4 ms·

> "Since the Android app requires location permissions to use the hardware device" God because Blutooth LE devices need location permission on Android? How is

> "Since the Android app requires location permissions to use the hardware device" God because Blutooth LE devices need location permission on Android? How is that still a thing, I remember being outraged about that a decade ago or something.

varenc 3y ago
Location permission is required because with Bluetooth access alone an app can essentially locate a device already by checking nearby device addresses against a database of known locations. Similar to how scanning WiFi BSSIDs can also determine location. It's a tricky problem. As a more technical user, I'd love it if they were separate permissions and the Bluetooth permission included an extra "your location can be determined from bluetooth alone" warning. But for the average user that's just going to confuse them.
- jbaber 3y ago
  Isn't it a good thing that it informs the average user that the app can know your location?
  - varenc 3y ago
    edit: changed my original reply after I read the docs: https://developer.android.com/guide/topics/connectivity/bluetooth/permissions https://developer.android.com/guide/topics/connectivity/blue... On Android apps that don't use Bluetooth to derive location, and assert that they don't, will not prompt the user for a location permission. But this app is requesting `ACCESS_FINE_LOCATION` in its manifest. It could be doing that because they're acknowledging they are using Bluetooth to derive location, but I don't think they are. I suspect what's actually going on is that they're requesting that permission just so they can show your location inside an embedded map view. In which case the permission is not related to its Bluetooth usage.
    - x1sec 3y ago
      I do note that BLUETOOTH_SCAN could be used for versions 12+. The link you provided is good, I'll also reference that as it also has details on strong assertion (android:usesPermissionFlags - neverForLocation). > I suspect what's actually going on is that they're requesting that permission just so they can show your location inside an embedded map view. Does the embedded map do some processing in the cloud first? Because the lat/lng is sent over the same API request that includes the battery voltages as well as the BLE address of your handset. I really think none of this is essential to a simple app that reads a battery voltage on your screen.
murderfs 3y ago
Just as with wifi networks, being able to see nearby Bluetooth devices is enough to figure out your location using publicly available databases like WiGLE.
- x1sec 3y ago
  Good point, and I assume this is why Google has taken this approach. That said, the more location data points you have, the more accurate the location (larger sample size, time proximity data - GPS is accurate always, SSID/BSSIDs can be out of date.
- lyu07282 3y ago
  There is a huge difference from that to a device syscall getCurrentGPSLatLon() but I can see why Google would want to make their permission system as abtuse as possible
Larrikin 3y ago
This is no longer the case https://developer.android.com/guide/topics/connectivity/bluetooth/permissions https://developer.android.com/guide/topics/connectivity/blue... There is actually a lot more review in the Play Store now as well, they will kick you out the store if they detect you're lying about the permission.
- deleted 3y ago
  [deleted]
- throitallaway 3y ago
  It seems like permissions should be part of the app manifest and there should be no way to lie about it.
  - deleted 3y ago
    [deleted]
  - x1sec 3y ago
    The manifest has ACCESS_FINE_LOCATION. When you run the application, the developer actually displays a popup saying to grant the permission so it can do BLE scanning to connect to the hardware device. Of course they neglect to say they will also use the permission to collect your GPS co-ordinates. Then the AMap location services SDK goes further collects MNC, MCC, LAC and CELL IDs (CGI) and Wifi SSIDs. Here I think the battery app developer does not even know this is happening, they use AMap SDK to obtain the GPS data only. It took me quite some time to figure this out (documented in part 2[1]). Will also note the manifest has CAMERA, IMAGE_CAPTURE, ACTION_VIDEO_CAPTURE, RECORD_AUDIO and MODIFY_AUDIO_SETTINGS. I have not seen where/how they are used (yet). The code that included strings requesting various permissions (In the AMap SDK code) uses string obfuscation to conceal what it is doing. Likely to trick automated static code analysis tooling. Note: > Alibaba state “in 2018, Amap became the first Chinese maps service to navigate a path to 100 million daily users”. [2] How are Google allowing this SDK to be used in developer's applications? [1] https://doubleagent.net/2023/05/22/a-car-battery-monitor-tracking-your-location-part2 https://doubleagent.net/2023/05/22/a-car-battery-monitor-tra... [2] https://www.alibabacloud.com/customers/autonavi https://www.alibabacloud.com/customers/autonavi
SV_BubbleTime 3y ago
So… as I understand it… this is about Bluetooth beacons. Bluetooth, it to require locations because if you passed by a beacon and an app is registered to the OS to watch it, that that is the same as reporting your location. Your phone said “hey, app that the user installed, you know that BLE device you told me to watch for? Saw it just now!” So it’s not it doesn’t make sense. Bluetooth low energy can be used to determine your location so you should have to give it permission. The problem is… No one knows this. It’s not even like there’s a solvable problem, because you don’t have to be using the Bluetooth low energy beacon format for this, you just need to be able to scan for advertising BLE devices which the OS does all time. Remember the rush to turn Covid Tracking on (Covid is over, but those changes aren’t going away). This is how Tile and the Apple Tags that killed them work. Those are just roaming beacons. Tons of apps that you install for major retailers, Home Depot, Target, Walmart, Best Buy all know exactly when you walk in the store if you have their app on an location services given into it. Don’t install apps. Not unless you have to. Then questionable permissions aren’t an issue.

varenc 3y ago

Location permission is required because with Bluetooth access alone an app can essentially locate a device already by checking nearby device addresses against a database of known locations. Similar to how scanning WiFi BSSIDs can also determine location. It's a tricky problem. As a more technical user, I'd love it if they were separate permissions and the Bluetooth permission included an extra "your location can be determined from bluetooth alone" warning. But for the average user that's just going to confuse them.

jbaber 3y ago
Isn't it a good thing that it informs the average user that the app can know your location?
- varenc 3y ago
  edit: changed my original reply after I read the docs: https://developer.android.com/guide/topics/connectivity/bluetooth/permissions https://developer.android.com/guide/topics/connectivity/blue... On Android apps that don't use Bluetooth to derive location, and assert that they don't, will not prompt the user for a location permission. But this app is requesting `ACCESS_FINE_LOCATION` in its manifest. It could be doing that because they're acknowledging they are using Bluetooth to derive location, but I don't think they are. I suspect what's actually going on is that they're requesting that permission just so they can show your location inside an embedded map view. In which case the permission is not related to its Bluetooth usage.
  - x1sec 3y ago
    I do note that BLUETOOTH_SCAN could be used for versions 12+. The link you provided is good, I'll also reference that as it also has details on strong assertion (android:usesPermissionFlags - neverForLocation). > I suspect what's actually going on is that they're requesting that permission just so they can show your location inside an embedded map view. Does the embedded map do some processing in the cloud first? Because the lat/lng is sent over the same API request that includes the battery voltages as well as the BLE address of your handset. I really think none of this is essential to a simple app that reads a battery voltage on your screen.

murderfs 3y ago

Just as with wifi networks, being able to see nearby Bluetooth devices is enough to figure out your location using publicly available databases like WiGLE.

x1sec 3y ago
Good point, and I assume this is why Google has taken this approach. That said, the more location data points you have, the more accurate the location (larger sample size, time proximity data - GPS is accurate always, SSID/BSSIDs can be out of date.
lyu07282 3y ago
There is a huge difference from that to a device syscall getCurrentGPSLatLon() but I can see why Google would want to make their permission system as abtuse as possible

Larrikin 3y ago

This is no longer the case https://developer.android.com/guide/topics/connectivity/bluetooth/permissions https://developer.android.com/guide/topics/connectivity/blue... There is actually a lot more review in the Play Store now as well, they will kick you out the store if they detect you're lying about the permission.

deleted 3y ago
[deleted]
throitallaway 3y ago
It seems like permissions should be part of the app manifest and there should be no way to lie about it.
- deleted 3y ago
  [deleted]
- x1sec 3y ago
  The manifest has ACCESS_FINE_LOCATION. When you run the application, the developer actually displays a popup saying to grant the permission so it can do BLE scanning to connect to the hardware device. Of course they neglect to say they will also use the permission to collect your GPS co-ordinates. Then the AMap location services SDK goes further collects MNC, MCC, LAC and CELL IDs (CGI) and Wifi SSIDs. Here I think the battery app developer does not even know this is happening, they use AMap SDK to obtain the GPS data only. It took me quite some time to figure this out (documented in part 2[1]). Will also note the manifest has CAMERA, IMAGE_CAPTURE, ACTION_VIDEO_CAPTURE, RECORD_AUDIO and MODIFY_AUDIO_SETTINGS. I have not seen where/how they are used (yet). The code that included strings requesting various permissions (In the AMap SDK code) uses string obfuscation to conceal what it is doing. Likely to trick automated static code analysis tooling. Note: > Alibaba state “in 2018, Amap became the first Chinese maps service to navigate a path to 100 million daily users”. [2] How are Google allowing this SDK to be used in developer's applications? [1] https://doubleagent.net/2023/05/22/a-car-battery-monitor-tracking-your-location-part2 https://doubleagent.net/2023/05/22/a-car-battery-monitor-tra... [2] https://www.alibabacloud.com/customers/autonavi https://www.alibabacloud.com/customers/autonavi

SV_BubbleTime 3y ago

So… as I understand it… this is about Bluetooth beacons. Bluetooth, it to require locations because if you passed by a beacon and an app is registered to the OS to watch it, that that is the same as reporting your location. Your phone said “hey, app that the user installed, you know that BLE device you told me to watch for? Saw it just now!” So it’s not it doesn’t make sense. Bluetooth low energy can be used to determine your location so you should have to give it permission. The problem is… No one knows this. It’s not even like there’s a solvable problem, because you don’t have to be using the Bluetooth low energy beacon format for this, you just need to be able to scan for advertising BLE devices which the OS does all time. Remember the rush to turn Covid Tracking on (Covid is over, but those changes aren’t going away). This is how Tile and the Apple Tags that killed them work. Those are just roaming beacons. Tons of apps that you install for major retailers, Home Depot, Target, Walmart, Best Buy all know exactly when you walk in the store if you have their app on an location services given into it. Don’t install apps. Not unless you have to. Then questionable permissions aren’t an issue.