4 ms·

Sometimes the scopes of permissions are surprising. For example. scanning for Bluetooth devices on Android requires the location permission. Why? Bluetooth beac

by Zak 3y ago

Sometimes the scopes of permissions are surprising. For example. scanning for Bluetooth devices on Android requires the location permission. Why? Bluetooth beacons can be used to precisely locate a device. Unfortunately, there isn't a way provided to the average user to say that an app can use Bluetooth, but not GPS. https://developer.android.com/about/versions/marshmallow/android-6.0-changes.html#behavior-hardware-id https://developer.android.com/about/versions/marshmallow/and...

vxNsr 3y ago
With Bluetooth beacons they don’t need gps, with just Bluetooth beacons they can triangulate your location, there’s no way to know if an app is gonna do that vs just try to connect to your (non-Apple) headphones or watch
tzs 3y ago
> Sometimes the scopes of permissions are surprising. For example. scanning for Bluetooth devices on Android requires the location permission. Why? Bluetooth beacons can be used to precisely locate a device. I am indeed surprised by that. I would have expected the location permission to just control whether or not the app can use the system's location APIs or access GPS (if the system provides low level access to the GPS that doesn't require going through the location APIs). Having it control access to something that is not specifically a location service but that might sometimes be usable to obtain information that can be used to figure out location does not seem wise to me, because all kinds of things that you might not expect to provide such information do. For example internet access can provide location information indirectly via IP geolocation. If they try to stop all of that through the location permission then a bazillion apps that the user does not think of as having anything to do with location would have to require location permission, and users would learn that if an app asks for that they have to give it to them.
- Timon3 3y ago
  > Having it control access to something that is not specifically a location service but that might sometimes be usable to obtain information that can be used to figure out location does not seem wise to me, because all kinds of things that you might not expect to provide such information do. For example internet access can provide location information indirectly via IP geolocation. Using Bluetooth beacons you can get the location of a user accurate to a couple of meters, possibly granular enough to identify the individual. Continuous tracking can track your movements with the same scale. IP geolocation will at best be a radius of multiple kilometers. There's a big difference between "I know where you're standing at this second" and "I can guess what part of the country you're in".
- AlotOfReading 3y ago
  Bluetooth is specifically used to track location in many places. If you've ever been to a Disney property for example, there are beacons throughout the park for exactly that purpose. As you'd expect, the Disney apps request the fine localization permission and there's fine print somewhere on their website about how you should disable Bluetooth if you don't want to be tracked.
  - crooked-v 3y ago
    For me, the annoying part of Disney doing this isn't that they do it, it's that they do it and and their ride wait times still aren't accurate. They have a ton of data measuring people moving past specific points in lines in real time, so what are they even doing with it?
    - lazide 3y ago
      Notably, while fascist states loved to spout the propaganda about trains running on time - they often didn’t, hah.
    - dunham 3y ago
      Perhaps they're calculating the optimal wait time to report to the customer from the expected wait time?
seanalltogether 3y ago
As a developer of an app for controlling smart devices in the home, this one is especially infuriating. What's worse, if you have code that needs to scan ble devices in the background (for instance to update the clocks on those smart devices) you need to tell the user to go to their system settings and allow location tracking all the time.
- IggleSniggle 3y ago
  This is rough. As a developer, I can 100% see why there could be a ton of legit reasons to need this. As a user, there's no way in hell I would trust you not to be nefarious, unless you had a very detailed and clear explanation AND the rest of your app also strongly signaled "competent and trustworthy." And even then I would be wary. The company/app you trust today could be acquired by a company you despise tomorrow. But also as a user, I find location tracking for myself to be incredibly useful. To that last point, I am curious: is there any good comprehensive open sourced and audited alternatives to eg Tile or Find My?
pessimizer 3y ago
You have to give Android permission to get your location and to take audio in order to take a photograph.
- JohnFen 3y ago
  This sort of thing is why I think of the Android permission system as being "better than nothing", but not adequate.
- _jal 3y ago
  This is what you get when you let an advertising/surveillance oligopolist design your privacy permissions.
- yjftsjthsd-h 3y ago
  I'm pretty sure that's a bug in your camera app; mine prompts me for those permissions but I'm pretty sure it works fine for still photographs without them
- LorenPechtel 3y ago
  Location permission would of course be needed if you were going to geotag your picture. The camera app with my phone makes it an optional permission--and now I see it isn't recording location for some reason.

by Zak 3y ago

vxNsr 3y ago

With Bluetooth beacons they don’t need gps, with just Bluetooth beacons they can triangulate your location, there’s no way to know if an app is gonna do that vs just try to connect to your (non-Apple) headphones or watch

tzs 3y ago

> Sometimes the scopes of permissions are surprising. For example. scanning for Bluetooth devices on Android requires the location permission. Why? Bluetooth beacons can be used to precisely locate a device. I am indeed surprised by that. I would have expected the location permission to just control whether or not the app can use the system's location APIs or access GPS (if the system provides low level access to the GPS that doesn't require going through the location APIs). Having it control access to something that is not specifically a location service but that might sometimes be usable to obtain information that can be used to figure out location does not seem wise to me, because all kinds of things that you might not expect to provide such information do. For example internet access can provide location information indirectly via IP geolocation. If they try to stop all of that through the location permission then a bazillion apps that the user does not think of as having anything to do with location would have to require location permission, and users would learn that if an app asks for that they have to give it to them.

Timon3 3y ago
> Having it control access to something that is not specifically a location service but that might sometimes be usable to obtain information that can be used to figure out location does not seem wise to me, because all kinds of things that you might not expect to provide such information do. For example internet access can provide location information indirectly via IP geolocation. Using Bluetooth beacons you can get the location of a user accurate to a couple of meters, possibly granular enough to identify the individual. Continuous tracking can track your movements with the same scale. IP geolocation will at best be a radius of multiple kilometers. There's a big difference between "I know where you're standing at this second" and "I can guess what part of the country you're in".
AlotOfReading 3y ago
Bluetooth is specifically used to track location in many places. If you've ever been to a Disney property for example, there are beacons throughout the park for exactly that purpose. As you'd expect, the Disney apps request the fine localization permission and there's fine print somewhere on their website about how you should disable Bluetooth if you don't want to be tracked.
- crooked-v 3y ago
  For me, the annoying part of Disney doing this isn't that they do it, it's that they do it and and their ride wait times still aren't accurate. They have a ton of data measuring people moving past specific points in lines in real time, so what are they even doing with it?
  - lazide 3y ago
    Notably, while fascist states loved to spout the propaganda about trains running on time - they often didn’t, hah.
  - dunham 3y ago
    Perhaps they're calculating the optimal wait time to report to the customer from the expected wait time?

seanalltogether 3y ago

As a developer of an app for controlling smart devices in the home, this one is especially infuriating. What's worse, if you have code that needs to scan ble devices in the background (for instance to update the clocks on those smart devices) you need to tell the user to go to their system settings and allow location tracking all the time.

IggleSniggle 3y ago
This is rough. As a developer, I can 100% see why there could be a ton of legit reasons to need this. As a user, there's no way in hell I would trust you not to be nefarious, unless you had a very detailed and clear explanation AND the rest of your app also strongly signaled "competent and trustworthy." And even then I would be wary. The company/app you trust today could be acquired by a company you despise tomorrow. But also as a user, I find location tracking for myself to be incredibly useful. To that last point, I am curious: is there any good comprehensive open sourced and audited alternatives to eg Tile or Find My?

pessimizer 3y ago

You have to give Android permission to get your location and to take audio in order to take a photograph.

JohnFen 3y ago
This sort of thing is why I think of the Android permission system as being "better than nothing", but not adequate.
_jal 3y ago
This is what you get when you let an advertising/surveillance oligopolist design your privacy permissions.
yjftsjthsd-h 3y ago
I'm pretty sure that's a bug in your camera app; mine prompts me for those permissions but I'm pretty sure it works fine for still photographs without them
LorenPechtel 3y ago
Location permission would of course be needed if you were going to geotag your picture. The camera app with my phone makes it an optional permission--and now I see it isn't recording location for some reason.