomes an option. With LTE, and especially mmWave, tracking from a cell tower becomes painfully accurate. If you're on some large WiFi network, for example a building with tens or hundreds of WiFi access points, an active WiFi connection can be tracked very easily as well (down to the centimeter with the right firmware on the APs). If you want to protect yourself from passive scanners that respond to your phone's WiFi scanning signal, be sure to keep MAC address randomisation enabled. Also consider making your phone use random MAC addresses when connecting to WiFi access points in case someone fakes an access point to get your phone to reveal its real MAC address. This isn't foolproof, there are ways to determine your phone's brand, model, and even the firmware version through WiFi probes if your adversary has enough information on it, simply based on the extra options set in the WiFi packet header and the order of them. Using any Bluetooh devices also makes it easy to track you as you can't use random MAC addresses with Bluetooth peripherals. If you want safety from external tracking, disable all communication systems unless absolutely necessary. If you just want to disable app tracking, retract location permissions or disable location services. One final note: some apps have been caught going through photos in your gallery, extracting the time and date of the picture together with the GPS tag in them. This allows apps with media permissions to build up a location history if you've been taking pictures. Be wary of unnecessary full media permissions; apps generally don't need them as there are APIs that allow apps to select a single file or folder.
charcircuit 4y ago
The main code that executes when you turn off the location setting for a user that stops apps from getting your location is LocationManagerService.refreshAppOpsRestrictions https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/location/LocationManagerService.java;l=1520;bpv=1;bpt=1?q=Ilocationmanager https://cs.android.com/android/platform/superproject/+/maste... This function removes the coarse and fine permissions from all apps except those who are on the Emergency Bypass Allowlist or the ADAS Bypass Allowlist. https://source.android.com/docs/devices/automotive/location_bypass/location_bypass_policy https://source.android.com/docs/devices/automotive/location_...

brookst 4y ago

It just means the system location APIs won't return a location. There's no attempt to detect if an app is using e.g. inertial guidance or a database of SSIDs to estimate locatiom.

bmicraft 4y ago
Scanning ssids requires the location permission on Android. Turning location off temporarily revokes the location permission for all apps (system included)
- brookst 4y ago
  Thanks, did not know that!

CharlesW 4y ago

> I'm actually not sure what exactly is accomplished by toggling Location Services off. I couldn't find an analogous article by Google, but Apple does a pretty good job of explaining this: https://www.apple.com/legal/privacy/data/en/location-services/ https://www.apple.com/legal/privacy/data/en/location-service...

jeroenhd 4y ago

It depends on the settings on your phone. There's the location toggle, which will limit almost all location API access to apps on your phone. There's a toggle for WiFi/Bluetooth scanning in the background, which is used to quickly connect to devices that come into range and to help get a quicker fix on your location once you do enable it. This type of scanning will continue even if you disable location services through the default button, though apps on your phone won't be able to use them. I'm not entirely sure how the Bluetooth thing is supposed to work, I'm guessing some places have Bluetooth beacons? Disabling location services should also disable the GPS/GLONASS/etc. chip because it's not useful. In theory the Android system could activate the chip of course, but in any clean ROM it won't. If you're trying to protect your location from the apps on your phone, you'll most likely be fine just disabling location services. Pay attention: some phones have a location toggle that actually only disables GPS, you may need to long press the toggle to get it to turn off all location services. IP geolocation is also easy to implement, so consider using a VPN to make it hard to track you through your internet connection. If you try to protect yourself from external factors, you're in for a challenge. Overrides may exist, for example when you call the emergency services; location services and GPS will turn on and send a GPS fix to the emergency services. Furthermore, if your phone has even a semblance of a cellular connection, triangulation from the ISP side becomes an option. With LTE, and especially mmWave, tracking from a cell tower becomes painfully accurate. If you're on some large WiFi network, for example a building with tens or hundreds of WiFi access points, an active WiFi connection can be tracked very easily as well (down to the centimeter with the right firmware on the APs). If you want to protect yourself from passive scanners that respond to your phone's WiFi scanning signal, be sure to keep MAC address randomisation enabled. Also consider making your phone use random MAC addresses when connecting to WiFi access points in case someone fakes an access point to get your phone to reveal its real MAC address. This isn't foolproof, there are ways to determine your phone's brand, model, and even the firmware version through WiFi probes if your adversary has enough information on it, simply based on the extra options set in the WiFi packet header and the order of them. Using any Bluetooh devices also makes it easy to track you as you can't use random MAC addresses with Bluetooth peripherals. If you want safety from external tracking, disable all communication systems unless absolutely necessary. If you just want to disable app tracking, retract location permissions or disable location services. One final note: some apps have been caught going through photos in your gallery, extracting the time and date of the picture together with the GPS tag in them. This allows apps with media permissions to build up a location history if you've been taking pictures. Be wary of unnecessary full media permissions; apps generally don't need them as there are APIs that allow apps to select a single file or folder.

charcircuit 4y ago

The main code that executes when you turn off the location setting for a user that stops apps from getting your location is LocationManagerService.refreshAppOpsRestrictions https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/location/LocationManagerService.java;l=1520;bpv=1;bpt=1?q=Ilocationmanager https://cs.android.com/android/platform/superproject/+/maste... This function removes the coarse and fine permissions from all apps except those who are on the Emergency Bypass Allowlist or the ADAS Bypass Allowlist. https://source.android.com/docs/devices/automotive/location_bypass/location_bypass_policy https://source.android.com/docs/devices/automotive/location_...