News for hackers. Stuff that matters.
Re:How to stay private when using Android by andrepd on Wednesday January 01, 2020 @09:33AM (#21928155)
Unfortunately all of these things are bandages on a sinking ship. They're technically better than nothing, but in reality they simply do not fix the problem. Even worse, it's possible (even probably) that some privacy controls simply do not do the think they say they do. You are essentially trusting a company with a rubbish track record in privacy violations to pinky swear they stop tracking you when you toggle a switch.
Re:How to stay private when using Android by mirimir on Wednesday January 01, 2020 @05:23PM (#21931158)
Yes, totally inadequate.

The problem, though, is that ~nobody would bother doing what it would take. And so there's the argument that recommending bandages is the most effective strategy.

It would be cool to see this acknowledged. Even if in tiny print somewhere.

Re:How to stay private when using Android by xenospn on Wednesday January 01, 2020 @01:12PM (#21929462)
This is why I have a serious aversion to using any kind of Google Product. They're an advertising company first and foremost - why would anyone expect their products to do anything BUT maximize ad revenue?
Re:How to stay private when using Android by d1zzy on Wednesday January 01, 2020 @02:34PM (#21929985)
But maximizing ad revenue (long term) does also imply not losing user's trust and information.
Re:How to stay private when using Android by xenospn on Wednesday January 01, 2020 @02:42PM (#21930049)
Not necessarily. You can run a very effective misinformation campaign.
Re:How to stay private when using Android by izacus on Wednesday January 01, 2020 @10:47AM (#21928450)
Can you please list a few privacy violations that create the track record? Comparable to e.g. Apple giving Siri voice recordings to 3rd party contractors without the ability to disable it?

I'm sure it'll be easy, easier than downvotes.

Re:How to stay private when using Android by danShumway on Wednesday January 01, 2020 @11:28AM (#21928726)
1. Google tracked user location even when location history was turned off.

2. Most people don't understand the full extent of Web and App Activity permissions -- they don't understand that this will allow Google to do things like parse search queries out of DuckDuckGo searches on Chrome.

3. Similarly (until recently) most people didn't realize that Google was using email info for advertising, including purchases made at competitors. This is the reason why none of your Amazon purchase confirmations list the items you purchased any more. They didn't want Google to be able to read them. Also no way to opt out until enterprise pressure forced Google to eventually promise to stop using the data... for ads.

4. On the subject of Siri, Google's voice assistant was also responsible for giving recordings to 3rd party contractors without the ability to disable it, and most users weren't aware this was happening.

5. Until consumer backlash forced them to stop, Google Maps also aggregated user wifi network names. This would open the door to determine location information based purely on what Wifi networks were stored on your device.

> I'm sure it'll be easy, easier than downvotes.

The reason you're getting downvotes is because this stuff is really easy to research[0], and other commenters don't believe you're engaging in good faith -- they think you're just trying to waste their time by asking them to list out examples that are common knowledge. A downvote is much easier and faster for them.

[0]: https://en.wikipedia.org/wiki/Privacy_concerns_regarding_Goo...

Re:How to stay private when using Android by hydgv on Wednesday January 01, 2020 @02:02PM (#21929798)
>This is the reason why none of your Amazon purchase confirmations list the items you purchased any more

Just checked a recent email from Amazon I received on a Gmail account and that is false.

Re:How to stay private when using Android by danShumway on Wednesday January 01, 2020 @02:21PM (#21929905)
I just checked the emails I received from Amazon from Christmas purchases, and it is not false. I don't doubt you, but I'm curious what the difference is. I'm looking at order confirmation emails and package ship/delivery emails. They only list order numbers for me, and I need to click through to the Amazon account to see the actual items.

Is there a different category of purchase that you're looking at, or is there something I'm missing?

Edit: I am looking online and I'm not seeing any articles that reference Amazon hiding orders specifically to thwart Gmail tracking, so it's very possible I'm wrong and that's just anecdote. But that being said, they definitely aren't showing individual items in my email confirmations. Is there a preference for this that I forgot I toggled?

Re:How to stay private when using Android by grzm on Wednesday January 01, 2020 @02:32PM (#21929973)
In my experience, I’ve noticed that order confirmation includes order details: shipping confirmation not. Took me a while to notice the pattern, and I still find it frustrating.
Re:How to stay private when using Android by hydgv on Wednesday January 01, 2020 @02:26PM (#21929932)
Re:How to stay private when using Android by eezurr on Wednesday January 01, 2020 @03:20PM (#21930317)
Do both of you use gmail?
Re:How to stay private when using Android by danShumway on Wednesday January 01, 2020 @05:07PM (#21931066)
I'm on Fastmail. I looked back at some of my old Gmail emails and they do list items. The Fastmail emails do not. This strikes me as really weird, if anything I would expect it to be the opposite.

Regardless, it's pretty clear that Amazon doesn't universally hide order information, so my assertion that they're doing it to avoid Gmail tracking seems to be pretty objectively wrong. If they were, they would do a better job.

Note that Gmail is still tracking your purchases, that's pretty widely established, and until recently, they were using your purchase history for ads. But I'm definitely wrong about Amazon's response, and I can't track down whatever source gave me that idea.

Re:How to stay private when using Android by lazzlazzlazz on Monday January 06, 2020 @09:42PM (#21976278)
My confirmation emails contain zero product information.
Re:How to stay private when using Android by thawaway1837 on Wednesday January 01, 2020 @11:57AM (#21928926)
I did not know #3. That’s messed up.

Email privacy should be sacrosanct.

Re:How to stay private when using Android by Buge on Wednesday January 01, 2020 @01:44PM (#21929673)
See news articles about it from the time, and a petition telling Google to stop:

https://usatoday30.usatoday.com/tech/news/2004-03-31-google_...

https://web.archive.org/web/20040604175545/https://www.priva...

And a Microsoft ad criticizing Google for it:

https://www.youtube.com/watch?v=9x4_dozWkq0

Re:How to stay private when using Android by lern_too_spel on Wednesday January 01, 2020 @12:45PM (#21929248)
> 1. Google tracked user location even when location history was turned off.

This is disingenuous. If the user uses a Google app that needs location data, of course that location will be sent to Google. This also happens on iOS.

> 3. Similarly (until recently) most people didn't realize that Google was using email info for advertising

That's how Gmail was marketed when it launched. Ads were shown based on the contents of emails. Everybody knew this.

> 5. Until consumer backlash forced them to stop, Google Maps also aggregated user wifi network names

No, Location Services collects WiFi names. Unlike on iOS [1], this is disable-able on Android, and the checkbox to do so is even shown during device setup. If you mean the Street View vans collect WiFi SSIDs, Apple does exactly the same but worse because nobody has any idea if they respect "_nomap" in the SSID (obeyed by both Mozilla and Google), and Apple won't say.

I find Apple to be far more deceptive on privacy. In addition to the location data that, unlike with Android, you cannot stop Apple from collecting, you also have the problem of having to send banking details to Apple to develop apps for your own devices. For an even bigger deception, look at Tim Cook's weasel words in interviews when asked about China's access to iCloud data. He talks about who has the keys for iMessage communications, which has absolutely nothing to do with the problem. [2]

[1] https://news.ycombinator.com/item?id=21725216

[2] https://www.vice.com/en_us/article/43eqpw/tim-cook-insists-c...

Edit for MarioMan: Wifi Services is not the system that collects this data but a user of Location Services. Turning it off won't stop Apple from collecting location data off your device.

Re:How to stay private when using Android by danShumway on Wednesday January 01, 2020 @01:02PM (#21929383)
> that needs location data, of course that location will be sent to Google

It's surprising enough that articles were written about it, and Google had to clarify its privacy policy to explain it.[0] It is not intuitive or natural to a normal user to believe that location data will be stored when they have a permission entitled "location" turned off. That's deceptive on Google's part, plain and simple.

On that note, I don't really care what Apple does, why would bad privacy policies on iPhone make me feel better about Google spying on me?

> That's how Gmail was marketed when it launched. Ads were shown based on the contents of emails. Everybody knew this.

Literally the next comment alongside yours is someone who didn't know this.

> If you mean the Street View vans collect WiFi SSIDs, Apple does exactly the same.

Yes, that's what I mean[1], and, again, who cares whether or not Apple does the same? We're supposed to believe this was totally expected behavior that was entirely fine, which is why Google was forced to respond and change their policies after public backlash.

Why do people do this? Why do people look at public, documented controversies and say, "there wasn't a controversy, everyone was OK with it"? This stuff isn't public knowledge, or else it wouldn't be newsworthy.

I've written about this pattern in the past[2], but I'm not going to rehash it in detail here. The short version is that every privacy accusation is denied vigorously until the story breaks that it's actually real. And then suddenly the conversation shifts and those privacy violations were all public knowledge and the controversy was overblown and nobody smart was ever surprised by them. People are paranoid until it's proven they're not, and then they're accused of over-reacting.

[0]: https://www.theverge.com/2017/11/21/16684818/google-location...

[1]: https://www.theguardian.com/technology/2010/may/15/google-ad...

[2]: https://news.ycombinator.com/item?id=21778234

Re:How to stay private when using Android by lern_too_spel on Wednesday January 01, 2020 @01:08PM (#21929430)
> Google had to clarify its privacy policy to explain it.[0]

Google didn't update any privacy policies in this article. It is about background collection of location data when location services was disabled that has since stopped. Meanwhile, Apple continues to collect your location data in the background with no way to disable it.

> why would bad privacy policies on iPhone make me feel better about Google spying on me?

Because you're saying that Google is uniquely deceptive on privacy when the main competitor is provably worse.

> Google was forced to respond and change their policies after public backlash.

As I showed, Apple still hasn't changed its policies on WiFi collection. Responding to privacy concerns is better than not responding to privacy concerns by any definition.

Re:How to stay private when using Android by danShumway on Wednesday January 01, 2020 @01:14PM (#21929482)
Google isn't uniquely deceptive on privacy. It's just deceptive on privacy. Google isn't uniquely bad on privacy. It's just bad on privacy.

It is possible for multiple companies to be bad at the same things.

Re:How to stay private when using Android by lern_too_spel on Wednesday January 01, 2020 @01:17PM (#21929510)
This I agree with. There are also degrees of deception and badness on privacy, and Apple is by far the worst among the major tech companies, even beyond Facebook, which has not given the Chinese government wholesale access to a subset of its users' data and then lied about it.
Re:How to stay private when using Android by MarioMan on Wednesday January 01, 2020 @01:29PM (#21929586)
If you’re referring to the crowd-sourced collection and contribution of Wi-Fi SSIDs, iOS has the “Wi-Fi Networking” toggle in location services that turns this on or off. If you’re referring to the use of that data, it is one of several components in the locations API that cannot be separated out.
Re:How to stay private when using Android by yrro on Thursday January 02, 2020 @05:37AM (#21934289)
So if I don't want Google telling the world where I live, I can no longer tell Windows users to not upload my WiFi passwords to Microsoft (_optout)... what a world we live in!
Re:How to stay private when using Android by lern_too_spel on Thursday January 02, 2020 @09:49AM (#21935746)
Google and Mozilla. Apple will continue to tell the world where you live.

Microsoft no longer uploads WiFi passwords, but when it did, you could opt out by putting _optout anywhere in the SSID.

Re:How to stay private when using Android by singron on Wednesday January 01, 2020 @10:58AM (#21928527)
For example, turning off "location history" didn't prevent Google from tracking your location history. You had to also disable "web and app activity".
Re:How to stay private when using Android by Terretta on Wednesday January 01, 2020 @11:27AM (#21928718)
More to the point, none of this matters when you’re continuously polling Google’s API endpoints for your email.
Re:How to stay private when using Android by izacus on Wednesday January 01, 2020 @11:48AM (#21928868)
How is that different than Apple iPhones polling iCloud backends for your email? Or visiting websites?
Re:How to stay private when using Android by Terretta on Wednesday January 01, 2020 @12:18PM (#21929044)
I presume this false equivalence is trolling, since only one of the two firms mentioned derives ~90% of its revenue from targeting ads, and the implications should be self-evident.
Re:How to stay private when using Android by d1zzy on Wednesday January 01, 2020 @02:32PM (#21929968)
There are things that aren't as obvious and may seem counterintuitive. Because company A derives 95% of their profits from ads it puts pressure on product design to not endanger that and also branch out in other areas. It would be extremely risky for such a business to have a cavalier attitude to how they manage user's trust and the information that the ads depend on because, like you said, they depend on that ad income. That is why, if you have to give your private information and the choice is between a company that depends on (safeguarding) it (like Google) vs a company that doesn't care (like mom&pop store), I would be very afraid of the latter's management of your private information, the security of their systems, etc.

If you have a choice to not give your private information (or limit what you give) to anyone then that's obviously better.

Re:How to stay private when using Android by izacus on Wednesday January 01, 2020 @05:01PM (#21931038)
> I presume this false equivalence is trolling, since only one of the two firms mentioned derives ~90% of its revenue from targeting ads, and the implications should be self-evident.

No, it's not trolling and nothing about what you wrote is self-evident. Especially when you take into account that one company is the world leader in datacenter security practices and the other is struggling with quality service development.

Re:How to stay private when using Android by asdkhadsj on Wednesday January 01, 2020 @12:13PM (#21929012)
Depends on what criteria you care about. In the example of polling, and the data that can leak from said polling, it's only different in the sense that we _know_ Google is evil in this equation.

So if this is a concern of yours you should definitely not use Google, and you should probably not use Apple.

Re:How to stay private when using Android by izacus on Wednesday January 01, 2020 @05:03PM (#21931046)
What the heck does "we _know_ Google is evil" actually mean?

This isn't a Marvell movie, how does doing the same thing by two different corporations make a difference beyond you buying into brand marketing?

Re:How to stay private when using Android by asdkhadsj on Thursday January 02, 2020 @09:49AM (#21935742)
Simply a meme about exploiting your user data as extremely as Google can. Ie, I am their sole business model on the advertising front.

A good example is many of the things outlined in this post. People _trying_ to use Android privately, but after an update Google switches all of their privacy settings back to giving Google everything - and it syncs all old stuff to boot.

That behavior is what I consider actively combatant towards the consumer. It's like how Comcast just keeps finding ways to make incremental fees, "accidentally" charge people, etc.

These are under what I consider "evil" for corporations.

Re:How to stay private when using Android by chiefalchemist on Wednesday January 01, 2020 @02:39PM (#21930014)
Not being troll-y but...A simple search of NH will give you plenty of examples. It seems that at least twice p/month some Google snafu related to privacy or other dark patterns bubbles to the top.

There's a reason they stopped using "don't be evil."

Re:How to stay private when using Android by pinepinetree on Wednesday January 01, 2020 @10:05AM (#21928272)
Exactly. Scottiestech's YouTube has some good info on how your smartphone is tracking you more than you think. Sometimes I think about building my own phone with a Raspberry Pi or use LineageOS.
Re:How to stay private when using Android by endemic on Wednesday January 01, 2020 @10:44AM (#21928434)
AFAIK one of the best solutions for smartphone privacy is using a custom Android ROM without Google apps installed. Of course that means basically no 3rd party apps, but you can still get a surprising amount of functionality with just a web browser. You’ll still get tracked by your mobile provider, but I think that would happen even with a dumbphone.
Re:How to stay private when using Android by icefog on Wednesday January 01, 2020 @01:39PM (#21929644)
> Of course that means basically no 3rd party apps

I'm using LineageOS without Play Store/Services and would like to dispel this myth. Here are just some of the third party applications I can install directly from the developer using adb, without going through a third party store: Signal, Firefox, NetGuard, NewPipe, Orgzly, OsmAnd, Tor Browser. Those pretty much cover all of my smartphone needs and more.

Re:How to stay private when using Android by im3w1l on Wednesday January 01, 2020 @05:21PM (#21931139)
Three kinds of apps that are very important to me, that I cannot get without play store:

The national 2fa app. The app people use to send money to their friends, sometimes street vendors. Rideshare app.

Re:How to stay private when using Android by andrepd on Wednesday January 01, 2020 @12:53PM (#21929315)
You can use microg. It's a Free reimplementation of google play framework, so that apps which depend on it can still function in a de-googled phone. It's imperfect, I admit it, and breaks some apps, but it's still a massive help.
Re:How to stay private when using Android by qaute on Wednesday January 01, 2020 @01:26PM (#21929573)
I'll second (third?) LineageOS + microG! Full ROMs combining both are available [1] (OS updates often seem to have to be installed manually, but are supported on popular phones for years). In addition to using everything from the F-Droid repository, I can run Slack/Discord/Messenger/WhatsApp/GroupMe (though notifications are hit-or-miss) and a good few other apps (Duolingo, bank mobile apps, Uber but not Lyft). Many of these apps can be installed via Yalp Store [2], which is a frontend for the Google Play store with a built-in account to provide some anonymity. It'll do until I get a Librem5 [3].

TL;DR: no Google, most things work, but not necessarily smoothly. I've used it for a few years now.

[1] https://lineage.microg.org/ [2] https://f-droid.org/en/packages/com.github.yeriomin.yalpstor... [3] https://puri.sm/products/librem-5/

Re:How to stay private when using Android by arminiusreturns on Wednesday January 01, 2020 @01:32PM (#21929601)
F-Droid is a pretty cool foss app "store" as an alternative to the playstore.
Re:How to stay private when using Android by huntermeyer on Wednesday January 01, 2020 @02:35PM (#21929989)
What do you mean by, "no 3rd party apps"?

You can use F-Droid (https://f-droid.org/) in place of the Play Store.

Re:How to stay private when using Android by stjohnswarts on Wednesday January 01, 2020 @11:12AM (#21928618)
You shouldn't have to find a half dozen toggles somewhere. there should be a master toggle somewhere that turns that crap off. Location, sync, listening, all that stuff. They could provide that if they were serious about privacy, but they don't
Re:How to stay private when using Android by yjftsjthsd-h on Wednesday January 01, 2020 @11:06AM (#21928577)
Certainly if you want to build your own Pi phone don't let anyone stop you, but if you want something very much like that but prefabricated, the pinephone is a good option.
Re:How to stay private when using Android by andrepd on Wednesday January 01, 2020 @12:47PM (#21929263)
I do use LineageOS+microg without play store installed, to avoid any Google software on my phone (yet still being able to use some apps which depend on the google framework)
Re:How to stay private when using Android by art4ur on Wednesday January 01, 2020 @01:08PM (#21929428)
I've been doing this for about a year and half now. Not only does my phone's battery last longer without Play store but I'm missing very few features.