This is whack-a-mole at best. Another lib will replace this one.
The real problem is corporations trying the destroy the open web, again. We had AOL and CompuServe, now we have app stores. Consumers have been conditioned to install apps for basic things, just so they can slurp up their data.
Unfortunately this round of internet-killers are much better funded. The open web won in the past, but there is no guarantee it will win this time.
> Consumers have been conditioned to install apps for basic things
It's an unfortunate development, but I wouldn't call it "conditioning", it didn't really look like a coordinated plan - just a textbook case of people with good intentions paving a shiny road to hell. Native apps are intrinsically superior to the web experience; this is true on mobile and desktop alike. The push to native apps came before tracking was so widespread, developers just wanted people to have a great experience.
Unfortunately, the amount of private data exposed by mobile platforms (and one of the two platforms being owned by an advertiser interested in such data) is so much more valuable than what was ever exposed on desktop... when this fact became common knowledge, consumers were screwed.
It is becoming increasingly evident to me that having location APIs enabled on smartphones is an accident waiting to happen. As of about a year ago, location services are disabled at the OS level on all of my mobile devices.
There’s situations where it makes sense. Third party mapping software for one. Imagine the uproar (and possible lawsuit) if Apple allowed their Maps app access to the location, but not third party apps like Google’s.
The solution isn’t to turn off location services, but to use permissions so that only apps I approve can have access to it. Both iOS and Android have that feature.
Personally I wasn't losing any sleep before knowing apps might be sending location data to advertisers. Why should I even care? But now what I find obnoxious is being nagged about explicitly approving every little permission to every app, even having to wait until the app wants to use it to approve it which was an especially stupid change. And now I don't even get to let apps use location data all the time from most menus, and when I do I get nagging reminders from Samsung trying to scare me into turning it back to "only when in use." The model on Windows where a program can do things a program should be able to do without asking was completely fine and discrete permissions for apps are an obnoxious waste of time in my opinion.
The problem is people just hit accept without understanding what is happening. The problem requires a legal solution. It should just be plain illegal to collect the users location for anything other than providing the features the user expects and any extra use of that data should not be permitted.
LineageOS ships with Google’s location services. Plus, Google has changed the way that third-party location services have to be installed in Android. Now, they have to be installed as a system app, not as a normal app. This requires knowledge of how to use the command line over ADB, and you also have to install some special files that allow your custom-installed location services to survive system upgrades.
So, I have Mozilla location services running on my LineageOS phone instead of Google’s, but only because I'm that tiny minority of nerds who knows how to do all that. Ordinary people might prefer to simply install MicroG’s fork of LineageOS, which avoids Google outright and provides third-party location services.
I wonder how it works on Huawei phones that shipped with Android after they weren't allowed to ship with Google services. I think P40 was the last phone to ship with Google services?
There's a very interesting thing going on with this: what they mean is, Android location requests go through the location API provider on the phone, and Android phones the US is familiar with are content to roll with Google's location API
No, systemwide location stays off. It transmits your ip+location mapping to Apple or Google whenever it's on (via the WiFi triangulation lookup), even if you've granted no apps location permission. Any subsequent requests from that IP for the next while can be assumed to be in the same location, precisely geolocating requests from your other devices on the same connection as well.
I would prefer Apple and Google not receive my 24/7 tracklog. I don't believe that I need to have anything to hide to say that I don't think it's reasonable for an advertising company to know where I am 24/7/365.
One question: On Android, when I disable access to location for a specific app, does the library have a way to access the location anyway? My belief is that no, that it can't do that, but I may be wrong.
What if library "A" is included in a background app with access to location services, it then locally broadcasts via UDP or listens on a TCP port for incoming local connections, so that a library "B" can either listen to those UDP broadcasts or connects to the local TCP port of library "A" to receive the location data. Is this a possible scenario? Is Android monitoring such a behavior?
Sure it's possible, and I don't think that's part of the security model. If you're letting app/library "A" access your location, you're trusting it. If you're worried that it might send that data to your worst enemy, you should disable access for library A.
26 comments
[ 6.8 ms ] story [ 85.2 ms ] threadThe real problem is corporations trying the destroy the open web, again. We had AOL and CompuServe, now we have app stores. Consumers have been conditioned to install apps for basic things, just so they can slurp up their data.
Unfortunately this round of internet-killers are much better funded. The open web won in the past, but there is no guarantee it will win this time.
Though TBH I suspect that was added purely because it's a significant source of battery-drain.
It's an unfortunate development, but I wouldn't call it "conditioning", it didn't really look like a coordinated plan - just a textbook case of people with good intentions paving a shiny road to hell. Native apps are intrinsically superior to the web experience; this is true on mobile and desktop alike. The push to native apps came before tracking was so widespread, developers just wanted people to have a great experience.
Unfortunately, the amount of private data exposed by mobile platforms (and one of the two platforms being owned by an advertiser interested in such data) is so much more valuable than what was ever exposed on desktop... when this fact became common knowledge, consumers were screwed.
The solution isn’t to turn off location services, but to use permissions so that only apps I approve can have access to it. Both iOS and Android have that feature.
So, I have Mozilla location services running on my LineageOS phone instead of Google’s, but only because I'm that tiny minority of nerds who knows how to do all that. Ordinary people might prefer to simply install MicroG’s fork of LineageOS, which avoids Google outright and provides third-party location services.
I'd use GrapheneOS where possible. Consider making it possible where it's not.
I would prefer Apple and Google not receive my 24/7 tracklog. I don't believe that I need to have anything to hide to say that I don't think it's reasonable for an advertising company to know where I am 24/7/365.
What if library "A" is included in a background app with access to location services, it then locally broadcasts via UDP or listens on a TCP port for incoming local connections, so that a library "B" can either listen to those UDP broadcasts or connects to the local TCP port of library "A" to receive the location data. Is this a possible scenario? Is Android monitoring such a behavior?