
Google is tracking you. Even when you're in Airplane Mode w/o SIM card [video] - Jerry2
https://www.youtube.com/watch?v=S0G6mUyIgyg
======
zwerdlds
One thing this video implies is that no radios are on during airplane mode.
Perhaps my terminology is imprecise but the passive GPS receiver can remain
active. Still, its creepy (though unsurprising) that it uploads the data
anyways.

BTW, having the GPS on must have been a massive battery drain. I know it is on
my phone, especially for initial triangulation. I wonder if low power mode
would help?

~~~
olooney
I guess I knew GPS was passive but I would have guessed - naively, it turns
out - that "airplane mode" turns off _all_ interfaces to the outside world.

Is there a way to toggle off the GPS on an android phone?

~~~
downrightmike
open the phone, find the chip, burn it out.

------
dekhn
Is the android phone OS actually uploading location information unencrypted as
implied (they mitm'd the phone and said they saw raw locations, unencrypted).

~~~
olooney
I know that Apple got in trouble for storing and passing around unencrypted
location data a while back.[1] I also remember a story about predator drones
sending unencrypted video feeds, apparently because key management is hard and
they thought their enemies were too low tech to intercept.[2] I'm not a
security/cryptography guy, but my impression is developers do this because
it's easier.

[1]: [https://www.fastcompany.com/40477441/facebook-google-
apple-k...](https://www.fastcompany.com/40477441/facebook-google-apple-know-
where-you-are)

[2]: [https://www.wired.com/2012/10/hack-proof-
drone/](https://www.wired.com/2012/10/hack-proof-drone/)

~~~
TFortunato
Heh, sadly, I would not at all be surprised to see a: "TODO: encrypt this"
somewhere in the comments

------
olooney
Many of the youtube comments were people asking if he turned off location
tracking... does anyone here know if that would be an effective
countermeasure?

~~~
lern_too_spel
Yes. The reporter didn't understand the difference between airplane mode and
Google Location Services. If you turn off the latter, the location upload
won't happen, and you can still get your GPS location if you want it. iOS has
the same location services system, but you cannot disable it if you want to
get your location.

~~~
tinus_hn
One difference is that your location is not associated with your identity,
it’s associated with a random ID that automatically refreshes every few days.

~~~
legacynl
Except that it has been demonstrated that no amount of 'anonymization' or
'pseudonimization' is effective at actually disconnecting the data from the
person. With enough data, you can figure out who's who even with this
'randomID'.

Simple example: A random user with ID 'aaa' will provide location data
throughout the day. This provides you with the means to figure out where they
work, how late they get up, what their average walking speed is, etc. One day
the user get's a new randomID 'bbb'. At first glance there is no connection
between 'aaa' and 'bbb'. But from a specific day 'aaa' stops transmitting
data, and 'bbb' starts transmitting data. 'bbb' will submit the same data and
thus you can figure out for example their walking speeds and place of work.
This means 'aaa''s data will match 'bbb''s. Looking at the datetime when the
switchover happened you could deduce that 'aaa' and 'bbb' are probably the
same. With more data points you can increase your accuracy.

IE: with sufficiently large datasets (which they have), no amount of
anonymization works (which they know).

