[Omnitech]

(I hope this "sideloading" section is still relevant for direct-install APKs in 10.2.1.xxxx. I don't want to post in the section where people talk about a bunch of specific apps.)

One of the tradeoffs of running direct-install or sideloaded Android apps on BB10 are the security and privacy issues. One of the top reasons I won't buy an Android smartphone is because of all the Googleplex's privacy intrusions.

So for my BB10 device that I use to run direct-install Android apps, on the security/malware side I address that in part by running a fulltime Android antivirus utility. And on the privacy side we've already got some advantages over a standard Android device because the Google Play framework and various other Google frameworks are not in the BB10 Android runtime. When it comes to location services, I thought I was good because I had A) turned off location services by default via BB10 settings (only activate it when I need it), and B) turned off (I thought) Android location services in the Android runtime via the Android Settings applet. (Which I launch using Ghost Commander)

So I found a free (but well-rated) Android game that looked interesting, but it wants, among other things, location permissions. Most likely to serve regional ads but I still don't trust those things.

I figured I was good because of the above 2 measures, but 2 minutes after I launch the app I start seeing targeted location-specific ads being served to me inside the app.

I know that Google has a rough location-correlated database of wifi networks and carrier network addresses/towers (one of the key reasons they drive those Google Maps cars all over the place), but I thought if you turned off "Google Location Services" in Android Settings, they weren't supposed to use that database.

Anyone have more details on how the ad servers are determining location if you have supposedly disabled all that stuff?

Are they doing something stupidly sneaky like correlating historical location data from some prior time when you had location services turned-on using the same account or Google ID?

[Djlatino]

Most of the time, the fail safe for location based ads is the IP location that your ISP has.

This doesn't necessarily mean they know where you are, exactly, but they do have a good sense of where you might be.

E.g. I'm using Bell's Internet which is based in Calgary, making my IP location in Calgary, yet I'm in Edmonton. So I'll be getting friendly Russian girl requests when I visit a public torrent tracker followed by "hey bb I see you're in Calgary,AB".

Essentially, this is what occurs with apps as well since you leave them guessing when you pop off your location.

That or your app's cache saved your last known location, which I doubt.

[Omnitech]

Most of the time, the fail safe for location based ads is the IP location that your ISP has.

This doesn't necessarily mean they know where you are, exactly, but they do have a good sense of where you might be.

E.g. I'm using Bell's Internet which is based in Calgary, making my IP location in Calgary, yet I'm in Edmonton. So I'll be getting friendly Russian girl requests when I visit a public torrent tracker followed by "hey bb I see you're in Calgary,AB".

Essentially, this is what occurs with apps as well since you leave them guessing when you pop off your location.

That or your app's cache saved your last known location, which I doubt.

I don't know what the phrase "pop off your location" means.

I know about IP geolocation, but the impression that one gets when turning off Android's location services is that they will not track your location for any Google purposes. Since Google owns the ad network and that's probably the single most valuable property of theirs on the Android platform, one would expect that to mean that this applies to anything Google touches, including any 3rd-party ad networks that leverage off of their feed from that specific end-user.

If they claim that you can block usage of Google's Location services, but their ad network still uses IP info to provide rough location info to 3rd-parties anyway, that's kind of misleading.

Not that I expect much from Google these days...


(Edit: And I'm kind of surprised and disappointed that Verizon would make it trivial to do rough geolocation based on customer-assigned IP addresses in their mobile network anyway. Especially since an IP address should remain assigned to the device as it travels, or else data communications would get continuously trashed as people travel between cellsites. Something fishier is going on here, methinks.)

[Omnitech]

Re-thinking the IP geolocation thing on Verizon - they assign users IPv6 addresses in private address space these days. Perhaps it is not a customer IP address but a tower IP address that they are tracking location on. I still think it's kind of stupid for Verizon to make that easy to track simply by IP address.

If someone wants to subpoena that information that's one thing, but that opens up a whole can of worms around privacy if people can track you all over the place just by looking at ie the headers in the email messages you are sending as you travel from one cellsite to the next.

[Djlatino]

Re-thinking the IP geolocation thing on Verizon - they assign users IPv6 addresses in private address space these days. Perhaps it is not a customer IP address but a tower IP address that they are tracking location on. I still think it's kind of stupid for Verizon to make that easy to track simply by IP address.

If someone wants to subpoena that information that's one thing, but that opens up a whole can of worms around privacy if people can track you all over the place just by looking at ie the headers in the email messages you are sending as you travel from one cellsite to the next.

Basically what I meant with the "pop off" expression was "turn off", sorry for that confusion.

But IP tracking isn't as bad you may think, I mean it's not as accurate as an actual GPS location, especially if it's IPv6 - since IPv6 still isn't widely used as much. That being said, if you are really in need to pop out that roll of tinfoil, mind as well get a VPN.

[Omnitech]

Basically what I meant with the "pop off" expression was "turn off", sorry for that confusion.

But IP tracking isn't as bad you may think, I mean it's not as accurate as an actual GPS location, especially if it's IPv6 - since IPv6 still isn't widely used as much. That being said, if you are really in need to pop out that roll of tinfoil, mind as well get a VPN.

Yeah I know it's not as accurate as GPS, nor is it as accurate as their wifi-network based location thing, which is scarily accurate sometimes.

I just like to know what I am getting into, so I can make informed decisions about how to use things. There are altogether too many things going on under the hood in smartphones and other internet-connected devices these days that need to be enumerated and documented.

[chetmanley]

I've discovered something about geolocation on BB10 v Android runtime that is annoying me.

For BB10: We cannot disable wifi/cell tower geolocation and reporting. And I can't seem to find what service/provider is receiving this position data (is it google, BB, mozilla etc). So it's all or nothing.

Does anyone know of a way to set only pure GPS reception based positioning on a BB10 device without turning off the wifi and cell reception? Additionally, does anyone know if BB maps needs to be running for this position data transmission to take place? or does it occur the instant location services are turned on?

For Android (including the ART on BB10): It is possible to disable google based location gathering, and in addition, the Qualcomm hardware acceleration which also collects and transmits location data to IZat without affecting normal GPS reception based positioning.

Sadly, on BB10 with the android runtime, these settings only affect android apps (google maps), but do not affect BB10 (bb maps). I ran both side by side and proved this.