3 ms·

It explicitly pops up the confirmation dialog even though user has previously DENIED that geolocation permission dialog. The whole thing is only created because

by bflesch 9mo ago

It explicitly pops up the confirmation dialog even though user has previously DENIED that geolocation permission dialog. The whole thing is only created because they see "high denial rates" and want to create a way to permanently undo these denials.

jeroenhd 9mo ago
The spec doesn't mandate such behaviour, that's up to the user agent to implement. I've had to deal with plenty of people who couldn't do things like use Jitsi or other web apps because they missed or denied the permission prompt before reading them. The tiny icons in the address bar are barely recognised as clickable items by most users, which is a good thing for toning down annoyances but an awful inconvenience when trying to help people. In a few cases, the solution to "accidentally dismissed permission popup" was "make everyone else download an app full of trackers".
- bflesch 9mo ago
  Jitsi is about audio / video where this would make more sense, not about geolocation. Geolocation based on IP address is always done in the background, so they already know what city you are from. But Google wants to have the nice high-precision location from our GPS chips so they can permanently associate the IP address, and available WIFIs/Bluetooth/network devices and all related MAC addresses to a specific building. And they want to have this specific functionality so they can organically trick non-power-users who got accustomed to the permission popup dialogs into re-sharing their location.
  - wongarsu 9mo ago
    The audio/video version is in the works [1]. I imagine geolocation just got to this stage first because it's far simpler. And IP-based geolocation is really unreliable beyond the country level. It depends on ISPs using a different pool of IP addresses for each city. That seems to be the norm in the US, but is not how every ISP runs their operation 1: https://developer.chrome.com/origintrials/#/view_trial/3736298840857247745 https://developer.chrome.com/origintrials/#/view_trial/37362...
    - bflesch 9mo ago
      Oh come on please stop this insincere false narrative. IP-to-geolocation works extremely well even with semi-public databases, and Google has spent billions on collecting a very powerful database of it. Google is internally fusing data from all devices that were ever in your LAN or near your WIFI access point. It merges them based on: - outside IP address given by ISP and mobile phone carriers - list of network devices incl. IP address & MACs (do you have a 3d printer or not?) - any info they can extract via their Smartphone Apps both on Android and IOS - Android devices share geolocation data with google anyways - user agents & browsing history on google properties and 3rd party websites - every time your IP addresses hit anything in google cloud or google CDNs (e.g jquery from googlestatic.com or google fonts) - all data you have ever provided to them (payment data, gcloud, gmail) - all the tracking that is already built into chrome and other google software Plus they procure data from third-party providers. Only a single app on your smartphone needs to have geolocation privilege and then the data (location, ip address and user data) is available for google to digest via their scripts/SDKs which are packaged into basically every smartphone app. The large tech companies have significant incentive to mutually share data with each other, that's why you often see Javascript from one tech company included in the website or product of another one. It's enough to touch a google dc with a single packet included in the facebook app for them to associate your session with the new IP address and vice versa. Google has years of data on how often user agents and devices behind a certain IP address change. They can very confidently say if your ISP-provided IP address has been rotated or not, and where it was rotated to. They most definitely have enough GPS positions from smartphones that they can predict where you sleep, so if your smartphone shows up under another IP address but the network devices around it stay the same they can easily deduce that this is your new dial-up IP address. All of this not even discusses unethical or clearly illegal ways these companies have acquired data by abusing a lack of security measures on the smartphone operating systems. An example is Facebook uploading entire smartphone contact books to their servers to fuel their "organic" growth - Google most definitely has done exactly the same. The "careless people" book highlights that Facebook deployed spyware with their smartphone apps which monitored what other apps the users were using - this is how they figured out that WhatsApp was going viral and based on this data they did the surprise acquisition of WhatsApp. I'm confident that google abuses the same security vulnerabilities in order to further collect data.
  - kitd 9mo ago
    > Jitsi is about audio / video where this would make more sense, not about geolocation. It's still permission-based. And the article mentions that the same ux is being done for media objects.
  - jeroenhd 9mo ago
    > Geolocation based on IP address is always done in the background, so they already know what city you are from They don't. Maybe the trackers do, but most websites place me 100km to the west. When I want to look up opening times for supermarkets near me, I like the "show nearby" button. Even Google gets confused because I VPN back to my home network. Every time I spend a few days somewhere else, Google's IP-based geolocation is broken again.

by bflesch 9mo ago

jeroenhd 9mo ago

The spec doesn't mandate such behaviour, that's up to the user agent to implement. I've had to deal with plenty of people who couldn't do things like use Jitsi or other web apps because they missed or denied the permission prompt before reading them. The tiny icons in the address bar are barely recognised as clickable items by most users, which is a good thing for toning down annoyances but an awful inconvenience when trying to help people. In a few cases, the solution to "accidentally dismissed permission popup" was "make everyone else download an app full of trackers".

bflesch 9mo ago
Jitsi is about audio / video where this would make more sense, not about geolocation. Geolocation based on IP address is always done in the background, so they already know what city you are from. But Google wants to have the nice high-precision location from our GPS chips so they can permanently associate the IP address, and available WIFIs/Bluetooth/network devices and all related MAC addresses to a specific building. And they want to have this specific functionality so they can organically trick non-power-users who got accustomed to the permission popup dialogs into re-sharing their location.
- wongarsu 9mo ago
  The audio/video version is in the works [1]. I imagine geolocation just got to this stage first because it's far simpler. And IP-based geolocation is really unreliable beyond the country level. It depends on ISPs using a different pool of IP addresses for each city. That seems to be the norm in the US, but is not how every ISP runs their operation 1: https://developer.chrome.com/origintrials/#/view_trial/3736298840857247745 https://developer.chrome.com/origintrials/#/view_trial/37362...
  - bflesch 9mo ago
    Oh come on please stop this insincere false narrative. IP-to-geolocation works extremely well even with semi-public databases, and Google has spent billions on collecting a very powerful database of it. Google is internally fusing data from all devices that were ever in your LAN or near your WIFI access point. It merges them based on: - outside IP address given by ISP and mobile phone carriers - list of network devices incl. IP address & MACs (do you have a 3d printer or not?) - any info they can extract via their Smartphone Apps both on Android and IOS - Android devices share geolocation data with google anyways - user agents & browsing history on google properties and 3rd party websites - every time your IP addresses hit anything in google cloud or google CDNs (e.g jquery from googlestatic.com or google fonts) - all data you have ever provided to them (payment data, gcloud, gmail) - all the tracking that is already built into chrome and other google software Plus they procure data from third-party providers. Only a single app on your smartphone needs to have geolocation privilege and then the data (location, ip address and user data) is available for google to digest via their scripts/SDKs which are packaged into basically every smartphone app. The large tech companies have significant incentive to mutually share data with each other, that's why you often see Javascript from one tech company included in the website or product of another one. It's enough to touch a google dc with a single packet included in the facebook app for them to associate your session with the new IP address and vice versa. Google has years of data on how often user agents and devices behind a certain IP address change. They can very confidently say if your ISP-provided IP address has been rotated or not, and where it was rotated to. They most definitely have enough GPS positions from smartphones that they can predict where you sleep, so if your smartphone shows up under another IP address but the network devices around it stay the same they can easily deduce that this is your new dial-up IP address. All of this not even discusses unethical or clearly illegal ways these companies have acquired data by abusing a lack of security measures on the smartphone operating systems. An example is Facebook uploading entire smartphone contact books to their servers to fuel their "organic" growth - Google most definitely has done exactly the same. The "careless people" book highlights that Facebook deployed spyware with their smartphone apps which monitored what other apps the users were using - this is how they figured out that WhatsApp was going viral and based on this data they did the surprise acquisition of WhatsApp. I'm confident that google abuses the same security vulnerabilities in order to further collect data.
- kitd 9mo ago
  > Jitsi is about audio / video where this would make more sense, not about geolocation. It's still permission-based. And the article mentions that the same ux is being done for media objects.
- jeroenhd 9mo ago
  > Geolocation based on IP address is always done in the background, so they already know what city you are from They don't. Maybe the trackers do, but most websites place me 100km to the west. When I want to look up opening times for supermarkets near me, I like the "show nearby" button. Even Google gets confused because I VPN back to my home network. Every time I spend a few days somewhere else, Google's IP-based geolocation is broken again.