6 ms·

How apps track your location without asking for permission

98 points by zhongjiewu 11y ago

hex1337 11y ago
I wonder if this is a corner case of Google Play policy. Stealing privacy is forbidden on GP, but nearby wifi AP should be considered as a public accessible info.
- redwards510 11y ago
  Since nearby APs indicate where you are, I'd argue that IS private information.
yincrash 11y ago
Basically doing what the coarse location provider does anyways, which is corollate visible APs on the device with a db of mapped APs. Yes, it's possible, but constantly scanning for APs will have the side effect of an app draining battery even faster than if it used the phone's location service.
- minthd 11y ago
  I'm sure there are tricks against battery consumption - for example - scan only when user stops driving. And when user walking scan rarely. Or maybe use Gyro/Accelerometer to estimate where the user walked.
- halviti 11y ago
  During the Android setup process it asks you if you want to enable this feature and has a side note that these scans are specifically to save battery life because they take much less energy than typical location services.
  - yincrash 11y ago
    Yes, wifi scan location takes less power than GPS location. Rolling your own wifi location service in an app will take more power than the framework's service, however, and it will almost certainly be less optimized.
hitlin37 11y ago
may be they fix it as a new feature after Google M.
haywardsmyfault 11y ago
Very real issue to consider as we all try to guide Android's imminent permission system update (Make noise and open issues!) Is accessing nearby BSSIDs available in a similar fashion on iOS? A quick look reveals: https://developer.apple.com/library/ios/documentation/SystemConfiguration/Reference/CaptiveNetworkRef/index.html#//apple_ref/c/func/CNCopyCurrentNetworkInfo https://developer.apple.com/library/ios/documentation/System...
- eyesee 11y ago
  On iOS you can only access the information of the SSID you are connected to, not a list of nearby networks.
  - Someone1234 11y ago
    Android has a lot of information leaks. I hate to keep beating this dead horse, but as of last year Google gives every app you install access to your cellphone number without them needing to ask for an extra permission (READ_PHONE_STATE is now a freebie as far as the app store is concerned, it isn't listed, in fact it will say "no special permissions" if READ_PHONE_STATE alone is in the manifest). I honestly think Android's permission system is a joke, and a sceptical Google will fix the majority of the information leaks with this up-coming update. PS - It is "interesting" that getting your google account address requires a special permission on Android, but getting your phone number does not. Wonder why that is? IMEI too.
    - haywardsmyfault 11y ago
      Actually as of the Android M preview you can get the user email address without any permission guarding. This is because GET_ACCOUNTS is under PROTECTION_NORMAL, and so it is automatically granted at install time.
      - Someone1234 11y ago
        Ouch, that's certainly a step on the wrong direction. I guess they get points for consistency, but they're being consistently bad.
magicalist 11y ago
> Note that these metrics are accessible even with system wifi and location disabled Can someone explain this? It doesn't seem to make sense that with wifi disabled this would be possible (and the code they link to specifically has a fall through if wifi is disabled). Maybe something just got jumbled up in their explanation.
- tarentel 11y ago
  According to the paper: "the Android OS by default performs WiFi scans in the intervals of tens of seconds, even when the WiFi is turned off; the setting to disable background scanning when WiFi is off is buried in the advanced settings." It looks like you can stop this from happening when the WiFi is off it just requires an extra step. I don't have an Android device so I can't really verify this.
  - halviti 11y ago
    When you set up android for the first time it gives you some text explaining what this is and how it works, and asks you whether you want to enable/disable it. I'm not sure if this was ever a "default", but it is definitely part of the setup prompts now.
  - deleted 11y ago
    [deleted]
  - click170 11y ago
    The option you are looking for is called "Keep Wi-Fi on during sleep" and it can be found under Settings -> Wifi -> Advanced on Android 4.3. This is the only device I can test with. I advise turning it off unless you need it to be on, not only for privacy reasons but for battery life. I noticed an increase in battery life by turning that feature off.
    - harmarsupercar 11y ago
      On a Samsung Galaxy S5 running Lollipop (5.01?) it's under Wifi -> Advanced -> Always Allow Scanning. With this turned off and GPS turned on (ie, not using Wifi to determine locations) I get a terrible reduction in battery life because all locations are done finely with the GPS chip. With all location services disabled I get much better battery life.
ignoramous 11y ago
I am surprised that this is even news to people. Fire OS uses Wi-fi to set timezones (which means, by just knowing the BSSIDs, Amazon can pin point your location). Similarly, IP Addresses, if you have tolerance for error, can pretty much help you gauge (coarse) location as well. It goes without saying that the OHA-Android [0] is a data mine for Google already. With M, they're really upping that game [1]. Far worser things to worry about. [0] http://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-android-controlling-open-source-by-any-means-necessary/ http://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-... [1] http://www.computerworld.com/article/2931084/android/google-now-on-tap.html http://www.computerworld.com/article/2931084/android/google-...
izacus 11y ago
The original title of the article is "How apps track your location without asking for permission". Reading the article to the end: >> The same method also applies to iOS, which has greater user location data privacy protection. Nonetheless, iOS still allows acquiring the current connected wifi BSSID. A user can deny the location requests on an iOS device at will. However, an app using wifi BSSID can still get a user’s static location without asking. So singling out Android in HN submission title is grossly misleading. Especially since reading this comments shows that people don't read the articles posted -_-
- the-dude 11y ago
  > So singling out Android in HN submission title is grossly > misleading. Especially since reading this comments shows > that people don't read the articles posted -_- I have always considered HN the 'new Slashdot'
- j_baker 11y ago
  You know, every time I personally write a blog post, I've learned to just assume that people will only read the title. If I'm lucky they may also see a subtitle or read the first paragraph. But unless you just write some compelling content, almost nobody will read it all the way through. You can't blame people. We're so inundated with information these days, we have to skim through things.
- r00fus 11y ago
  I disable wifi everywhere but my home network. Even work (mainly because of reasonable traffic shaping on work wifi that doesn't align with my needs). On iOS only the connected wifi will expose the BSSID. Turn off promiscuous mode on iOS, don't join random networks, and you can't be tracked this way.
- sctb 11y ago
  Thanks, we updated the title to the article's.
XJOKOLAT 11y ago
It just gets worse. Can someone with more knowledge than I please give an opinion: Does the iphone or cyanogenmod do this? Are there any alternative phones/OS's which don't share your data? Thanks,
jimrandomh 11y ago
I tried their proof of concept app on CyanogenMod. Its PrivacyGuard was not fooled at all; it described the app as asking for Location permission, and it blocked access to the list of wifi access points unless that permission was granted.
jpmonette 11y ago
So what is that tool name mapping the BSSIDs on a Google Map? http://blog.trustlook.com/wp-content/uploads/2015/06/Screen-Shot-2015-06-02-at-6.13.30-PM-1024x474.png http://blog.trustlook.com/wp-content/uploads/2015/06/Screen-...

98 points by zhongjiewu 11y ago

I wonder if this is a corner case of Google Play policy. Stealing privacy is forbidden on GP, but nearby wifi AP should be considered as a public accessible info.

redwards510 11y ago
Since nearby APs indicate where you are, I'd argue that IS private information.

yincrash 11y ago

Basically doing what the coarse location provider does anyways, which is corollate visible APs on the device with a db of mapped APs. Yes, it's possible, but constantly scanning for APs will have the side effect of an app draining battery even faster than if it used the phone's location service.

minthd 11y ago
I'm sure there are tricks against battery consumption - for example - scan only when user stops driving. And when user walking scan rarely. Or maybe use Gyro/Accelerometer to estimate where the user walked.
halviti 11y ago
During the Android setup process it asks you if you want to enable this feature and has a side note that these scans are specifically to save battery life because they take much less energy than typical location services.
- yincrash 11y ago
  Yes, wifi scan location takes less power than GPS location. Rolling your own wifi location service in an app will take more power than the framework's service, however, and it will almost certainly be less optimized.

hitlin37 11y ago

may be they fix it as a new feature after Google M.

haywardsmyfault 11y ago

Very real issue to consider as we all try to guide Android's imminent permission system update (Make noise and open issues!) Is accessing nearby BSSIDs available in a similar fashion on iOS? A quick look reveals: https://developer.apple.com/library/ios/documentation/SystemConfiguration/Reference/CaptiveNetworkRef/index.html#//apple_ref/c/func/CNCopyCurrentNetworkInfo https://developer.apple.com/library/ios/documentation/System...

eyesee 11y ago
On iOS you can only access the information of the SSID you are connected to, not a list of nearby networks.
- Someone1234 11y ago
  Android has a lot of information leaks. I hate to keep beating this dead horse, but as of last year Google gives every app you install access to your cellphone number without them needing to ask for an extra permission (READ_PHONE_STATE is now a freebie as far as the app store is concerned, it isn't listed, in fact it will say "no special permissions" if READ_PHONE_STATE alone is in the manifest). I honestly think Android's permission system is a joke, and a sceptical Google will fix the majority of the information leaks with this up-coming update. PS - It is "interesting" that getting your google account address requires a special permission on Android, but getting your phone number does not. Wonder why that is? IMEI too.
  - haywardsmyfault 11y ago
    Actually as of the Android M preview you can get the user email address without any permission guarding. This is because GET_ACCOUNTS is under PROTECTION_NORMAL, and so it is automatically granted at install time.
    - Someone1234 11y ago
      Ouch, that's certainly a step on the wrong direction. I guess they get points for consistency, but they're being consistently bad.

magicalist 11y ago

> Note that these metrics are accessible even with system wifi and location disabled Can someone explain this? It doesn't seem to make sense that with wifi disabled this would be possible (and the code they link to specifically has a fall through if wifi is disabled). Maybe something just got jumbled up in their explanation.

tarentel 11y ago
According to the paper: "the Android OS by default performs WiFi scans in the intervals of tens of seconds, even when the WiFi is turned off; the setting to disable background scanning when WiFi is off is buried in the advanced settings." It looks like you can stop this from happening when the WiFi is off it just requires an extra step. I don't have an Android device so I can't really verify this.
- halviti 11y ago
  When you set up android for the first time it gives you some text explaining what this is and how it works, and asks you whether you want to enable/disable it. I'm not sure if this was ever a "default", but it is definitely part of the setup prompts now.
- deleted 11y ago
  [deleted]
- click170 11y ago
  The option you are looking for is called "Keep Wi-Fi on during sleep" and it can be found under Settings -> Wifi -> Advanced on Android 4.3. This is the only device I can test with. I advise turning it off unless you need it to be on, not only for privacy reasons but for battery life. I noticed an increase in battery life by turning that feature off.
  - harmarsupercar 11y ago
    On a Samsung Galaxy S5 running Lollipop (5.01?) it's under Wifi -> Advanced -> Always Allow Scanning. With this turned off and GPS turned on (ie, not using Wifi to determine locations) I get a terrible reduction in battery life because all locations are done finely with the GPS chip. With all location services disabled I get much better battery life.

ignoramous 11y ago

I am surprised that this is even news to people. Fire OS uses Wi-fi to set timezones (which means, by just knowing the BSSIDs, Amazon can pin point your location). Similarly, IP Addresses, if you have tolerance for error, can pretty much help you gauge (coarse) location as well. It goes without saying that the OHA-Android [0] is a data mine for Google already. With M, they're really upping that game [1]. Far worser things to worry about. [0] http://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-android-controlling-open-source-by-any-means-necessary/ http://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-... [1] http://www.computerworld.com/article/2931084/android/google-now-on-tap.html http://www.computerworld.com/article/2931084/android/google-...

izacus 11y ago

The original title of the article is "How apps track your location without asking for permission". Reading the article to the end: >> The same method also applies to iOS, which has greater user location data privacy protection. Nonetheless, iOS still allows acquiring the current connected wifi BSSID. A user can deny the location requests on an iOS device at will. However, an app using wifi BSSID can still get a user’s static location without asking. So singling out Android in HN submission title is grossly misleading. Especially since reading this comments shows that people don't read the articles posted -_-

the-dude 11y ago
> So singling out Android in HN submission title is grossly > misleading. Especially since reading this comments shows > that people don't read the articles posted -_- I have always considered HN the 'new Slashdot'
j_baker 11y ago
You know, every time I personally write a blog post, I've learned to just assume that people will only read the title. If I'm lucky they may also see a subtitle or read the first paragraph. But unless you just write some compelling content, almost nobody will read it all the way through. You can't blame people. We're so inundated with information these days, we have to skim through things.
r00fus 11y ago
I disable wifi everywhere but my home network. Even work (mainly because of reasonable traffic shaping on work wifi that doesn't align with my needs). On iOS only the connected wifi will expose the BSSID. Turn off promiscuous mode on iOS, don't join random networks, and you can't be tracked this way.
sctb 11y ago
Thanks, we updated the title to the article's.

XJOKOLAT 11y ago

It just gets worse. Can someone with more knowledge than I please give an opinion: Does the iphone or cyanogenmod do this? Are there any alternative phones/OS's which don't share your data? Thanks,

jimrandomh 11y ago

I tried their proof of concept app on CyanogenMod. Its PrivacyGuard was not fooled at all; it described the app as asking for Location permission, and it blocked access to the list of wifi access points unless that permission was granted.

jpmonette 11y ago

So what is that tool name mapping the BSSIDs on a Google Map? http://blog.trustlook.com/wp-content/uploads/2015/06/Screen-Shot-2015-06-02-at-6.13.30-PM-1024x474.png http://blog.trustlook.com/wp-content/uploads/2015/06/Screen-...