16 ms·
Ban the sale of precise geolocation
- titzer 6mo agoThese people really have no idea at the level of data collection from Google's rootkit on Android known as "Google Play Services".
- troupo 6mo agoDon't you want random companies to store your precise location for 12 years? https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541
- Swizec 6mo agoScreenshot in that tweet says 13 months FYI
- mzajc 6mo ago> Lifespan: 13 Months > ... > Standard retention (4320 Days) It looks like a cookie prompt, so I assume "Lifespan" refers to cookie expiration and "retention" to how long the data (including geolocation) is retained on the spyware company's servers.
- troupo 6mo ago[Cookie] Lifespan: 13 Months Data Retention: Standard Retention (4320 days)
- ch4s3 6mo agoIMO we should ban gathering this data without a warrant or specific contractual agreement between the device owner and entity aggregating the data. As much as congress loves to claim the interstate commerce theory of everything, this seems like a slam dunk.
- Dwedit 6mo agoContractual agreement? Nobody reads things like EULAs or terms of service. It's probably in there already.
- rubyfan 6mo agoRight, privacy terms are written to be vague and permissive. Even if you read them you can’t usually understand how the data will be used or opt out.
- toofy 6mo agoif it were up to me i’d require a hand signed contract that explicitly, up front and in plain english gives permission and is not transferable to any “partners”.
- ch4s3 6mo agoI should have been a bit more clear. We should ban retention for any purposes where it is not explicitly required for the intended function and clearly agreed to by all parties. Think somethig like strava or asset tracking. You know it stores gps data, and why.
- ryandrake 6mo agoThere is no such things as "clearly agreed to by all parties" when it comes to end users. Companies provide a one-sided, "take it or leave it" EULA, and if you don't agree to everything in it, you don't use the product. There is no meeting of the minds, there is no negotiation, and there is no actual agreement. It's a rule book dictated by one side.
- pocksuppet 6mo agoThen it's not a valid contract and therefore does not absolve them of criminal liability for stalking you.
- 6mo ago
- uxhacker 6mo agoMore details are available here, including screenshots of the tool. https://citizenlab.ca/research/analysis-of-penlinks-ad-based-geolocation-surveillance-tech/#3-Webloc https://citizenlab.ca/research/analysis-of-penlinks-ad-based...
- mtlynch 6mo agoCorresponding HN thread: https://news.ycombinator.com/item?id=47758309 https://news.ycombinator.com/item?id=47758309
- wolvoleo 6mo agoJust ban the sale of any kind of adtracking. That way we can get rid of the cookiewalls too. Missed opportunity by the EU when they wrote GDPR.
- troupo 6mo agoGDPR literally prohibits the sale of user data and tracking without user consent (because yes, you want to give people the possibility to opt in for a variety of reasons). GDPR has literally nothing to do with cookie popups. That was, and is, adtech
- pocksuppet 6mo agoI think they are saying GDPR did not ban websites from noisily asking for consent and trying to trick you into giving consent.
- wolvoleo 6mo agoWell they did but that is not policed. For example, giving consent should be the same difficulty as denying it. So one click consent means there must be also one click non-consent. But this is policed very poorly. I think they should just ban adtech altogether, at least any form of targeted advertising, individual pricing (which is already illegal in many EU countries) and ideally also deep market research.
- lotu 6mo agoMy job was building cookie walls in response to GDPR. It might not have been the “intent” but it certainly was the consequence of that law.
- troupo 6mo ago> My job was building cookie walls in response to GDPR. If you're building cookie walls, you are not building them in response to GDPR. You are literally building dark patterns intended to circumvent GDPR and trick users into accepting any and all data collection. You wouldn't need to build cookie walls if people you work for didn't, say, store precise geolocation of everyone for 12 years: https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541
- Johnbot 6mo agoA lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by checking where the device returns to at night you can figure its home address. Then if you find information on the residents (work locations, schools, etc.), you see if said device goes where each resident of the home address is likely to go, and you now have a pretty good idea of exactly who the device belongs to.
- 1121redblackgo 6mo agoYep. With side channel/one order of thinking above the laws, its trivial to get around said laws. Need better laws.
- sroussey 6mo agoCompanies exist that de-anonymize other data brokers data. Lets the other data brokers claim they have anonymized data while end end users get everything.
- ImPostingOnHN 6mo agoyou could probably run a anonymization company at the same time you run a de-anonymization company
- gessha 6mo agoBest of both worlds - legal and profitable \s
- rockskon 6mo agoThere is no such thing as anonymized location data when you have the location of something where and when they sleep and work. It's a rhetorical fiction the ad industry tells itself.
- lifestyleguru 6mo agoSmartphones, mobile apps, mobile networks, and WiFi stopped being your friends around 2015-2016. Now it's just a matter of how much data can be harvested from device sensors in real time until reaching a pain point which doesn't exist.
- mystraline 6mo agoYep. And the FLOSS/Linux phone hardware attempts have frankly sucked. I was hoping that my PinePhone Pro would actually be usable. But no, its a PineDoorstop. Proper Linux would be a great 3rd choice. But yeah. We've got a duopoly and not much we can do about it.
- 9991 6mo agoGrapheneOS is a proper Linux. The hardware isn't open, but otherwise it's quite nice and clearly designed for the end-user's benefit, in stark contrast to the more widely-adopted alternative mobile OSes.
- reorder9695 6mo agoIf anyone's interested in this the book "The Age of Surveillance Capitalism" is rather revealing of the sheer scale of this.
- Cider9986 6mo agoWiFi isn't that bad, we have mac address randomization[1] and VPNs. Cellular is obscenely bad, though. [1] https://grapheneos.org/usage#wifi-privacy https://grapheneos.org/usage#wifi-privacy
- Eextra953 6mo agoDoes anyone know of any groups that are organizing and lobbying to get things like this into law? I know about the EFF but they seem to be more focused on documenting and reporting instead of lobbying and getting things passed.
- glitchc 6mo agoHow about we just ban the collection of precise geolocation? Wouldn't that be a better solution?
- Mithriil 6mo agoI would expect such a law to be lobbied to death.
- davebren 6mo agoYou can have legitimate use cases where it's a core functionality of the application to store it, so the user obviously knows it's being collected and agrees by using it.
- warkdarrior 6mo agoSo you want to ban all mapping apps and all fitness apps?
- ssl-3 6mo agoNothing external needs my precise location to navigate with a map. An approximate location is sufficient to deliver to my device a map of an area I'm in, and of the overall route, and all of the details that are useful for navigation. Fitness apps can be local. We have pocket supercomputers; certainly, we don't need help from the clown to keep track of how far (or how energetically) we biked or walked today, or where that took place.
- romaniv 6mo agoThe problem with all these discussions about banning stuff is that privacy is always on the back foot. It's by design. People who want to surveil and manipulate us are actively investigating new ways of doing it, they get paid for it and they risk nothing in the long run. All of these discussions about specifics are just reactions. They aren't even reactions to the surveillance itself, but rather to a discovery by someone that a new surveillance machine has been constructed and launched. So the current feedback process involves: construction → exploitation → reporting → public awareness → legislation. This is too slow. Moreover, operating in this environment is exhausting. We need a different feedback loop altogether. I'm not sure which one would work best, but something different needs to be considered.
- jjk166 6mo agoYeah, abuse of privacy should be the crime, the same way theft is. How exactly the crime is committed shouldn't matter. Companies can have every right to make a compelling argument that what they did was not an abuse of privacy when they are defending themselves in court. And critically, it is not someone becoming aware of private information that is the abuse of privacy, it is exploiting that private information which is the abuse. There may be countless legitimate technical reasons you need to collect data, but there can not possibly be a technical justification for selling it.
- heavyset_go 6mo agoA culture that values privacy, out of respect, necessity and/or fear, has potential to sabotage each step of the process even if it were not to change. There was a point, at least in my bubble, where there was a general sense that government surveillance is bad (expect against those people). I think coming out of the Cold War, then 9/11, and followed by propaganda obfuscating the increase, purpose and prevalence of private surveillance took us from "no, we aren't Stalinist Russia" to "I don't care, I have nothing to hide" to just "I don't care" when it comes to the topic of surveillance at all. Unfortunately, it will take great shocks to instill it so the next generation can learn from the suffering of the previous, and then forget it when privacy is taken for granted again.
- linkjuice4all 6mo agoLet’s just stretch copyright to cover movement/location as a protected creative expression. It’s somewhat ridiculous but we’ve already established case law and technology for handling/mishandling protected assets.
- gruez 6mo agoThen they add a clause to the ToS with "you grant us and our affiliates a worldwide, non-exclusive, royalty-free, sublicensable and transferable license to your location..."
- hn_acker 6mo agoCory Doctorow argued against using copyright law as a substitute for privacy law or labor law [1], and I argue the same for location privacy. Copyright law already gets abused enough in contexts that indisputably involve copying of creative work. I do not want to stretch copyright law into location/movement privacy, where nonconsensual recording of location/movement does not necessarily copy something created by the person whose location was tracked. At least in the US, copyright comes into existence when creative expression is recorded in a tangible medium (such as your device's RAM, because outside of my beloved meme world you cannot download more RAM), and the copyright belongs to whoever did the recording. If an app on your phone records your location, was it you who recorded it? Was it the phone maker who recorded it? Was it the app maker who recorded it? Keep in mind, maybe you didn't install the app, or maybe you weren't aware that the app would track your location when you first installed it. [1] https://pluralistic.net/2023/10/21/the-internets-original-sin/ https://pluralistic.net/2023/10/21/the-internets-original-si...
- lifeisstillgood 6mo agoThere needs to be a believeable legal framework behind this. Imagine a option on your iPhone that says “Enable this to allow geo-location tracking for organisations registered under the NOADSJUSTPUBLICGOOD Act” - then any wifi endpoint could locate you as long based on signal strength etc and that data could only be made available to people registered under the act. Would we see new understanding of how people move around in cities, would we see better traffic information, Inthink so - as long as people believe that there are real teeth to the laws and they enforced loudly and publically. We should embrace the benefits of a society wide epidemiology experiment - the benefits for public health are incredible. (Add to that supply chain logistics on open ledgers and many of the new things that just were not possible before and the future of open transparent but well regulated democracies is bright. Let me know if you spot one.
- kristianpaul 6mo agoHaven't read the article yet but having more NTRIP public endpoint could help a lot to this precise location
- shevy-java 6mo agoSoon Geolocation will be tied to Age! Then you can meet locals and congratulate them on their birthday. The movie Minority Report was way too timid in its prediction here. Age up everything! \o/
- erelong 6mo agoAlternatively, opt out of services that sell it
- reenorap 6mo agoI'm of the opinion now that posting videos online without the explicit permission of EVERYONE in the video should be illegal. It's one thing to take a video and keep it on your phone but if you share it outside of your family and only your family, then it needs to have the expressed consent of everyone whose face is on it otherwise it should be a crime. The previous views on privacy didn't take into account the fact that everyone now has video cameras and people are incentivized to violate privacy to make money as influencers. I think people's privacies need to be protected and I think that means making laws around it much, much stricter. This includes things like location data, it shouldn't be sold or exposed at all.
- wakawaka28 6mo agoSo, no videos of festivals or politicians speaking? How about legally recorded conversations or anything else exposing corruption? Body cam footage? Harassment is already a crime. Take care not to come up with oppressive laws to deal with a nuisance.
- kidnoodle 6mo agoI had a theory that the way to solve this was a location intelligence data union which sold safely anonymised aggregates and shared the profits, while also litigating on behalf of members under available legislation to stop other people using their data. Alas, I was stymied by not having any cash to work on it, and the unit economics were not very VC friendly (at least I assume that’s one of the reasons why I didn’t get any traction from VCs).
- groos 6mo agoMost people don't realize how bad geolocated data is for a free society. I can buy data from a broker, geo-fence your house address, and then I'm able to see all the places where you went, who you associate with, and identify all you associate with by tracking them to addresses. All of this happens with anonymized device identifiers. It is the wet dream of a company such as Palantir and all governments who desire absolute control over their populations.
- pnw 6mo agoThe examples show Android devices. How does Webloc track iOS devices given Apple doesn't allow unique IDs and allows the user to disable the ad ID? I wish these articles would go into a bit more detail for the technical reader.
- treebeard901 6mo agoOnce wealthy and powerful people realize how this can be used to track them they will start cracking down. One of many examples for how underrated access to location data is for unauthorized people, it is a primary way that the military locates and kills targets in foreign countries. It is surprising all of the data is so freely available with data brokers. Or in some cases from the app companies themselves, if you're willing to make it worth the trouble for them.
- crummy 6mo agoSeems there’s an opening for an ElonJet-like tracker that operates on this data.
- Schiendelman 6mo agoThey realize it. But they can exercise enough power to target removal of information that they don't want public.
- charcircuit 6mo agoI think it's fair for law enforcement to compensate the people collecting this data instead of forcing them to give it away for free.
- ButlerianJihad 6mo agoWhen I had the opportunity to peer into public records, I found some extremely intriguing stuff. There was one person with a feminine name who showed up with a “home address” that would correspond to being my “neighbor” at home, at my clinic, at church, when I went to college, etc. All the years corresponded correctly, and the addresses were some residential place about a block or less away from the places where I went. For all I know, this person was either fictional or an innocent bystander. She did appear to have a Facebook account or two. I was never able to directly contact her. But I found it very strange and I wondered what would be gained by doxxxing me in this manner? Of course this has nothing directly to do with GPS coordinates, but imagine if the GPS began to be part of your public record as well, or on your credit report. Imagine if it was entered into the public record what coffee house you visited every morning, or if there were errors in this record.
- GJim 6mo ago> GPS coordinates * coordinates There are many ways of establishing ones latitude and longitude without recourse to one particular GNSS system.
- ButlerianJihad 6mo agoExcuse my colloquialism. All I meant was “universally recognized coördinate format”, okay?
- Terr_ 6mo ago"Get consent first" hasn't worked because the average consumer can't give informed consent to the kind of stuff going on behind the scenes. What about: "If something bad happens because of the data your company shared or lost, it is criminally and financially liable?"
- atmosx 6mo agoBoth make sense. Depends on who you want to protect.
- eptcyka 6mo agoI want geolocation to not be sold. Yet, I do not believe we have been successful in banning the sale of cocaine and elephant tusks. What makes us think this will be an easier problem to solve?
- KaiserPro 6mo agoThe problem the USA has is that it has no concept of "private data" outside of some part of HIPAA. Until that changes you're going to be stuck. Something as simple as the data protections act 1998 (https://en.wikipedia.org/wiki/Data_Protection_Act_1998 https://en.wikipedia.org/wiki/Data_Protection_Act_1998) would kneecap a lot of the shady shit that goes on in the USA.
- victor22 6mo agoYou cannot regulate anything anymore, everything is geotracked, be real
- sciencesama 6mo agoinstead buy it and show the horror things ! may be focus on politicians who can be swayed with this data !
- duxup 6mo agoIt's frustrating how much of the system already is a hassle for everyone who already does the things right. I make some apps that use precise location. We don't sell the data, we share it with the interested party who the app user is working for only. The user is fully aware when the data is collected and when not, they can even turn it off at will. Nobody even cares who has the device, just that they're delivering a package or something to that effect. It's all good. Then I hit the app-stores and it's like pulling teeth with paperwork and rejections (depends on the reviewer, sometimes you fly through, sometimes very much not). I have to attest that we don't do shit with an email that may or may not appear in a field, that we don't do porn (I have no idea where that reviewer got that idea). Some reviewer misread something and now I have to explain that no we don't use contacts, we never do... wtf. More delays. I'm privacy minded so I don't so much mind the IDEA that I have to attest to all these things, but all the hoops I have to run through is because the bad guys who steal all this info and sell it do their thing, but they're still doing their bad thing just fine ... Meanwhile my app is stuck in review. It feels like being pulled over randomly by the cops because "well there's a lot of speeders out there" when I'm not one of them. It's all hassle for everyone doing it right, and for the bad guys or the apps that clearly don't have to follow the rules that everyone else does it has no impact on them. The whole system is borked.
- nullc 6mo agoPerhaps you saw the news about GM reaching an FTC settlement because they were tracking the locations cars they made at all times and selling the information to LexisNexis. You might have left the articles with a belief that GM agreed to stop. Their settlement allows them to sell precise locations -- but with 'anonymous ids' instead of names, and also allows them to sell data with name/personal information but only zipcode resolution location information.