Android phones keep location cache, too, but it's harder to access (ars technica) [LWN.net]

After the recent discovery that iPhones/iPads were recording location data on the device, folks have been looking for similar data on Android phones—and have now found some. "Another important difference, according to developer Mike Castelman, is that Android keeps less data overall than iOS devices. 'The main difference that I can see is that Android seems to have a cache versus iOS's log,' Castleman, who contributed some code improvements to [Magnus] Eriksson's tool, told Ars. That is, Android appears to limit the caches to 50 entries for cell tower triangulation and 200 entries for WiFi basestation location. iOS's consolidated.db, on the other hand, seems to keep a running tally of data since iOS is first installed and activated on a device. iOS will also keep multiple records of the same tower or basestation, while Android only keeps a single record."

to post comments

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 23, 2011 0:04 UTC (Sat) by simosx (guest, #24338) [Link] (2 responses)

At least for Android it is not on by default. You need to opt-in if you want the functionality.

According to https://github.com/packetlss/android-locdump
the files (if you opted-in) can be found at /data/data/com.google.android.location/files on your rooted Android phone.

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 23, 2011 3:39 UTC (Sat) by Trelane (guest, #56877) [Link]

And you can put alternate firmware on a (non-jailed, not just jailbroken) phone.

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 25, 2011 11:58 UTC (Mon) by webmastir (guest, #59528) [Link]

ahhh, ty for this

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 23, 2011 13:12 UTC (Sat) by Lennie (subscriber, #49641) [Link] (7 responses)

Supposedly the evercookie developer found evidence about Android sending it to Google ?:

http://online.wsj.com/article/SB1000142405274870398370457...

Here is the excerpt:

Google previously has said that the Wi-Fi data it collects is anonymous and that it deletes the start and end points of every trip that it uses in its traffic maps. However, the data, provided to the Journal exclusively by Mr. Kamkar, contained a unique identifier tied to an individual's phone.

Mr. Kamkar, 25 years old, has a controversial past. In 2005, when he was 19, he created a computer worm that caused MySpace to crash. He pled guilty to a felony charge of computer hacking in Los Angeles Superior Court, and agreed to not use a computer for three years. Since 2008, he has been doing independent computer security research and consulting. Last year, he developed the "evercookie"a type of tracking file that is difficult to be removed from computersas a way to highlight the privacy vulnerabilities in Web-browsing software.

The Journal hired an independent consultant, Ashkan Soltani, to review Mr. Kamkar's findings regarding the Android device and its use of location data. Mr. Soltani confirmed Mr. Kamkar's conclusions.

Transmission of location data raises questions about who has access to what could be sensitive information about location and movement of a phone user.

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 23, 2011 17:22 UTC (Sat) by tetromino (subscriber, #33846) [Link] (5 responses)

According to Ars Technica, the data does contain a unique identifier, but that identifier is randomly generated, and is not derived from the phone's hardware IDs. In addition, data collection is opt-in: when you first associate your phone with your Google account, you are presented with a dialog giving you a choice whether or not to allow Google to collect location information.

Google spokesperson Randall Sarafa contacted Ars to clarify that its data collection practices are opt-in, as is Apple's. "All location sharing on Android is opt-in by the user. We provide users with notice and control over the collection, sharing and use of location in order to provide a better mobile experience on Android devices," he told Ars.

Furthermore, he explained that the unique identifier number is random, not hashed from the unique IMEI or MEID number associated with all mobile devices. Google's servers use the number to correlate data from a single device to analyze patterns. "Any location data that is sent back to Google location servers is anonymized and is not tied or traceable to a specific user," Sarafa said. However, as researchers have shown numerous times in the past, "anonymized" data can often be analyzed and correlated with a single person with surprising accuracy.

Surprising?

Posted Apr 24, 2011 16:08 UTC (Sun) by gmatht (subscriber, #58961) [Link] (3 responses)

Revealing that a device arrives at my work at 9am and arrives at my home at 6pm regularly is more of a worry to me than revealing my IMEI. According to the article they delete endpoints, which I guess means that it isn't obviously trivial to get that data, but still not surprising to me if it can be reconstructed.

Surprising?

Posted Apr 25, 2011 9:51 UTC (Mon) by tialaramex (subscriber, #21167) [Link] (2 responses)

No, when they speak about endpoints they mean for Google's route planner.

Assuming you don't have some type of serious amnesia problem it's unlikely that you use Google's route planner to travel to and from work every day.

The geolocation data used to match WiFi hotspots, GPS locations and phone masts together doesn't have "endpoints" it's just a sea of possible correlations. If you find this to be a type of unbearable snooping, well, you can turn it off, but I'm afraid the rest of your life will be fairly miserable because tracking is inevitably going to become more and more pervasive over time.

In the larger picture we have a choice, much as societies have faced before. We can embrace the change and learn how to all live in the glass house, or we can fight tooth and nail and lose anyway. Sadly past experience suggests we'll probably choose to fight tooth and nail. Much better in most people's eyes to desperately try to lock the truth away than to face all the lies we tell ourselves and each other.

Surprising?

Posted Apr 25, 2011 12:48 UTC (Mon) by drag (guest, #31333) [Link] (1 responses)

If you want the truth it's helps to realize that phone companies track and record your movement anyways. If they don't sell that information it's only because nobody cares enough to pay for it.

Oh and your credit card (aka every major bank) collects and sells information about your purchasing habits. All personally identifiable, of course. Oh and mortgage applications are a big source of accurate information that is heavily traded.

Not to mention that your government collects information from your tax documentation, licensing applications, and other documentation your forced by law to fill out and sells that, too.

On top of that the government works closely with data collection corporations to ensure data accuracy.

Compared to all that Google is almost trivial.

Surprising?

Posted Apr 28, 2011 11:44 UTC (Thu) by nlucas (subscriber, #33793) [Link]

Doing something because others do it is not an argument.

There is a big difference between anyone with access to your phone to also have access to location information and some company who you make business with have access to information you had to share with them.

An application you download from the internet should not *EVER* have access to this information, unless enough BIG RED BUTTONS have been clicked and the phone is on a special mode only hackers know.

There should be a way to easily clear this cache, like the "recent files" list on a desktop. It's important private information and needs to be handled like that.

The "we are all in a big brother world" argument is ridiculous. There are (at least) some of us who don't have a facebook account, or even a blog, because they don't buy into the "world is a stage" and "everyone want's their 15 minutes of fame" philosophy.

Yeah, I know just by commenting on a public forum I'm giving away some of my private life into the internet, but there is a line for everyone.

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 29, 2011 1:23 UTC (Fri) by Baylink (guest, #755) [Link]

Well, good that I reflexively declined that offer, based partly on *their not telling me what the $%*^ it actually meant*.

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 25, 2011 18:27 UTC (Mon) by Kamilion (subscriber, #42576) [Link]

Samy is my hero.

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 25, 2011 0:59 UTC (Mon) by Hausvib6 (guest, #70606) [Link] (3 responses)

I thought since Android is FLOSS, pulling something like this will be lots more difficult since there are lots of eyes doing verification of the source code. Then I remember something about trust, http://cm.bell-labs.com/who/ken/trust.html.

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 25, 2011 15:50 UTC (Mon) by zsouthboy (guest, #60295) [Link] (2 responses)

This isn't going behind the user's back. It hasn't slipped through the source code to be enabled and reenabled with the compiler.

You opt-in to google's location services and it's turned on.

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 25, 2011 16:29 UTC (Mon) by martinfick (subscriber, #4455) [Link] (1 responses)

> You opt-in to google's location services and it's turned on.

And surprisingly, there is even a big scary warning when you do so!

Android phones keep location cache, too, but it's harder to access (ars technica)

Posted Apr 26, 2011 3:32 UTC (Tue) by Hausvib6 (guest, #70606) [Link]

I see, so this is just a sensasional news jumping on the privacy-scare bandwagon started by iPhone location database.