3 ms·

Your location is leaked in many, many ways. Even if you have location services off on your phone, the first-party (Google, Apple) has access to your precise loc

Your location is leaked in many, many ways. Even if you have location services off on your phone, the first-party (Google, Apple) has access to your precise location. On Android, this bypasses VPNs, and I believe on iOS/Mac first-party apps also bypass VPNs. You are trusting that this data is not leaked to any third-parties. You cannot verify this, as the data is exfiltrated to servers which you can't verify. Okay, fine, I'll just install another operating system then, like KDE plasma mobile or GrapheneOS. Your location is still leaked 24/7. This is because your cellular modem has it's own operating system, running underneath your phone's operating system, which is triangulating your location at all times. Once again, you are trusting that telecommunications companies aren't misusing this - but please remember they're complied, by law, to make a lot of this information available to numerous third parties. Okay fine, let me just remove the Sim then and use my phone on Wifi only, always through a VPN. Your location is still being leaked potentially, for example, by your car. Your car also has a cellular modem which leaks your location, and you probably signed a contract allowing that data to be given to hundreds of third-parties. Of course, all of this is assuming you don't use any social media. Social media can also leak your location, even without location services. If you review a restaurant - that's your location. Where are your friends? You're probably around them. And on and on.

magicalist 1y ago
I mean you're saying a lot for rhetorical effect, but it doesn't get around the fact that there aren't that many avenues to reliably collect this data, with high enough resolution and tied to identity, for thousands/millions of individuals, and if you do have that data, you're basically a data broker. I mean, yes, all those things are true, and they're pooled together and available for sale by data brokers. It's also disappointing that the root comment is distracting from the 4th amendment violations by making the conversation about their vague claims of selling mini-palantir demos through abusing web ads.
- jandrewrogers 1y ago
  The assumption that the data must be "high resolution" is erroneous. Low resolution noisy data works just fine, you just need a lot more of it. You can use standard signal processing tricks such as stacking noisy low-resolution data to extract high-resolution features. This requires a lot more processing but that isn't much of a limitation. These reconstruction techniques work even if the data is from unrelated sources that aren't even trying to measure the thing you are measuring. Any data exhaust will work, people have created interesting PoCs leveraging things like HVAC data, RF attenuation, etc. High-precision weather models essentially work the same way, making inferences by stitching together diverse event data that has nothing to do with weather. High-quality high-resolution data sources largely don't exist in the way people imagine they do, so you need to do this anyway. If you have a high-resolution spatiotemporal graph for entities, tying it to identity is always trivial. It would be more common if it weren't for the fact that open source platforms scale poorly for this type of analytical processing.
gruez 1y ago
>On Android, this bypasses VPNs source? >You are trusting that this data is not leaked to any third-parties. You cannot verify this, as the data is exfiltrated to servers which you can't verify. At least on Android you can theoretically disable "google location accuracy" which stops it sending nearby hotspot mac addresses to Google. That's the only public route where google gets your location without you knowingly sending to it. You also imply that mobile operating systems are surreptitiously sending locations back to google/apple even if users have all location related features disabled, but I'm not aware of any evidence this is the case, and this falls into same category as "facebook is secretly listening to you" territory until proven otherwise.
- const_cast 1y ago
  > source? When I'm connected to a VPN that's far away, applications with my precise location, such as Google Maps, use my real-life location. > You also imply that mobile operating systems are surreptitiously sending locations back to google/apple even if users have all location related features disabled I did not, I said the operating system has access to your location, which it does. You're relying purely on trust in both Apple and Google to not send that location out. The toggle is just that, a software toggle in an app. The operating system is billions of lines of closed-source code. > and this falls into same category as "facebook is secretly listening to you" territory until proven otherwise Meaning, almost certainly true? If I gave Facebook microphone access, I would 100% expect it to be using my microphone for analytics. If you read their privacy policy, this is definitely allowed. Personally, in my opinion, you'd have to be very naive to think tech isn't trying to maximize it's gains here. If you can get the data, and there's no consequences, and it's allowed... why wouldn't you?
  - gruez 1y ago
    >When I'm connected to a VPN that's far away, applications with my precise location, such as Google Maps, use my real-life location. that's because VPNs don't change your phone's geolocation, which is determined by GPS/wifi signals. It's not a "VPN bypass" in any meaningful sense, any more than amazon knowing where you live because you filled out your address isn't a "VPN bypass". >Meaning, almost certainly true? If I gave Facebook microphone access, I would 100% expect it to be using my microphone for analytics. If you read their privacy policy, this is definitely allowed. Both iOS and Android has microphone indicators, so the idea that it's surreptitiously listening to you behind your back is doubtful, or requires some sort of conspiracy between it and Google/Apple. That's not impossible, but should be considered a crank theory until proven otherwise. >[...] and there's no consequences, and it's allowed... why wouldn't you? Strongly disagree. Google has been sued and lost for much lesser privacy infringements, like tracking users while in incognito, which if you read the suit is pretty absurd. Evidence that any big tech company was intentionally eavesdropping on users (ie. excluding something like voice assistants being accidentally triggered) would be a bombshell.
flossposse 1y ago
> Your location is still being leaked potentially, for example, by your car. Your car also has a cellular modem which leaks your location, and you probably signed a contract allowing that data to be given to hundreds of third-parties. Ok, fine. I'll just drive classic cars for the rest of my life. Your location is still being leaked by a global network of automated license plate reading cameras https://deflock.me/ https://deflock.me/
rustcleaner 1y ago
We literally need to train kids in Spy vs Spy tier information security if we want them to have a chance at being adults capable of avoiding this grid in any appreciable way.
immibis 1y ago
> because your cellular modem This is one of those common scaremongering things. It's an unavoidable part of the network, not extra malice added on top - it's basically equivalent to pointing out that in a wired network, it's possible to follow the wires to see where they go. And then adding that your ISP is spying on you by having a database of where all the wires go. Technically correct, but calling it something nefarious makes it more scary than useful information. It's just how networks work and you should be aware of it when using networks, especially wireless ones.
- const_cast 1y ago
  It's not meant to be scary - the telephony network has always had it built-in, and cellular networks for SMS are clear text. However, you should be aware that telecommunication companies are required, by law, to divulge information. If the government wants to know your call history or every text you've ever sent or received, they're required to give up that information. Similar story to ISPs. Yes, it's how these networks were built - but that doesn't mean there's nothing you can do. E2EE services exist, and frankly SMS is shit technology by modern standards anyway. For ISPs, we have secure DNS and tools like VPNs and Tor. When it comes to if this information can be used for nefarious ways, the answer is overwhelmingly yes. If we ask if it is being used for nefarious ways, the answer is we don't know. These networks are naturally built on pure trust. Do you trust your government, your ISP, your telecom, etc.
  - immibis 1y ago
    Everyone is required by law to divulge information that helps a court case upon request by the court. The process is called subpoena. And yes, you can go to jail if the judge thinks you deleted something because of the fact you thought you were going to get subpoenad.
    - const_cast 1y ago
      This is true, but practically not relevant. If you store data in clear text, then there is risk there. If you don't, then there is much less risk. Not everything is the same as everything else. I would never write my passwords in clear text and send them all over the internet. But, somehow, when we talk about SMS and Phone, this concept is lost. Again, there are E2EE services available. These can be subpoenaed, but there's no data available. In addition, there are automated surveillance methods such as Prism and whatever modern-day equivalent certainly exist. Me personally, I would not be surprised if all your texts are surveilled en-masse, no warrant or subpoena required. Again, that's only a risk if you use SMS or other clear text services. So, don't.

magicalist 1y ago

I mean you're saying a lot for rhetorical effect, but it doesn't get around the fact that there aren't that many avenues to reliably collect this data, with high enough resolution and tied to identity, for thousands/millions of individuals, and if you do have that data, you're basically a data broker. I mean, yes, all those things are true, and they're pooled together and available for sale by data brokers. It's also disappointing that the root comment is distracting from the 4th amendment violations by making the conversation about their vague claims of selling mini-palantir demos through abusing web ads.

jandrewrogers 1y ago
The assumption that the data must be "high resolution" is erroneous. Low resolution noisy data works just fine, you just need a lot more of it. You can use standard signal processing tricks such as stacking noisy low-resolution data to extract high-resolution features. This requires a lot more processing but that isn't much of a limitation. These reconstruction techniques work even if the data is from unrelated sources that aren't even trying to measure the thing you are measuring. Any data exhaust will work, people have created interesting PoCs leveraging things like HVAC data, RF attenuation, etc. High-precision weather models essentially work the same way, making inferences by stitching together diverse event data that has nothing to do with weather. High-quality high-resolution data sources largely don't exist in the way people imagine they do, so you need to do this anyway. If you have a high-resolution spatiotemporal graph for entities, tying it to identity is always trivial. It would be more common if it weren't for the fact that open source platforms scale poorly for this type of analytical processing.

gruez 1y ago

>On Android, this bypasses VPNs source? >You are trusting that this data is not leaked to any third-parties. You cannot verify this, as the data is exfiltrated to servers which you can't verify. At least on Android you can theoretically disable "google location accuracy" which stops it sending nearby hotspot mac addresses to Google. That's the only public route where google gets your location without you knowingly sending to it. You also imply that mobile operating systems are surreptitiously sending locations back to google/apple even if users have all location related features disabled, but I'm not aware of any evidence this is the case, and this falls into same category as "facebook is secretly listening to you" territory until proven otherwise.

const_cast 1y ago
> source? When I'm connected to a VPN that's far away, applications with my precise location, such as Google Maps, use my real-life location. > You also imply that mobile operating systems are surreptitiously sending locations back to google/apple even if users have all location related features disabled I did not, I said the operating system has access to your location, which it does. You're relying purely on trust in both Apple and Google to not send that location out. The toggle is just that, a software toggle in an app. The operating system is billions of lines of closed-source code. > and this falls into same category as "facebook is secretly listening to you" territory until proven otherwise Meaning, almost certainly true? If I gave Facebook microphone access, I would 100% expect it to be using my microphone for analytics. If you read their privacy policy, this is definitely allowed. Personally, in my opinion, you'd have to be very naive to think tech isn't trying to maximize it's gains here. If you can get the data, and there's no consequences, and it's allowed... why wouldn't you?
- gruez 1y ago
  >When I'm connected to a VPN that's far away, applications with my precise location, such as Google Maps, use my real-life location. that's because VPNs don't change your phone's geolocation, which is determined by GPS/wifi signals. It's not a "VPN bypass" in any meaningful sense, any more than amazon knowing where you live because you filled out your address isn't a "VPN bypass". >Meaning, almost certainly true? If I gave Facebook microphone access, I would 100% expect it to be using my microphone for analytics. If you read their privacy policy, this is definitely allowed. Both iOS and Android has microphone indicators, so the idea that it's surreptitiously listening to you behind your back is doubtful, or requires some sort of conspiracy between it and Google/Apple. That's not impossible, but should be considered a crank theory until proven otherwise. >[...] and there's no consequences, and it's allowed... why wouldn't you? Strongly disagree. Google has been sued and lost for much lesser privacy infringements, like tracking users while in incognito, which if you read the suit is pretty absurd. Evidence that any big tech company was intentionally eavesdropping on users (ie. excluding something like voice assistants being accidentally triggered) would be a bombshell.

flossposse 1y ago

> Your location is still being leaked potentially, for example, by your car. Your car also has a cellular modem which leaks your location, and you probably signed a contract allowing that data to be given to hundreds of third-parties. Ok, fine. I'll just drive classic cars for the rest of my life. Your location is still being leaked by a global network of automated license plate reading cameras https://deflock.me/ https://deflock.me/

rustcleaner 1y ago

We literally need to train kids in Spy vs Spy tier information security if we want them to have a chance at being adults capable of avoiding this grid in any appreciable way.

immibis 1y ago

> because your cellular modem This is one of those common scaremongering things. It's an unavoidable part of the network, not extra malice added on top - it's basically equivalent to pointing out that in a wired network, it's possible to follow the wires to see where they go. And then adding that your ISP is spying on you by having a database of where all the wires go. Technically correct, but calling it something nefarious makes it more scary than useful information. It's just how networks work and you should be aware of it when using networks, especially wireless ones.

const_cast 1y ago
It's not meant to be scary - the telephony network has always had it built-in, and cellular networks for SMS are clear text. However, you should be aware that telecommunication companies are required, by law, to divulge information. If the government wants to know your call history or every text you've ever sent or received, they're required to give up that information. Similar story to ISPs. Yes, it's how these networks were built - but that doesn't mean there's nothing you can do. E2EE services exist, and frankly SMS is shit technology by modern standards anyway. For ISPs, we have secure DNS and tools like VPNs and Tor. When it comes to if this information can be used for nefarious ways, the answer is overwhelmingly yes. If we ask if it is being used for nefarious ways, the answer is we don't know. These networks are naturally built on pure trust. Do you trust your government, your ISP, your telecom, etc.
- immibis 1y ago
  Everyone is required by law to divulge information that helps a court case upon request by the court. The process is called subpoena. And yes, you can go to jail if the judge thinks you deleted something because of the fact you thought you were going to get subpoenad.
  - const_cast 1y ago
    This is true, but practically not relevant. If you store data in clear text, then there is risk there. If you don't, then there is much less risk. Not everything is the same as everything else. I would never write my passwords in clear text and send them all over the internet. But, somehow, when we talk about SMS and Phone, this concept is lost. Again, there are E2EE services available. These can be subpoenaed, but there's no data available. In addition, there are automated surveillance methods such as Prism and whatever modern-day equivalent certainly exist. Me personally, I would not be surprised if all your texts are surveilled en-masse, no warrant or subpoena required. Again, that's only a risk if you use SMS or other clear text services. So, don't.