I think generally speaking these privacy articles fail to convince the majority of people that there's a problem, which is crucial to be able to sell the solution.
I think the abortion part is the most relatable, but you'll hear them say they've got nothing to hide. I believe getting access to that data and show people what data they have on them would be the most effective.
It's like saying to someone that has nothing to hide "oh yeah? Give me your phone and your documents, let me browse what's on them"
A lot of great comments here. I just wanted to add that even just your ip address is enough to roughly track your location. When your phone checks gmail you are leaving digital breadcrumbs in Google’s logs of your ip address which roughly tracks your location. App permissions will not solve this. We need strong privacy regulations with teeth.
I have my location turned off for everything and keep mine in a Faraday bag. That said, there was one tip in this article I wasn't aware of: deleting my advertising ID, so everyone should read it and see if you can't improve your own privacy.
It feels good when I have to use it and, for a moment it says "no service", like kicking the tech assholes in the dick.
If you have a device that's actively connected to a cellular network, and has been while in your home or work, then your only option is to leave it behind or turn it off. That includes your car if it was made in the past decade, if nothing else, so it can catch OTA firmware updates, and send telemetry data.
GPS and location services don't mean shit when your carrier keeps logs of where you've been based on cell-tower triangulation.
Yeah but it was a luxury, and most likely an RX-only unit that only had a GPS radio. Even if you had a 2g cell radio in the 90's in your car it'd be incredibly limited, and horrendously expensive for something you could carry in your pocket.
These days even the cheapest model of Honda Civic will have a modern internet connected network of microcontrollers and computers which all receive OTA updates, many of which handle telemetry.
This video, where Veritaseum hacks LinusTechTips' phone, gives a good overview of how it's possible to track cellphones or hack sms, even without asking a carrier or having physical access to the device: https://m.youtube.com/watch?v=wVyu7NB7W6Y
TLDW: cellphone networks rely on old, unsecure infrastructure
I work for a telecom. In my country there is well regulated legislation that specifies how and when the police can ask the telecoms for cell location data, usually used for missing people.
They also provide large scale, anonymised data for crowd movement analysis. For example it was used to demonstrate how 60,000 people moved into and out of a stadium located for historical reasons in an old-fashioned, dense residential area, in preparation for the arrival of English football fans.
You could hide almost everything.
No app knew the other apps I used.
No app had clipboard access. when I needed to paste something I used Xposed Edge.
You could spoof a lot of info, GPS coordinates, IMEI ...
The list goes on.
support stopped. I should check if there's a fork.
edit: AOSP permissions have improved and I now use almost exclusively FOSS apps, so I'm not worried, but I still miss the app.
One thing I am always aware of are apps that want permission to access Bluetooth and/or Wi-Fi and/or Networks.
Even though Bluetooth is very short ranged it can still be used to tie you into a location within a database based on other database records that are more detailed.
Yeah, I love playing you “My Great Dog-sitting Simulator” (not a real app) but you do not need access to my BT. The OS handles sending your audio to my headphones!
I haven't done an extensive survey or anything, but every modern router I've interacted with supports setting up a secondary WiFi network with guest isolation (so anything on that SSID can't see any network device besides the router and itself). This is useful for apps or hardware that is untrusted and/or demands unjustified permissions.
I remember when Bluetooth started demanding location permissions. You'll never convince me that it's functionally required or provides any benefit other than furthering efforts to spy on the user.
When it started being rolled out, I avoided any app or hardware that made that demand. Sadly, that's no longer an option if I want any Bluetooth at all.
It's not like Bluetooth started demanding location permissions, the conceptual model of the permission was revised: having access Bluetooth means an app could determine your location via a form of lateration.
In earlier versions of smartphone operating systems, this was not transparent to users lacking the technical background, so Bluetooth also requiring location access is actually an attempt at making users aware of that. I'm not an iOS developer, so I can't comment on iPhones, but on Android versions prior to 11, having access to Bluetooth meant an app would be able to determine your location.
Today, you can require the permission ACCESS_FINE_LOCATION, which expresses that your app might use Bluetooth to obtain location information on Android. Also, if you're just scanning for nearby devices to connect your app to, but don't want users to be confused why your smart fridge app needs to know your precise location, you can declare a permission flag (neverForLocation) and Android will strip beacon information from the scan results, better asserting your intentions.
So, overall: no, there is nothing nefarious going on, it was always possible to determine your location via Bluetooth, and the update to the permission model was an honest improvement that actually benefits you as user.
Now, there are still plenty of shady apps around, and apps that are poorly written - don't use those.
Pretty easy steps; get app you are interested in. Deny it access to things it doesn’t need when asked. If the app proceeds to not work until you enable, delete. Otherwise, enjoy app without the unnecessary permissions.
NetGuard just outright blocks network access. Apps can't send tracking data if they are not able to access the servers. I'm using it in whitelist mode where I only allow access to apps that need it.
That's my approach with Rethink DNS. I get FOSS alternatives whenever acceptable for my use case, but isolate even them to only bare working minimum of outside connections.
11 out of 32 apps requesting location on my phone have the permission granted, because I actually need them to use location for one reason or another. the rest works perfectly fine with the permission disabled.
Years and years ago, they discovered that Google was still tracking your location, even with location disabled. That's because Google created a surveillance network using your friends' phones. Your friends' phones would find local WiFi connections, and report them back to Google, along with associated GPS data. Then Google used this to make a sort of WiFi map. So now Google can tell where you are without ever getting any actual "location data".