Great stuff. However, while I'm happy that they're limiting third-party access to this data, given Google's business model, I still wouldn't trust them with it.

You're right Google no longer has the trust it used to enjoy. So many apps have been uploading entire call logs and it's really absurd this was so easiy accessible to all apps.

It's the only reason stopping me from getting an Android phone. I think Apple is better on privacy.

Haha, but in Apple case, you can't even see the code, dude.

You realize the entirety of Google Play Services is closed source, right?

Woops... well, but at least Android core is not, which is better than "everything close" (Apple).

How would that be better? If there is any code that they don't want to see, they would just not show you.

Android and ios are both completely opaque operating systems... stop pretending they are not.

You would be surprised how little of your Android phone is actually open-source code.

At least is better than 100% closed (Apple).

You can't even see the code for most Android OEM phones either.

I'm choosing the lesser of two evils here, glad you downvoted me.

Android may have always been available at no cost, but it was never free. Always assume if you are given a service gratis, that _you_ are the product being sold. This doesn't just apply to Android, but to gmail, Drive, Docs, etc.

I think that's a good general assumption. But in the case of Android, I think of it (and Chrome) more as a defensive move. Google's business depends on having access to users. A free browser and a free mobile OS are a loss leader so that nobody can cut off their major revenue streams.

Not that we shouldn't keep an eye on them, of course. The great bulk of their revenue comes from advertising, which is all about selling users to advertisers. But I don't think Android makes the picture any worse.

Google location services makes the picture much worse though, which the majority of Android users (in the US at least) have enabled.

Yes, it feels really spooky getting notifications to review the supermarket, coffee shop or anything else close to our surroundings.

The spookiness is even greater for those of us that know what it means to live under repressive regimes.

Google maps stalking is indeed bad and I hate it but you can easily disable it by not running Maps in the background.

Honestly Android allows me to tune out of the internet business model a lot easier than iOS. Just dive into permissions and install a system wide adblocker. You can even bypass the app store.

I always have location off but my old coworker used to leave hers on. One day after work we were waiting for the bus she took a picture of some grafitti near the bus stop. A minute later she got a notification from google asking if they could, I can't remember if it was, tag the picture or add the picture on google maps or both for the gas station next to the bus stop. It was fairly creepy, i'd never seen one of those before. She started turning her location off after that.

I must say, now that Google is buying people's credit card purchase history from third party data brokers, their behavior is much more creepy than just tracking your location.

>Google has been able to track your location using Google Maps for a long time. Since 2014, it has used that information to provide advertisers with information on how often people visit their stores. But store visits aren’t purchases, so, as Google said in a blog post on its new service for marketers, it has partnered with “third parties” that give them access to 70 percent of all credit and debit card purchases.

https://www.technologyreview.com/s/607938/google-now-tracks-...

A product only useful at the Billion User data points level. I am 100% fine participating in what's essentially the training data for all future AI products coming out of Google. It feels like a happy family of devices all working together for a more scientific future.

In history, people allowing one entity to accumulate a lot of power on the basis that they will remain benevolent have almost always be wrong.

Don't assume people at the top have an agenda that are compatible with yours.

The fact we are enjoying a lot of peace and freedom right now should now be a signal for us to relax : democracy is a system that needs maintenance, not some legacy you can claim ad vitam.

It's our duty as a citizen to always doubt the intentions of those in power. Just like it's a flight intendent duty to check that the planes doors safety are engaged again and again. It's not a moral issue. It's just a technical requirement.

There is no democracy, just the appearance of one. As an adult, I think it's everyone's responsibility to start and understand this sooner or later.

Well yes, I do believe we are in an oligarchy and not a democracy. But it's a different point, and would strike a debate that would not help with the main argument of my comment. So I just use the word "democracy" where most people expect it, otherwise, it gets complicated.

>It feels like a happy family of devices all working together for a more scientific future.

With this philosophy, I’d suggest you’d avoid paying attention to the trajectory of Chinese society, perhaps even more so now that Google plans to get in bed with the CCP’s censorship and dissident quashing regime...

I believe they claim they aren't really doing that. It could be the great negative attention forced them to say that wasn't their actual plan.

They said the same thing about their participation in the drone program, until an internal revolt forced them to reveal their true hand (they were actually doing it and hoping to do more of it), and subsequent internal backlash put a stop to it altogether.

https://jacobinmag.com/2018/06/google-project-maven-military...

I too hope that Googlers block what their execs are planning to do in China, but we're not there yet, and it should give one pause that their leadership are onboard with doing this in the first place.

Google didn't try to hide that they were working with the Pentagon to better identify targets. Their participation was well known and in the open.

No it wasn't. They specifically tried to misrepresent what the project was, minimize the scope of their involvement with it, as well as Google's plans to expand it further.

From the article I linked, which is an interview with a Googler who helped lead the resistance-

Interviewee:

...

They also tried to downplay the scope and involvement of the project. But that rhetoric dissolved when we found out that leadership had been lying.

Interviewer:

What were they lying about?

Interviewee:

From the beginning, they told us that Project Maven was a small contract purely for non-offensive purposes. They said that we weren’t building anything custom. They said that this was a one-off project only worth $9 million, and that it wasn’t part of any further collaboration with the Pentagon.

Those all turned out to be lies. On April 12, DefenseOne published an article that landed like a bombshell in the company. Drawing on conversations with Pentagon officials, it revealed that Project Maven was actually a pilot project for future collaborations between Google and the military. In particular, Project Maven was part of Google’s push to win the Joint Enterprise Defense Infrastructure (JEDI) contract.

JEDI is the military’s next-generation cloud that will network American forces all over the world and integrate them with AI. It’s basically Skynet. And all the big cloud providers want to win the contract because it’s worth $10 billion.

When we found out that Project Maven was an audition for JEDI, people started becoming extremely concerned. And as the media attention to the story increased, we learned a lot more. For instance, Diane Greene had told us that the Project Maven contract was only for $9 million, but internally they expected it to increase to $250 million per year. And they weren’t just giving the Pentagon access to open-source software — they were going to build a massive surveillance system that gave military analysts real-time information on people, vehicles, and buildings in a Google Earth–style interface.

Exposing all of those lies damaged leadership on this issue just as much as anything else that we did. That loss of trust really hurt them.

Free (Libre) Software is very often gratis as well, and generally breaks the "if you're not the customer..." rule. In the case of Android, there are community-maintained forks that do not include any of the Google stuff.

It might be true that libre software can break that rule. AOSP isn't libre, and the libre forks are so hobbled by limited access to Apps and the Play Store that there IS a cost to using them: the cost of losing very useful features that are only available in AOSP.

I think Dropbox, with its free tier, is a counter-example. The storage offered is advertisement itself.

That being said - for the end user Android isn't free. It's a part of a device sale that they're paying for.

There's a difference between the product made by a manufacturer, and the OS distributed by Google (their "service"). If we are talking about Google's incentives, than we have to look at their relationship with Android as a product. They are giving away Android to manufacturers for free. It's _Google_ that has the incentive to sell the users' data. That we purchase devices preloaded with Android doesn't pass that sale off to Google (like it would to Microsoft with a Windows computer), so it doesn't take away their incentive. So for the purposes of determining at what social cost you use Android, it might as well be gratis.

Note that 'their "service"' includes the Play Store, which is a not insignificant revenue generator for Google.

guess the same must be true for Linux, gIMP, emacs, vim, gcc, clang, LibreOffice.

There is a cost to using FOSS, though it's much less sinister than that of using Android or Google Apps. You are giving up convenience in exchange for software that respects you. In terms of the user becoming the product, I suppose that would be harder to argue. Maybe one could say the users become co-opted to promoting the cause/agenda of FOSS.

Could you cite some popular apps that do this? This is news to me.

Facebook is a popular app.

Wow, it uploads your call logs? I had no idea. I thought it was only ("only"...) contacts.

And if you have Whatsapp installed on the same phone, it possibly gets all the data that you have given Whatsapp. Ditto for Instagram.

Don't trust Facebook or anything they own.

Ironically, there's probably no organization on the planet that you should trust more with your personal information than Google. No organization takes privacy and security more seriously and spends more money and time getting it right. (Yes, that includes well-funded intelligence agencies like the NSA and your closest friends and family.) The idea that Google is going to turn around and start selling your information to third parties is just dumb.

> Ironically, there's probably no organization on the planet that you should trust more with your personal information than Google

Thank you for the suggestion. We likely have different ideals about what a healthy version of the future looks like.

> ...selling your information to third parties...

Not what I said. Google’s business model is to extract and store as much information about consumers as possible, enrich and correlate it, and then financially exploit it. Currently the best way they’ve found to do that is targeted advertising.

By doing so, they make this extremely revealing data available to every government in every jurisdiction in which they operate, which is pretty much all of them. They work to normalize this surveillance as inevitable and unstoppable.

Additionally, while it would currently run counter to their business model to sell raw data, there’s nothing to legally stop them, if that business model should change.

Just like Facebook, Google are now very close to market saturation. To keep growth up, they’ll need to increase revenue per user. How will they do that? We don’t know. But there’s a relatively high chance that I’ll like it even less than what they’re doing now.

> ... dumb

:)

> The idea that Google is going to turn around and start selling your information to third parties is just dumb.

Google's business _is_ selling my information to third parties. Don't Apple have a better track record, and a more privacy oriented business model here?

> Google's business _is_ selling my information to third parties.

No, Google's business is using your information as a tool to build products it sells to third parties. Actually selling your information, as such, would undermine that business.

Google business is no more about selling your information to other people than a ferryman’s business is selling his boat.

Your privacy against non-Google actors is Google's moat. They have every interest in protecting it.

> No, Google's business is using your information as a tool to build products it sells to third parties.

Really? If we're going to be that pedantic, then it's probably more like " Google's business is using your information to build products it sells to third parties." They're not using my information as a tool, they're using my information (location, interests, browsing habits, searches) to sell a product (advertising). At that stage, they _are_ selling my data.

This is the top comment I came here for. I really hope there is a way to turn off all the "machine learning stuff" because I would rather not sacrifice any of my personal data so that Google can better predict how to "optimize my phone experience". My human brain learns the random quirks of an OS in a matter of days, I don't need the OS brain trying to learn how I use it, as it would be confusing for both of us.

I just wish there was a global "NO NO and NO!" override button for any kind of "help make your service better by using your personal information" feature. Just recently, I discovered that www.google.com was also accessing my Chrome browser's location, and I can not recall when I said "yes" to any such location prompt. It's a bit sad -- I think of these features as being intentionally obfuscated similarly to how Facebook intentionally obfuscates their "account deletion" mechanism.

I'm afraid the majority of people just don't care about these needlessly nosy "smart" systems, and I'm probably going to suffer from it as someone in the privacy-niche.

> I discovered that www.google.com was also accessing my Chrome browser's location, and I can not recall when I said "yes" to any such location prompt

This is the worst when traveling through Europe. Cross a border and suddenly all Google services are in a language you don't speak.

I really hate that and I do speak quite a few.

It is not only the UI language that changes, the search results do as well.

Suddenly something that was easy to find becomes a mess of local results with similar names or machine translated, even though I used the original language name.

Note that this is often done based on your IP address if you've not opted-in.

It's often a quirk when using CCC (Chaos Computer Club) IP addresses at events in other countries; you'll be looking at google.de for the first couple of days until google correlates enough location data from people that have opted-in to correct the IP location.

On the plus side it means that a personal VPN with no opted-in devices will give you your home-region services (ymmv).

Google likes to ignore the Accept-Language header. Obviously they know better than you and your browser what language they should use!

The top comment is describing the positive advances in privacy. I think you jumped the gun -- may be worth a second look.

And I'm adding the NB: While they have better app-level restrictions, the real question is whether or not Google uses this information for their new ML-powered OS features.

The "privacy" and "security" features also mean a less powerful computer. Which is probably the right trade-off for most users but a pain in the ass for more niche use cases.

Most of that data is still available, just gated behind permissions that require explicit consent from user now.

Does the permission model even work at this point? The vast majority of users just accept whatever the app asks for without a second thought. The rest is bullied by platform monopolies.

There is very little real choice for users.

There may be few real alternatives. But this is a choice: You're getting the information, you're making a choice to use all features, use limited features, or just drop the app.

And you have explicit control and granular control, even if 99% of the people won't ever use it. Before, if you didn't want Facebook accessing your Microphone, the only option was to not use the app at all. Now, I can specifically disable that option.

Facebook may just make the app not run unless you give it mic permission. Of course you don't have to run it. I have seen apps that explicitly refuse to run unless you give them the permissions they want on iOS even though they shouldn't need them for 99% of their functionality.

Wouldn't such a behaviour be against GDPR? Probably not because of technicalities, but then I would hope the EU to make yet another piece of legislation to address this.

That's where Google/Apple should step in and ban those apps from the store.

Of course it works, why wouldn't it? If you want a crippled device that never lets anything access to data, you can always buy a dumbphone.

I hope that the permissions are better to understand and control than the current ones. Right now they seem to be designed to give the appearance of giving users control but the implementation is pretty bad and user unfriendly.

And the other problem is you install an app all the time and the permissions aren't clearly laid out. I want:

1. tell me I install an app that wants "some list of permissions".

2. let me disable this permission for all apps installed now and in the future.

1) it is not really realistic in practice:

- Permissions are requested incrementally at runtime. For large apps, a LOT of these permissions depend on corner cases BUT you still declare all the permissions you might ask for.

So maybe I will declare that I might ask to see the content of your screen .. because there is an help menu where I take a video of your screen to send to support after asking you for the permission.

Same for camera .. we might use Google Pay for most cases, but in one of the countries where we have the app, a local player has a very popular solution that scans your credit card. So we declare that we might need Camera because of this sdk.

Etc.

This is one of the reasons why the previous model where you asked the permissions at install time did not work very well in practice.

Anything targeting API level 23 has all permissions denied by default (and targeting higher level is mandatory for all new apps right now).

I would also like to give permissions only for a limited time and see a log how the permissions are being used in detail.

They don't limit the power of the computer, only who can access that power. It's not hard to grant an app full access if you trust it - but the "trusted by default" model is hopelessly outdated now that the vast majority of software is sourced from anonymous internet 3rd parties rather than a few well known software vendors.

These are awesome. Android is slowly catching up with iOS in this regard.

They are both slowly catching up to Java ME[1] where all of this worked perfectly well, except for the silly decision to disable the "always allow" option for non-trusted apps.

If they had just let the users (rather than Verisign) decide for themselves which apps they trusted, so that every app wouldn't have to pop up i confirmation dialog every time it wanted a network connection, I would be much happier with what we had then than with Android's model.

[1] https://www.wosign.com/support/resources/MIDP_2_0_Tutorial_O...

And Symbian. :)

> Limited access to sensors in background

I'm amazed this took so long. There have been papers coming out for years demonstrating how to extract all kinds of sensitive information from the vibration sensor.