this post was submitted on 17 Jan 2025
132 points (98.5% liked)

Cybersecurity

8878 readers
8 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago
MODERATORS
all 46 comments
sorted by: hot top controversial new old
[–] rumba@lemmy.zip 89 points 11 months ago (3 children)

The problem is, I want location tracking. I want a piece of software to tell me where I left my headphones or my wallet. I want it to let me know that I left the house without my bag. I want to have a piece of software Tell me where I was 3 Thursdays ago at 7pm for what the date was The last time I went to a certain park. I want my navigation software to tell me that I need to make a left turn up ahead.

I just don't want Apple or Google to have that information.

My carrier and my ISP know where I am, that is unavoidable. They don't even need GPS to tell that they know where their assets are and they know which of their assets I'm connecting to. I am quite certain the NSA has access to that data as well.

[–] homesweethomeMrL@lemmy.world 15 points 11 months ago (1 children)

IT'S JUST THE ADVERTISING ID. NOT THE LOCATE PHONE PART.

Brought to you buy jerks who haven't had their coffee yet and read TFA.

[–] rumba@lemmy.zip 7 points 11 months ago (1 children)

FTA, that TA linked to as it's source

The hackers said they have stolen a massive amount of data, including customer lists, information on the broader industry, and even location data harvested from smartphones which show peoples’ precise movements, and they are threatening to publish the data publicly.

They claim to have precise loc data, unless that's not what you meant

[–] homesweethomeMrL@lemmy.world 8 points 11 months ago (1 children)

This data is harvested from apps rather than the phones themselves, as EFF explains, “each time you see a targeted ad, your personal information is exposed to thousands of advertisers and data brokers through a process called real-time bidding’ (RTB). This process does more than deliver ads—it fuels government surveillance, poses national security risks, and gives data brokers easy access to your online activity. RTB might be the most privacy-invasive surveillance system that you’ve never heard of.”

[–] rumba@lemmy.zip 5 points 11 months ago (1 children)

apps rather than the phones themselves,

In this case, they took it from a marketing agency, who collected it from apps, who got it from the phones.

The "app" adds location services as a permission requirement. Then they add the API for the advertiser. When they app runs, it calls the API which gathers location data.

So you'd think you can just disable location services for the app.

But what happens when they end up stealing it from Waze, or Tile, or Apple. What happens when google just sells it to people?

The only reasonable option is to turn it off at the phone level. But even then, aGPS knows. Your Carrier knows.

To stop this from being a thing, it needs to be done from the ground up with a privacy respecting OS run by a privacy respecting company, serviced by a privacy respecting server.

so basically never.

[–] homesweethomeMrL@lemmy.world 3 points 11 months ago (1 children)

But what happens when they end up stealing it from Waze, or Tile, or Apple. What happens when google just sells it to people?

Indeed.

To stop this from being a thing, it needs to be done from the ground up with a privacy respecting OS run by a privacy respecting company, serviced by a privacy respecting server.

Same as it ever was.

[–] boonhet@lemm.ee 1 points 11 months ago

Google, Apple, etc selling the data is actually unlikely. They don't want other advertisers data to be as competitive as their own.

The smaller players though, get more profit selling data because they'll never compete with the giants on the targeted ads front.

[–] 01189998819991197253 4 points 11 months ago

I am quite certain the NSA has access to that data as well

I'mma drop this here.

[–] Tar_alcaran@sh.itjust.works 66 points 11 months ago* (last edited 11 months ago) (1 children)

US government: "Location tracking is bad and dangerous"

Also US government: "We're not going to ban it, because that'll cost corporations money"

Also US government: "We'll just tell everyone to turn it off, so that it's their own fault from now on!"

[–] henfredemars 20 points 11 months ago (1 children)

The left hand knows not what the right hand is doing.

[–] Idontevenknowanymore@mander.xyz 4 points 11 months ago (1 children)

The Shadow(government) knows.

[–] homesweethomeMrL@lemmy.world 2 points 11 months ago (1 children)
[–] 01189998819991197253 1 points 11 months ago

But I was in the light...

[–] ShellMonkey@lemmy.socdojo.com 30 points 11 months ago (1 children)

Really? But my flashlight app says it needs location permissions to work...

My biggest gripe with Android perhaps is that somehow the nearby devices/location permissions is tied into WiFi and Bluetooth rather than just having a separate 'communications' permission to say who can use the network links.

[–] unexposedhazard@discuss.tchncs.de 0 points 11 months ago* (last edited 11 months ago) (1 children)

I dont really understand what you mean by the second. If an app has WiFi and Bluetooth access, then it has location access. Not including WiFi and Bluetooth under location permissions would be very bad, because the average person doesnt understand that those things can be used to locate you.

[–] ShellMonkey@lemmy.socdojo.com 4 points 11 months ago (2 children)

It could go both ways. Simple example might be an offline GPS app, allow it location but not network other than when downloading maps. Network based location is a crude thing at the IP level, but can get pretty accurate if based on BT/WiFi access point.

It's a bit better with the 'only when in use' option on modern versions, but 'in use' could be a bit subjective if an app keeps a running service in the background. I seem to recall that Graphine has them split out as two distinct things.

[–] unexposedhazard@discuss.tchncs.de 5 points 11 months ago* (last edited 11 months ago)

Oh i see. CalyxOS has a built in firewall app to restrict that, which is handy.

[–] Eheran@lemmy.world 2 points 11 months ago (1 children)

Why should it be allowed to see the wifi SSID etc.?

[–] ShellMonkey@lemmy.socdojo.com 3 points 11 months ago

The device will try and feed this info to Google for location when GPS can be reached. It's possible to turn off, but the fact that it can be used is troubling. Anything that can be turned off at a toggle can get flipped back on with an update.

[–] Taleya@aussie.zone 29 points 11 months ago (2 children)

I remember when government institutions caught a company doing shit like this they'd just cut their balls off, not issuing a whining psa

[–] Disaster@sh.itjust.works 7 points 11 months ago

Really? I thought they'd deep throat them for data?

[–] homesweethomeMrL@lemmy.world 27 points 11 months ago

Our phones know where we are and they know where we have been—the problem is they have a nasty habit of sharing that information with others.

What. The. Fuck. Do you think you're doing?? A "nasty habit"??? You know good and goddamned well they're designed specifically to do that, and that location data is among the most prized of all personal information.

What sort of mindfuck juice are you chugging to write an inconcievably idiotic sentence like "phones do the cutest thing - they leak your location data! OMG! Squeeee"

[–] luce@lemmy.blahaj.zone 18 points 11 months ago (2 children)

Thanks for the suggestion... NSA?

[–] ArsonButCute@lemmy.dbzer0.com 12 points 11 months ago (1 children)

That was my first thought too. Like, thanks for the reminder but aren't y'all the ones who kinda want my location data on?

[–] luce@lemmy.blahaj.zone 3 points 11 months ago* (last edited 11 months ago)

Yeah, them saying this really just means that they dont need location data to spt on you

[–] Chakravanti@monero.town 5 points 11 months ago

No one listened to Snowden a decade ago...but now the explanation is...official??

[–] TheReturnOfPEB@reddthat.com 16 points 11 months ago (1 children)

I'm not letting the NSA design my use of technology nor am I letting Forbes be the siren song of my personal security from technology.

Why would I trust either of those sources ?

[–] HereIAm@lemmy.world 9 points 11 months ago (1 children)

Have fun not using AES then.

[–] HereIAm@lemmy.world 4 points 11 months ago

I would just like to clarify I'm not a fan of the NSA. Just it's not unusual for them also support security. I believe SELinux even stems from them.

[–] DigitalNirvana@lemm.ee 6 points 11 months ago (4 children)

So what are y’all well informed, and security conscious folx doing? Truly location data can be useful for me, for people I want to know sometimes, but gets kind of concerning for certain entities to know and be able to track over time.

[–] Monument@lemmy.sdf.org 4 points 11 months ago (1 children)

This is my semi-lazy approach. I’m sure someone is going to tell me all the ways that I’m falling down on this front, but…

I switched over to iPhone in like 2019. I started getting ‘stealth’ ads in google maps while driving, and I just could not deal with it. It made me reconsider all of Google’s products, and I made an effort to get away from them. (The stealth ads were like “In a quarter mile, continue past the [name of store] on your right” on a perfectly straight road. At the time I was giving a lot of thought to dark patterns and how they influence our behavior, and I just could not see that occurrence as anything other than manipulation. Ironically, I’ve since learned it may have actually been due to GIS errors thinking the road curved when it didn’t, and Google not having a nearby street to use for reference, but like… I don’t know, and I don’t care.)
On my iPhone I set it up to never send advertising ID/opt out of ad personalization.
I don’t give apps permissions they don’t have a clear reason for needing - Your camera can give away your location because of photo geotagging. Network access can report on what devices you have on your network as well as your network information, which is something that’s trackable and geolocatable. In an extreme edge case, network access could be used to find file shares on your network and use those to gather information about you. Bluetooth for same reasons. There are advertising networks based on Bluetooth, since your hardware MAC is not changeable and is freely shared. It can be used to track your location within a store, or figure out where you’ve been. A device that connects your identity (email login or something) to your bluetooth MAC can be used to build profiles on where you’ve shop and what sections you loiter in stores. And obviously, location access. I semi-routinely audit which apps are on my phone, and remove ones I don’t use and restrict permissions that I may have granted for a good reason but no longer need the app to have.
I don’t use the same email for anything anymore. I use an email masking service to generate emails for different services.
I never give my last name to any site unless it’s for billing. And I often don’t give my real first name. I never give my real birthday to any site that isn’t engaged with money or the law. I’ve removed or made ambiguous my profile on almost all social media. I no longer post my face to the internet.
I have used (but am not currently using) a service to request to remove me from online marketing/info sites like spokeo or whatever.
I also use a network-wide advertising blocker on my home network, and while I do have smart devices, they are blocked from internet access, with an upcoming plan to completely put them on an offline and isolated network.
The other thing that I did (accidentally) was to buy a new car that does not share data with advertisers or insurance companies. (Yet/to the best of my knowledge.) I’ve also gone through and audited my old accounts and requested not just account deletions, but data deletions. This is especially important for services that may have health, financial, or purchasing data. When I move, I never file a change of address with USPS. First - I just know what’s important to me and update those addresses. But second, the USPS maintains a database of everyone in the U.S. called the National Change of Address (NCOA) Database, and that is more or less monitored by junk mail advertisers to track where people physically are and to send them junk mail. The only time I get junk mail that’s addressed to me is when my information is shared against my will from financial institutions under this stupid exception.

My next thing that I may wind up doing is seeing if I can start acquiring throwaway phone numbers to forward to my real number, so online services that require a phone number for delivery or whatever cannot use that piece of information consistently or well.

That all does sound like a lot, I guess. But it doesn’t feel like a lot. I just live my life and try not to leak my data.
Most of that (and the issue this article is about) would be moot if the U.S. would just pass consumer privacy protections, but noooo, we can’t have that. Instead they’re going to theatrically whine about other countries and pass laws to help Facebook and bolster U.S. controlled propaganda-outlets while not doing anything to actually solve the problem(s).

[–] DigitalNirvana@lemm.ee 2 points 11 months ago

Thank you, that’s very thorough. And fortunately I’m just a few steps away from that level, so tightening up my act won’t be such a chore.

[–] spencerwi@lemm.ee 2 points 11 months ago (1 children)

Maybe running an OwnTracks server or something?

[–] xombie21@lemmy.dbzer0.com 3 points 11 months ago (1 children)

I run owntracks to my home assistant instance, it works great!

[–] Buelldozer@lemmy.today 1 points 11 months ago (1 children)

What is owntracks useful for?

[–] xombie21@lemmy.dbzer0.com 1 points 11 months ago

It's an open-source alternative to Google maps but by linking it to home assistant it allows my wife to find my last known location if I go MIA, like get into a car crash. I prefer it since I store the location data on my own server and can control who has access to this information.

[–] riskable@programming.dev 4 points 11 months ago

Jokes on them: It's a trivial matter to leave location tracking on and then leave your phone at home, ship it somewhere, tape it under a bus seat, drop it from a bridge on to a barge, etc.