12 ms·

> bluetooth is constantly used to track people How so? Unless you grant Bluetooth permissions to apps (that then start broadcasting identifiers) or explicitly

by lxgr 2y ago

> bluetooth is constantly used to track people How so? Unless you grant Bluetooth permissions to apps (that then start broadcasting identifiers) or explicitly make your device discoverable, this shouldn't really be a thing. > What's the point of leaving it on all the time when most of the time it's just going to drain your battery and open you up to being tracked or exploited. Just people with a wearable have at least one Bluetooth device connected to their phone at all times. Bluetooth headphones are also very popular. We need hardened and privacy-protecting Bluetooth stacks, not blaming people for using their phones as designed and advertised.

dharmab 2y ago
Over ten years ago retailers were already tracking customer's cell phones as they walked around the store to see what sections people walked through. Your phone constantly sends radio waves out that are identifiable to the individual device. https://www.nytimes.com/2013/07/15/business/attention-shopper-stores-are-tracking-your-cell.html https://www.nytimes.com/2013/07/15/business/attention-shoppe...
- lxgr 2y ago
  Could you be more specific? In what way is a modern Bluetooth device (let's assume both classic and LE) uniquely identifiable, other than for the caveats mentioned above? 2013 was indeed over a decade ago.
autoexec 2y ago
> How so? Unless you grant Bluetooth permissions to apps (that then start broadcasting identifiers) or explicitly make your device discoverable, this shouldn't really be a thing. https://www.geoplugin.com/resources/geofencing-beacons-advanced-location-based-services-guide/ https://www.geoplugin.com/resources/geofencing-beacons-advan... https://www.rfidjournal.com/news/long-range-ble-transmits-at-20-miles/186978/ https://www.rfidjournal.com/news/long-range-ble-transmits-at... https://easytechsolver.com/what-stores-use-bluetooth-beacons/ https://easytechsolver.com/what-stores-use-bluetooth-beacons... https://www.nytimes.com/interactive/2019/06/14/opinion/bluetooth-wireless-tracking-privacy.html https://www.nytimes.com/interactive/2019/06/14/opinion/bluet... > We need hardened and privacy-protecting Bluetooth stacks, not blaming people for using their phones as designed Phones are explicitly designed to collect and leak as much of your personal data as possible. Nobody us going to implement hardened bluetooth stacks that protect you because that defeats the whole purpose. We're lucky they allow us to disable bluetooth at all. They've already changed airplane mode to continue using wireless and bluetooth even when enabled. Any useful features of bluetooth you might use with your phone is probably just bait to get to leak more of your data. They've removed headphone jacks to force your hand, but most people could at least make sure that bluetooth isn't enabled while it isn't in active use.
- lxgr 2y ago
  I'd agree that sometimes privacy can be orthogonal to the manufacturer's interests, but that sounds like a complete conspiracy theory that doesn't pass Occam's razor. What benefit would phone manufacturers have from their devices being trackable via Bluetooth, or if it's not themselves, who is paying them for it? Also, I'd love to see an answer to my original question: How exactly do you track a stock iPhone or Pixel with Bluetooth enabled? Neither transmit a persistent identifier, and none of the technologies linked change anything about that. They require explicit cooperation of an app on the device side, which is gated behind a prompt on both iOS and Android. Your last link actually suggests the opposite: Bluetooth beacons allow apps to position themselves more accurately indoors and then do with that information whatever they want – if you grant that permission in the first place.
  - autoexec 2y ago
    > What benefit would phone manufacturers have from their devices being trackable via Bluetooth In Google's case, they use bluetooth to track the location of android users and the bluetooth devices near them. In addition to data collection, it helps their "Find my Device" network. I suspect Apple's system also uses bluetooth to identify nearby apple devices and beacons. Obviously phone manufactures are primarily self-interested, but part of that also means offering extensive data collection opportunities to third parties such as app and accessory developers to attract people to their platform. > Also, I'd love to see an answer to my original question: How exactly do you track a stock iPhone or Pixel with Bluetooth enabled? While I don't have a pixel or an iphone, it does appear that there are ways to passively track these devices via bluetooth: https://www.theregister.com/2021/10/22/bluetooth_tracking_device/ https://www.theregister.com/2021/10/22/bluetooth_tracking_de... https://cec.gmu.edu/news/2025-02/find-my-hacker-how-apples-network-can-be-potential-tracking-tool https://cec.gmu.edu/news/2025-02/find-my-hacker-how-apples-n...
    - lxgr 2y ago
      Both Google's and Apple's "Find my" are services implemented on top of Bluetooth which you can disable independently of it. They're basically pre-installed apps (e.g. Tile used to do the same thing using a third party app before them). Including them to support the statement "Bluetooth itself is intentionally used to track users" seems like moving goalposts. Yes, these services being enabled by default isn't great, but if you're claiming that there's any data collection or intentional device broadcasting happening beyond that, i.e. at the base OS level, I'd be happy to see evidence of that (as I would also find that very concerning). Regarding antenna/transmission chain/baseband fingerprinting: These are indeed concerning, and I hope there will be countermeasures available at some point. But these should theoretically affect all radio technologies, right? In that case, turning off (just) Bluetooth would not help much, given that phones have at least one other permanently enabled radio. It's a different story for devices that have only Bluetooth, of course.
reportgunner 2y ago
I don't use bluetooth much and I have no idea what the technical details are, but surely an attacker can find a way to either guess or determine what bluetooth devices your phone is paired to and then pretend to be that device. (like a keyboard) Also according to my experience there is no "permission for bluetooth", it all falls under "Phone" or whatever other permission on Android.

by lxgr 2y ago

dharmab 2y ago

Over ten years ago retailers were already tracking customer's cell phones as they walked around the store to see what sections people walked through. Your phone constantly sends radio waves out that are identifiable to the individual device. https://www.nytimes.com/2013/07/15/business/attention-shopper-stores-are-tracking-your-cell.html https://www.nytimes.com/2013/07/15/business/attention-shoppe...

lxgr 2y ago
Could you be more specific? In what way is a modern Bluetooth device (let's assume both classic and LE) uniquely identifiable, other than for the caveats mentioned above? 2013 was indeed over a decade ago.

autoexec 2y ago

> How so? Unless you grant Bluetooth permissions to apps (that then start broadcasting identifiers) or explicitly make your device discoverable, this shouldn't really be a thing. https://www.geoplugin.com/resources/geofencing-beacons-advanced-location-based-services-guide/ https://www.geoplugin.com/resources/geofencing-beacons-advan... https://www.rfidjournal.com/news/long-range-ble-transmits-at-20-miles/186978/ https://www.rfidjournal.com/news/long-range-ble-transmits-at... https://easytechsolver.com/what-stores-use-bluetooth-beacons/ https://easytechsolver.com/what-stores-use-bluetooth-beacons... https://www.nytimes.com/interactive/2019/06/14/opinion/bluetooth-wireless-tracking-privacy.html https://www.nytimes.com/interactive/2019/06/14/opinion/bluet... > We need hardened and privacy-protecting Bluetooth stacks, not blaming people for using their phones as designed Phones are explicitly designed to collect and leak as much of your personal data as possible. Nobody us going to implement hardened bluetooth stacks that protect you because that defeats the whole purpose. We're lucky they allow us to disable bluetooth at all. They've already changed airplane mode to continue using wireless and bluetooth even when enabled. Any useful features of bluetooth you might use with your phone is probably just bait to get to leak more of your data. They've removed headphone jacks to force your hand, but most people could at least make sure that bluetooth isn't enabled while it isn't in active use.

lxgr 2y ago
I'd agree that sometimes privacy can be orthogonal to the manufacturer's interests, but that sounds like a complete conspiracy theory that doesn't pass Occam's razor. What benefit would phone manufacturers have from their devices being trackable via Bluetooth, or if it's not themselves, who is paying them for it? Also, I'd love to see an answer to my original question: How exactly do you track a stock iPhone or Pixel with Bluetooth enabled? Neither transmit a persistent identifier, and none of the technologies linked change anything about that. They require explicit cooperation of an app on the device side, which is gated behind a prompt on both iOS and Android. Your last link actually suggests the opposite: Bluetooth beacons allow apps to position themselves more accurately indoors and then do with that information whatever they want – if you grant that permission in the first place.
- autoexec 2y ago
  > What benefit would phone manufacturers have from their devices being trackable via Bluetooth In Google's case, they use bluetooth to track the location of android users and the bluetooth devices near them. In addition to data collection, it helps their "Find my Device" network. I suspect Apple's system also uses bluetooth to identify nearby apple devices and beacons. Obviously phone manufactures are primarily self-interested, but part of that also means offering extensive data collection opportunities to third parties such as app and accessory developers to attract people to their platform. > Also, I'd love to see an answer to my original question: How exactly do you track a stock iPhone or Pixel with Bluetooth enabled? While I don't have a pixel or an iphone, it does appear that there are ways to passively track these devices via bluetooth: https://www.theregister.com/2021/10/22/bluetooth_tracking_device/ https://www.theregister.com/2021/10/22/bluetooth_tracking_de... https://cec.gmu.edu/news/2025-02/find-my-hacker-how-apples-network-can-be-potential-tracking-tool https://cec.gmu.edu/news/2025-02/find-my-hacker-how-apples-n...
  - lxgr 2y ago
    Both Google's and Apple's "Find my" are services implemented on top of Bluetooth which you can disable independently of it. They're basically pre-installed apps (e.g. Tile used to do the same thing using a third party app before them). Including them to support the statement "Bluetooth itself is intentionally used to track users" seems like moving goalposts. Yes, these services being enabled by default isn't great, but if you're claiming that there's any data collection or intentional device broadcasting happening beyond that, i.e. at the base OS level, I'd be happy to see evidence of that (as I would also find that very concerning). Regarding antenna/transmission chain/baseband fingerprinting: These are indeed concerning, and I hope there will be countermeasures available at some point. But these should theoretically affect all radio technologies, right? In that case, turning off (just) Bluetooth would not help much, given that phones have at least one other permanently enabled radio. It's a different story for devices that have only Bluetooth, of course.

reportgunner 2y ago

I don't use bluetooth much and I have no idea what the technical details are, but surely an attacker can find a way to either guess or determine what bluetooth devices your phone is paired to and then pretend to be that device. (like a keyboard) Also according to my experience there is no "permission for bluetooth", it all falls under "Phone" or whatever other permission on Android.