News for hackers. Stuff that matters.
Re:Tell HN: Google is correlating location data to your IP by freitasm on Saturday December 17, 2022 @06:35PM (#34033401)
Not you IP address but your router/access point's MAC address and been doing it for many years.

For example, I receive quite a few devices for reviews, and I mostly give things away after using those. Many years ago, I gave a friend in another city a router. For a few weeks his computer and other devices reported his location as being my city instead of his. It took a couple of weeks for Google services to catch up.

Google logs your current location and the MAC address of any access point visible to your phone. In your case, if you used your phone via the VPN for more than a few hours, Google associates that MAC address with the finer location from your phone's GPS. It may not link that data to your account, but it uses it to help getting a GPS location.

If you live in a location with low traffic/human density then it may take longer for Google to change it back.

This information is also used for a GPS cold start. Actual GPS takes a few moments to get a fix, even more if indoors. A GPS get a fix faster if you are using it close to where it was last used, or how fresh the stored almanac data is, otherwise it may not find expected satellites in certain locations in the sky. While a fix is not available phone GPS uses any visible MAC address to determine its coarse location.

On laptops and desktops with no GPS, browsers will use this access point data to set a location - IP addresses databases are not up to date enough and sometimes they are linked to the ISP office address and not to specific towns and cities and certainly not to a specific address.

Re:Tell HN: Google is correlating location data to your IP by arthurcolle on Saturday December 17, 2022 @06:44PM (#34033462)
How do they get mac address from HTTP requests?
Re:Tell HN: Google is correlating location data to your IP by gerdesj on Saturday December 17, 2022 @06:50PM (#34033511)
In a http request/response, mac address would be meta data. ARP is not a thing there. That would be an example of data snaffling.
Re:Tell HN: Google is correlating location data to your IP by utsuro on Saturday December 17, 2022 @07:39PM (#34033851)
Do you have any info on this? AFAIK, MAC is only distributed in datalink layer around local connections.

I tried some quick packet sniffing browsing Google and did not see my MAC transmitted—as I’d expect (bc like you said, ARP not thing at this layer) also research on “MAC included in http metadata” turns up no results…

If you have any more info on this I’d love to learn more—as I’m puzzled to know why this would happen?

Re:Tell HN: Google is correlating location data to your IP by md_ on Saturday December 17, 2022 @08:03PM (#34034012)
I think the poster isn’t talking about the remote server seeing client MACs (because, as you say) but, rather, about the way mobile OSes use nearby wifi access point SSIDs to provide GPS-less geolocation. Samy Kamkar raised my awareness of this way back in 2010 or so, and this article about his DefCon talk provides a good quick explanation: https://www.bbc.com/news/technology-10850875.
Re:Tell HN: Google is correlating location data to your IP by freitasm on Saturday December 17, 2022 @08:22PM (#34034132)
Correct.
Re:Tell HN: Google is correlating location data to your IP by WookieRushing on Saturday December 17, 2022 @06:49PM (#34033504)
They can get it from your android phone or from chrome if you’re running it
Re:Tell HN: Google is correlating location data to your IP by pxeboot on Saturday December 17, 2022 @06:50PM (#34033510)
They don't. But Chrome, Google Play Services and other popular apps likely share this data frequently.
Re:Tell HN: Google is correlating location data to your IP by firecall on Saturday December 17, 2022 @08:19PM (#34034109)
They can get it if you log into your Android TV!

I believe they also track and log other Wifi networks that you arnt even connected to.

I'm sure they gather all sort of other metrics from any sensors and signals they can access.

Re:Tell HN: Google is correlating location data to your IP by freitasm on Saturday December 17, 2022 @08:22PM (#34034129)
Not from HTTP requests. Android has access to the network stack and location. Google grabs all visible APs around and correlate to your location.

It is way before HTTP even happens. This data is collected while you are driving around, walking down the street, etc.

Re:Tell HN: Google is correlating location data to your IP by brador on Sunday December 18, 2022 @01:34AM (#34035535)
How can you block this?
Re:Tell HN: Google is correlating location data to your IP by notpushkin on Sunday December 18, 2022 @01:43AM (#34035572)
Disable “coarse location” option in settings. Might not work though.

If you want coarse location to work but don't want Google to know it, try microG with a non-Google location provider (I use Apple and Mozilla and it's pretty good).

Re:Tell HN: Google is correlating location data to your IP by ThePowerOfFuet on Sunday December 18, 2022 @04:08AM (#34036145)
www.GrapheneOS.org
Re:Tell HN: Google is correlating location data to your IP by infinitedata on Sunday December 18, 2022 @08:26AM (#34037441)
Usa an iPhone?
Re:Tell HN: Google is correlating location data to your IP by achairapart on Sunday December 18, 2022 @08:53AM (#34037622)
Doesn't Apple do something similar however? When you turn WiFi off on your iPhone a prompt appears saying that it's better to turn it on for "better location tracking" or something like that.
Re:Tell HN: Google is correlating location data to your IP by jen20 on Sunday December 18, 2022 @10:39AM (#34038665)
Keeping Wifi on allows “find my” to work more accurately, which many people value. Third party apps such as YouTube have an additional permission to be able to look at the local network.
Re:Tell HN: Google is correlating location data to your IP by ce4 on Tuesday December 20, 2022 @06:36PM (#34074485)
Newer wifi chips allow passive scanning while the bulk of the silicon is powered down. I.e. it could/should also work in flight mode
Re:Tell HN: Google is correlating location data to your IP by mmebane on Monday December 19, 2022 @03:43PM (#34057390)
On Android, find Location Services in your system settings and look for Google Location Accuracy. The description for it on my Galaxy S21 reads:

> Google's location service improves location accuracy > by using Wi-Fi, mobile networks, and sensors to help > estimate your location. Google may collect location > data periodically and use this data in an anonymous > way to improve location accuracy and location-based > services. > > Turning this off will result in your device only using GPS > for location. This may impact the accuracy of location > used by apps such as Maps and Find My Device.

Based on that description, that should turn off the data collection, although it can also make GPS fixes take longer, and there may well be other apps collecting this data as well.

Re:Tell HN: Google is correlating location data to your IP by habibur on Saturday December 17, 2022 @08:22PM (#34034131)
They don't get it from your HTTP req.

They get it from your GPS on your android sending the mac address with your location to google servers.

And then later your TV sending the same mac address to google and asking "what's my location?".

Google associates your TV's request with your phones data using the mac address. And then the browser communicates with your OS using the location service API, a virtual GPS on your TV that only uses MAC address and google's server, to get the result.

Re:Tell HN: Google is correlating location data to your IP by runjake on Saturday December 17, 2022 @09:54PM (#34034643)
It’s not the MAC address, it’s the BSSID of the wireless network you are connected to, and those around you.

Software typically obtains BSSIDs from your mobile OS’s wi-fi frameworks.

The BSSID looks like a MAC address, and in many but not all cases, a given AP’s wireless network BSSID is within a byte or two of its actual wi-if radio MAC.

Google and Apple maintain their own massive geolocation databases of BSSIDs, signal strength, and latitude/longitude.

Re:Tell HN: Google is correlating location data to your IP by plorg on Saturday December 17, 2022 @09:03PM (#34034352)
I'm curious how this actually works. My workplace has extremely bad cell coverage and no GPS coverage indoors. I work at a satellite office about a mile from the main headquarters, but we have facilities (mostly small storefronts) over about a 1000mi radius from that location. Few employees have company-issued phones connected to the network. Whether or not we're connected (or have ever been connected) to the company network, people in my office will find that our detected location is maybe 200 mi away from our office, often in places that have none of the same ISPs as our headquarters and are nowhere near any of our facilities. The location will change maybe every few months. Currently we are showing up as being in the middle of a lake outside a town of 30000 people, though the FCC believes that area is only served by satellite internet providers. I assume our locations are being provided based on the MAC of the nearest router(s), but it's not clear why those router MACs get associated with such far-flung and uncorrelated places.
Re:Tell HN: Google is correlating location data to your IP by Operative0198 on Saturday December 17, 2022 @09:35PM (#34034547)
Can confirm this. In my naive days I used to use Google's Maps together with location tracking on my Android phone. When I moved location, the ISP I was using was available in the new location so I just moved with my router and my IP address and device Mac address remained the same.

Google Maps still thought I was living in my old address. My phone was stuck on the old location for days iirc.

Re:Tell HN: Google is correlating location data to your IP by barbarbar on Sunday December 18, 2022 @12:48AM (#34035370)
In my case the location it shows is in most cases very wrong and also sometimes places I have never visited. Sometimes it changes during some minutes to other places hundreds of kilometers away. So in my case it is completely nonsense what is going on.