News for hackers. Stuff that matters.
Re:Do you really want Linux phones by rlayton2 on Wednesday March 24, 2021 @10:40PM (#26575955)
Yes, this is the point. For example, I want a phone where I can send faked GPS data to apps that request GPS permissions (and so on).
Re:Do you really want Linux phones by rjzzleep on Thursday March 25, 2021 @12:27AM (#26576597)
Android had plenty tools in the past to allow that. Xprivacy even used to allow you to select which Contacts you want to allow for which app. So you could use WhatsApp but only allow a handful of contacts to be read.

One of the frustrations people have with Google is that they're making it increasingly closed and problematic to make modifications. Given that nowadays some banks for example are mobile only and everyone is waiting for Google to completely shut down modified boot systems(probably in response to Qualcomm TrustZone being untrustworthy), people are re evaluating whether it makes sense to invest in the Android ecosystem.

EDIT: google could have capitalized on this and made it a part of their offering.

Re:Do you really want Linux phones by inquirerGeneral on Thursday March 25, 2021 @09:41AM (#26580138)
That's because you're trying to use apps that use the services of Google. Pixel phones are still the best to use to wipe and put other operating systems on
Re:Do you really want Linux phones by heavyset_go on Thursday March 25, 2021 @01:50PM (#26583264)
Apps can detect when you're mocking GPS on Android.
Re:Do you really want Linux phones by a0-prw on Thursday March 25, 2021 @04:03AM (#26577502)
On Android phones, if you enable "developer" in settings, the app "fake GPS settings" can do that.

Caveat: It's been almost 4 or 5 years since I used it. I used to prank colleagues on Facebook by posting from a local prison or other weird places. Have had no use for it since I deleted my fb account. So I don't know if it can still do what you want.

Re:Do you really want Linux phones by matkoniecz on Thursday March 25, 2021 @06:04AM (#26578273)
You are unable to do it for specific apps, it is a global setting.
Re:Do you really want Linux phones by eqvinox on Thursday March 25, 2021 @06:53AM (#26578606)
Also I think the apps can check for this. It's also been several years for me but I remember using an external Bluetooth GPS receiver needed this setting to allow an app to read the BT data and feed it into Android & some Apps just refused to work.
Re:Do you really want Linux phones by fn1 on Thursday March 25, 2021 @02:39AM (#26577145)
That is because of Androids stupid permissions-system where you have to give all requested permissions to an app before being able to install it.

On iOS the app installs and works and THEN it might ask you for GPS permission and you can deny that and the app keeps working, just without the feature that needs GPS.

I just installed Mi Home, a chinese app which requested every permission there is. I just denied all of them, could still use the app and am 0 afraid that the app somehow accessed my data.

Re:Do you really want Linux phones by yarcob on Thursday March 25, 2021 @02:56AM (#26577204)
> you can deny that and the app keeps working, just without the feature that needs GPS

A phone that would truly value the user would allow the user to provide a fake GPS location. Then you could use features that need GPS and not give up your privacy. But Apple doesn't allow that since it would make the phone less useful for companies who want to use phones for tracking.

A phone that truly valued the user would allow users to install multiple copies of an app, and allow the user to log in with different accounts. But Apple doesn't allow that, because they don't want people to share devices.

Re:Do you really want Linux phones by cletus on Thursday March 25, 2021 @04:19AM (#26577597)
Yeah, your GPS example doesn’t hold up. How is denying an app location info consistent with your position that Apple wanting to enable companies to track users?

So you, I suspect, don’t want to “avoid tracking” so much as you want to avoid geo-gating of apps and content.

Content distributors rely on such features to satisfy legal obligations about what content they can show where. If the OS started adding features like “pretend I’m in location X” or “download movie regardless of app restrictions” (as an example of another feature that could be argued is pro-user) then at some point you’ll have a platform that isn’t commercially supported or viable.

Honestly, Apple is by far the most pro-user company in this field and there are countless examples of this.

But a very small minority chafe against the restrictions that are actually in most users interests (eg not allowing side loading of apps, which for most people would simply be an attack vector).

Re:Do you really want Linux phones by yarcob on Thursday March 25, 2021 @07:44AM (#26579016)
> Yeah, your GPS example doesn’t hold up. How is denying an app location info consistent with your position that Apple wanting to enable companies to track users?

Many apps require location data for access to features. If you can't provide a fake location, your only choice is to either accept tracking, or not use the service.

Lots of companies use phone apps for tracking (eg. for tracking location of agents). The company will immediately realise when you turn off GPS access. If you had a way to spoof a location (eg. tell the phone to pretend you stayed in the current location), you could go to the toilet without your employers knowledge and without leaving your phone behind.

Abusers often use phone apps to track their victims. If you are in an abusive relationship, you may be too scared to turn off Find My Friends. If the phone was actually on your side, you would be able to enter a fake location, and your abuser wouldn't have to know that you visited your parents on your way home from work.

Apple wants location data from iOS users to be hard to fake, because it is more valuable this way. Apple's most important asset is the value of their ecosystem. It's why they can charge companies 30% to access it. The user's needs are secondary.

Re:Do you really want Linux phones by Grimm1 on Thursday March 25, 2021 @08:17AM (#26579295)
Yeah, I don't buy it, frankly these all seems like minority use cases. I imagine if you were to poll all i-phone owners this would all be bottom of the list in terms of wants. I think a lot of people here conflate "What I as a tech and privacy enthusiast want" and "What everyone wants" very often. The feature you suggest would be used by a very small percentage.

That's not to say I wouldn't want it either but I'm pretty privacy conscious, and a tech enthusiast. I just don't think you can say Apple is putting user's needs second, I don't imagine most users need this.

Re:Do you really want Linux phones by zepto on Thursday March 25, 2021 @11:36AM (#26581567)
> Abusers often use phone apps to track their victims. If you are in an abusive relationship, you may be too scared to turn off Find My Friends. If the phone was actually on your side, you would be able to enter a fake location, and your abuser wouldn't have to know that you visited your parents on your way home from work.

This exact same feature you are asking for would be useful for people abducting children, who could make it look like the child was still at school while they took them away.

This is far more likely to be why Apple hasn’t implemented it.

Re:Do you really want Linux phones by cletus on Thursday March 25, 2021 @11:15AM (#26581285)
Yeah I’m going to need examples of what features get locked by not providing location. I’m just not buying this is anything other than wanting to avoid geo restrictions on content. I mean I understand the desire for this but I also understand the desire not to pay for content, so this is a thin one when it comes to “freedom”.

Oh and as for tracking, at least for the company they can already track you by what towers you’re connected to. So there’s no technical limitation on this being provided to apps regardless of what you might spoof.

Re:Do you really want Linux phones by yarcob on Thursday March 25, 2021 @01:48PM (#26583243)
> Yeah I’m going to need examples of what features get locked by not providing location.

Strava refuses to let you track your ride if you don't allow always-on background tracking. (They changed this about a year ago. Previously "while using the app" was sufficient)

A lunch menu app that I used before Covid allowed you to show nearby restaurants based on location. But there was no way to manually enter a location (without GPS it was just a huge unsorted list).

These are two examples that come to my mind (I'm not a person who uses a lot of different apps, I'm sure there's more out there. Try rejecting location access for a few apps and see what happens)

Edit: I'm also not sure why you are so hung up on geo restrictions. I don't really care about geo restrictions, and even if, you could avoid them trivially with VPNs that are widely available. That just has nothing to do with keeping my GPS coordinates private.

Re:Do you really want Linux phones by zepto on Thursday March 25, 2021 @11:28AM (#26581449)
> since it would make the phone less useful for companies who want to use phones for tracking.

Are you an Apple employer with access to confidential memos or meetings?

I can’t see how you would know this otherwise.

Re:Do you really want Linux phones by dreamer7 on Thursday March 25, 2021 @02:50AM (#26577187)
Just to clarify, Android has had the ability to request permissions ad hoc in the user journey since Android 6.0.

But it is true that Android won't reject apps that refuse to work without a permission while iOS mandates that basic functionalities of an app work even when permission is denied.

Re:Do you really want Linux phones by ip34162 on Thursday March 25, 2021 @06:39AM (#26578511)
Android does that too. The elephant in the room is denying internet permission. Nobody implements it because it'll hurt their bottom line.
Re:Do you really want Linux phones by newphonnewaccnt on Thursday March 25, 2021 @07:45AM (#26579025)
This is why apps like netguard are a must. Is there an equivalent for iOS?
Re:Do you really want Linux phones by aembleton on Thursday March 25, 2021 @06:38PM (#26586502)
I like how Miui (Xiaomi skin on Android) allows you to do this.
Re:Do you really want Linux phones by EvilEy3 on Thursday March 25, 2021 @04:38AM (#26577724)
2015 called, said Marshmallow was released.
Re:Do you really want Linux phones by maccard on Thursday March 25, 2021 @09:24AM (#26579942)
And meanwhile, 6 years later an app can be submitted to the play store that ignores that and just blanket asks for permissions and refuses to run without them.
Re:Do you really want Linux phones by inquirerGeneral on Thursday March 25, 2021 @11:23PM (#26588453)
"But given its importance and that i0S 14 already has a similar feature, it's more likely to ship than not. What could make Google's implementation better than Apple's is how easy it is to access more information requires you to head to the settings to see exactly what's going"

https://www.androidpolice.com/2021/03/22/android-12-isnt-sim...

Re:Do you really want Linux phones by hellisothers on Wednesday March 24, 2021 @11:24PM (#26576256)
As a developer I don’t want people sending my app spoofed data.
Re:Do you really want Linux phones by andolanra on Wednesday March 24, 2021 @11:38PM (#26576340)
Well then, you should make sure that you're providing a useful service with that data, or allow data collection to be turned off.

Think of it like this: if I'm actively using an app that's giving me turn-by-turn directions, then of course I'm not going to want to spoof GPS, since it would make the app useless to me. But if your app demands GPS data just for ad analytics, then yes, I would absolutely and without any remorse spoof GPS data for that app. In that latter case, I don't care that a developer might be unhappy with it, because as a user I'm unhappy that the developer is slurping up data they don't need!

Re:Do you really want Linux phones by duxup on Thursday March 25, 2021 @01:34AM (#26576882)
What about games like say Pokemon Go where accurate location data is part of the game and spoofing is a problem that can impact other user's?
Re:Do you really want Linux phones by vincnetas on Thursday March 25, 2021 @01:43AM (#26576914)
Good question. I still think that its up to user to decide what data he shares with app. If its crucial for app to know that gps position is not faked, app could do some heuristic. Check if user is not moving faster than some limit, does not stop moving for extended periods of time etc. Basically anticheat engine. Only area where this whould be relevant i think is online multiplayer games. Otherwise, if user is faking gps he is messing up his own experience.
Re:Do you really want Linux phones by mavhc on Thursday March 25, 2021 @04:01AM (#26577482)
2 different permissions: Possible faked GPS data, and Not faked GPS data. An app would really need to explain why it can't accept possibly faked GPS data.

https://developer.android.com/guide/topics/sensors/gnss on android now apps can access the raw gps data, which is much harder to fake

Re:Do you really want Linux phones by duxup on Thursday March 25, 2021 @10:43AM (#26580890)
I like that idea, although to me that is kinda the status quo and I'm not sure the folks who want to be able to fake anything at will would be ok with that.
Re:Do you really want Linux phones by duxup on Thursday March 25, 2021 @02:14AM (#26577041)
>Only area where this whould be relevant i think is online multiplayer games.

That's the issue with augmented reality games like Pokemon Go.

Re:Do you really want Linux phones by chii on Thursday March 25, 2021 @02:41AM (#26577159)
i argue it's not an issue. If the user decides to spoof to cheat in the game, there are other ways to detect it (such as speed limiting - which, as i understand, pokemon go already does).

If the app wants to force a user to not modify their phone just so they have a secure enclave for which they can implement DRM, then i can't agree to it. This includes things like spoofing, but also things like memory edits or hacking save files, or anything else client side. If the app needs secure storage that's unchangeable, they can save it on their servers.

Re:Do you really want Linux phones by duxup on Thursday March 25, 2021 @08:34AM (#26579430)
Spoofing is an issue even if you limit yourself to a reasonable speed. You don't have to spoof yourself everywhere all at once.
Re:Do you really want Linux phones by happymellon on Thursday March 25, 2021 @01:49AM (#26576934)
I don't play Pokémon go, but with my understanding of the game I'm not sure how spoofing the GPS would impact other users in a negative way.

Considering that most of the world has some form of travel restrictions over the past year, and I believe that being able to interact with friends in the game requires you be be in very close proximity. Can you explain how spoofing GPS data so that people are allowed to play together even though they are not close is bad?

Re:Do you really want Linux phones by kingaillas on Thursday March 25, 2021 @10:23AM (#26580649)
>I'm not sure how spoofing the GPS would impact other users in a negative way.

You could attack a pokemon gym at your convenience (from your couch, whatever time of the day). This negatively impacts other players because a legit, non-cheating spoofer will have to expend far more effort to do the same thing.

>Can you explain how spoofing GPS data so that people are allowed to play together even though they are not close is bad?

Friend interaction or just interaction in the game has to do with raiding and trading. You can already league battle (pvp) over any distance.

Niantic has made some changes along these lines - main one is the remote raid pass. One person close enough to a gym can invite friends to raid, no spoofing needed. They also upped the trade distance, how close you need to be to interact with a gym/pokestop, etc.

So the answer to your question is the game itself has made changes to address actual in-game scenarios. That leaves spoofing GPS as a way to asymmetrically cheat against gyms, or perhaps trivialize collecting pokemon (some are region locked and so on).

Re:Do you really want Linux phones by duxup on Thursday March 25, 2021 @02:13AM (#26577035)
In games like Pokemon Go (and similar augmented reality games) players go to real world locations in order to gather resources, and battle the pokemon of another user who currently holds that position.

If you can just spoof, the whole nature of augmented reality falls apart and someone could simply spoof themselves anywhere and take those positions. It was a big problem before the android os made it harder to spoof.

There's no point/ fun in playing augmented reality games if enough people simply cheat and the real world limitations aren't a factor.

Re:Do you really want Linux phones by afiori on Thursday March 25, 2021 @02:32AM (#26577116)
I played pokemon go seriously for a few years (both at the beginning and recently) and honestly spoofers are an issue only because imho Niantic is incompetent and doesn't care.[1]

not to say how it you are anywhere not in a medium size city you need either spoofers or endless grind to unlock significant parts of the game

[1] to be fair I left before the pandemic, so I cannot comment on how they handled that

Re:Do you really want Linux phones by duxup on Thursday March 25, 2021 @09:27AM (#26579962)
I think spoofing early on was an issue because it was so easy.

It really stopped being a large scale issue after Android started making it harder to spoof.

Re:Do you really want Linux phones by matheusmoreira on Wednesday March 24, 2021 @11:40PM (#26576354)
As a user I don't really care about what you want or need. You're not supposed to get any data at all unless it's strictly necessary. You're also supposed to delete any data that you do get after you're done using it in a way that benefits me and me alone.
Re:Do you really want Linux phones by jjav on Thursday March 25, 2021 @03:22AM (#26577325)
I'm a developer too, but no, sorry, the user comes first. They're paying the bills and your salary.

If your app needs to get info that benefits the user (as the mapping app GPS example), nobody will deny it because it makes sense.

If your app wants to get info that benefits you but not the user, it only makes sense for that data to be denied (preferably) or faked (as a backup plan). You have no right to it.

Re:Do you really want Linux phones by jcelerier on Thursday March 25, 2021 @05:05AM (#26577875)
> They're paying the bills and your salary

That's the whole issue - it's not the case anymorez now it's the ads that pay

Re:Do you really want Linux phones by abraae on Wednesday March 24, 2021 @11:34PM (#26576305)
As a user I want a way to bypass your overly intrusive data collection on me.
Re:Do you really want Linux phones by belval on Wednesday March 24, 2021 @11:35PM (#26576318)
I am the one paying for the phone so I should get to pick what information it will tell you.
Re:Do you really want Linux phones by hulahoof on Wednesday March 24, 2021 @11:35PM (#26576313)
Agreed, but as a user I do want this option and so the parent post point stands - the device should be on the owners side, not the app developers.
Re:Do you really want Linux phones by rnotaro on Wednesday March 24, 2021 @11:36PM (#26576325)
As a user you're not entitled to the GPS Data of my phone and i'm allowed to send any data that I want to.
Re:Do you really want Linux phones by polishdude20 on Wednesday March 24, 2021 @11:37PM (#26576333)
It's not your app anymore. The user has bought it remember?
Re:Do you really want Linux phones by stirfish on Thursday March 25, 2021 @01:17AM (#26576818)
Why not? As a developer, I can't think of any downsides.
Re:Do you really want Linux phones by theodric on Thursday March 25, 2021 @03:13AM (#26577280)
As a user I say "too bad, I paid for the app, I do what I want with it"
Re:Do you really want Linux phones by whateveracct on Thursday March 25, 2021 @12:07AM (#26576496)
too bad!