How we built the new Find My Device network with user security and privacy in mind
security.googleblog.com
Posted by Dave Kleidermacher, VP Engineering, Android Security and Privacy Keeping people safe and their data secure and private is a t...

I saw this on infinity for Reddit earlier, I don’t know if there’s a workaround for this or not.

  • forgotmylastusername@lemmy.ml
    1033·
    7 个月前

    They talk as if they’re protecting our privacy when it’s really a global surveillance net. The spin doctoring is insane.

    • Syn_Attck@lemmy.today
      52·
      7 个月前

      Friendly reminder that Bluetooth has a larger network stack than Wi-Fi. Much more code, much larger available attack base. There have been many numerous Bluetooth vulnerabilities that allow remote code execution or theft of files.

      This is truly becoming a surveillance state, in no way that can be debated. That want to be able to access everyone’s innermost thoughts (texts, notes, recordings, calendars, contacts, photos, you get it) without any chance of someone being able to protect against it.

      Reminder that Google was the 2nd or 3rd company to commit to NSA’s PRISM program of feeding American’s data for future analysis.

      • shneancy@lemmy.world
        3·
        7 个月前

        maybe humanity shouldn’t have written so many dystopian cyberpunk books and pieces of media, gave us all the wrong ideas :|

        • melpomenesclevage@lemm.ee
          71·
          7 个月前

          Maybe we shouldn’t have handed our fucking lives over to corporations

          Maybe they’re not ours til every single corpo is dead, and you should fight like the fucking dead to make this happen?

          I dunno.

      • refalo@programming.dev
        3·
        7 个月前

        I really don’t disagree with you, but it’s so frustrating and tiring to try to work around all this stuff and use alternative tools that nobody else does, all while you’re viewed as a paranoid tinfoil hat wearer. Yes I know I shouldn’t care what other people think, but I also don’t want to be alone forever.

        • Syn_Attck@lemmy.today
          01·
          7 个月前

          Find a good girl that doesn’t mind. Mine doesn’t care at all, she has her interests and I have mine. I’ll sit there and listen to her 5 minute lectures on makeup and perfumes, and every once in a while I’ll tell her about a vulnerability or something cool I found, and I know she’s paying as much attention as I do about makeup, but at least I can understand the basics of makeup without years of experimentation and learning.

          True, it makes it harder to stay secure when people around you don’t care or don’t know how, but its still possible. Just have to set some solid boundaries sometimes.

    • LWD@lemm.ee
      20·
      7 个月前

      “Privacy Sandbox” is just Google-controlled surveillance carried out with your phone/PC as the primary data provider. We’ve reached maximum perversion of the English language.

      • Scolding0513@sh.itjust.works
        3·
        7 个月前

        this sort of gaslighting through corruption of vernacular used to amuse me, but now I feel like the withering wojak face anymore

      • HelloHotel@lemm.ee
        2·
        7 个月前

        are you referring to the new “Privacy Sandbox” or the old “Privacy Sandbox”. because if there calling this new thing a “Privacy Sandbox” after the old one lost public attention after they kept promising it for years, I am going to laugh or maybe cry.

        what they originally called “Privacy Sandbox”

        it was a browser feature to remove the HTTP cookie and replace it with a cohort system. your browser would receve signals about your habbits. that you were buying domino’s pizza and announce to upcoming sites that you like pizza, but ya know… in a “safe” way.

        I still see, “chrome is going to replace the cookie” and “RIP the humble cookie” every once in a while.

        • LWD@lemm.ee
          4·
          7 个月前

          I’m pretty sure the old Privacy Sandbox was called FLoC, wasn’t it? This is definitely part of Google’s continued efforts to kill the (third-party) cookie in such a way that tracking your user activity will still be possible, but that Google itself will maximally benefit from because they’re the ones controlling how it’ll get implemented.

          And given Google’s near-unilateral control of web browsing standards, who will say no? Their biggest partners? Mozilla?

    • Murdoc@sh.itjust.works
      201·
      7 个月前

      Straight up 1984 Newspeak, where the Ministry of Truth is really concerned with lies, the Ministry of Peace is concerned with war, the Ministry of Love is concerned with torture, and the Ministry of Plenty is concerned with starvation.

      • trippingonthewire@lemmy.mlOP
        5·
        7 个月前

        It’s honestly Doublethink.

        Whenever Google gets exposed for bad practices, people ignore it. And they believe this stuff is good or don’t care.

  • shortwavesurfer@monero.townEnglish
    732·
    7 个月前

    According to the posted link, the network can be turned off entirely if you wish, and you could just not use Google Play Services on your device, and that should also stop this.

      • shortwavesurfer@monero.townEnglish
        11·
        7 个月前

        It appears to require a Google account to do the tracking. So yeah, without Google services, you should be perfectly safe. Since you have no Google account registered on device and no services that run rogue in the background,

          • shortwavesurfer@monero.townEnglish
            14·
            7 个月前

            The article did not say specifically how it was getting added to Android 15, because if it’s in AOSP, then yeah, there’s definitely a problem. But if it’s in Google Play Services, which seems likely, then it would not be as big of an issue.

          • BorgDrone@lemmy.one
            31·
            7 个月前

            If it works anything like Apple’s Find My (which it appears to do) then no you won’t be trackable.

        • HelloHotel@lemm.ee
          3·
          7 个月前

          I am aware that there are highly opinionated people in the graphineOS team. we had a scandal a while back that shook up the company (and I to the best of my understanding, kicked off/demoted some members, if its didn’t I’m getting another phone) a little while back. for being so important for my life and the lives of many others, the tightrope of maintaining trust that the OS is safe is unacceptably wobbly.

    • Kir@feddit.it
      191·
      7 个月前

      While I like those options, they are definitely not for everyone. Those problems are collective, protecting the privacy of 1% of the population is as good as protecting nobody.

        • Ilandar@aussie.zone
          2·
          7 个月前

          I think a growing number of “normal” people do, they are just less willing to make sacrifices for it than the types of people who populate this community, for example.

    • Proteish@awful.systemsCatalà
      23·
      7 个月前

      I also couldn’t find a mention, and it definitely does not make sense (and likely isn’t even possible) to run Bluetooth without Android itself running

      …which uses a crowdsourced device-locating network to help you find your lost or misplaced devices and belongings quickly – even when they’re offline.

      Maybe this line is being misinterpreted?

      • ForgotAboutDre@lemmy.world
        2·
        7 个月前

        It’s definitely possible. It may be using specific hardware to do the powered off tasks. Or it never be truly off, a small os running to managing these powered off tasks.

        The second is more likely, it’s cheaper and easier. It can also be applied to older devices and requires less integrated design.

    • Fredrik@lemmy.world
      172·
      7 个月前

      It’s mentioned in the linked article about Find My Device.

      This is what it says

      1. Locate offline devices

      Locate your compatible Android phone and tablet by ringing them or viewing their location on a map in the app — even when they’re offline. And thanks to specialized Pixel hardware, Pixel 8 and 8 Pro owners will also be able to find their devices if they’re powered off or the battery is dead.

      • Proteish@awful.systemsCatalà
        13·
        7 个月前

        I don’t know that means Bluetooth will be running when the device is off. “Specialized hardware” could mean a full Bluetooth modem on backup power, but more likely it’s means there’s a low power beacon. Would be interesting if anyone does a teardown of the Pixel 8.

        For non-Pixel 8 devices, definitely not. I assume “Offline” refers to the case where your device doesn’t have WiFi/LTE, but can still use Bluetooth to communicate with devices that do.

    • The Doctor@beehaw.orgEnglish
      52·
      7 个月前

      That is why we took our time when designing the new Find My Device, which uses a crowdsourced device-locating network to help you find your lost or misplaced devices and belongings quickly – even when they’re offline.

      • LaggyKar@programming.dev
        9·
        7 个月前

        That doesn’t say that. Although the article linked from there does, for Pixels.

        And thanks to specialized Pixel hardware, Pixel 8 and 8 Pro owners will also be able to find their devices if they’re powered off or the battery is dead.

        • ErwinLottemann@feddit.de
          3·
          7 个月前

          even with a dead battery? how? there must be something ‘turned on’ to send bluetooth signals or is this magic?

          • YerbaYerba@lemm.ee
            8·
            7 个月前

            I suspect it still draws battery power, but extremely small amounts. Few mah left in the battery could power a BLE beacon for weeks. There would be some limit to this as draining the lithium battery too deeply will damage it.

          • lemmyvore@feddit.nlEnglish
            5·
            7 个月前

            Not necessarily, there are lots of completely passive beacon technologies. I seem to remember reading a few years ago about beacons powered by Wifi signals.

            Obviously you also need other phones to be able to pick up those signals so it might take until phones with Android 15 become commonplace which might take a while. But it’s definitely doable.

  • cordlesslamp@lemmy.today
    362·
    7 个月前

    Didn’t iPhone been doing it for years so you can still track your lost phone even if it’s turned off?

    But this is Android, I’m sure there’ll be work around if you don’t want it. Personally I think it could be helpful.

    • Xatolos@reddthat.com
      9·
      7 个月前

      You turn it off. It says so in the link.

      User Controls: Android users always have full control over which of their devices participate in the Find My Device network and how those devices participate. Users can either stick with the default and contribute to aggregated location reporting, opt into contributing non-aggregated locations, or turn the network off altogether.

      • cordlesslamp@lemmy.today
        32·
        7 个月前

        Right, Google definitely a man of their words. Like they are definitely not record anything in your Incognito Chrome tabs.

    • onlinepersona@programming.devEnglish
      104·
      7 个月前

      Didn’t iPhone been doing it for years

      You’re trying to describe an action that has started in the past and is still taking place. “Didn’t” is simple past which indicates a concluded action. The correct tense you’d want to use here is present perfect progressive --> “Hasn’t iPhone been doing it for years”.

      Edit: Although, I missed the “been” in your sentence, so you just picked the wrong verb. Not too far off 👍

      Anti Commercial-AI license

      • Gooey0210@sh.itjust.works
        4·
        7 个月前

        I have some more questions, teacher

        If I lived in a country for some years/time, how do I say that?

        Also, if I worked as somebody?

        And in general, difference between have been and had been?

        Thank you

        • onlinepersona@programming.devEnglish
          91·
          7 个月前

          And in general, difference between have been and had been?

          I’ll answer this because the two previous questions depend on what you want to express. Just a note before-hand, the best site for English grammar I know is ego4u.

          First the quick answer:

          • have been --> present perfect progressive: an action that took place in the past and continued until recently or is still continuing
          • had been --> [past perfect progressive]: an action that started in the past and continued until some point in time in the past

          Longer answer:

          Conceptually, there are a limited number of possible tenses. Here is a picture from ego4u

          Let’s say you want to tell a story. There are the static states you can describe

          • Something is in a certain state right now e.g the person is alive, the table is on the second floor, life is great --> that’s the simple present
          • In the past something happened and the action was completed e.g I stood there, the pool was filled, the plane got loud --> that’s the simple past
          • A thing is in the future or there is an intent to do something in the future e.g we will be there, the train will be on time, they are going to have a party in the hotel --> simple future. Notice the use of will and going to. Those are two ways to express the simple future.

          So, now that we’ve expressed a state, something that is unchanging, we would like to describe changing actions are particular strips in time:

          • Actions that are currently taking place and ongoing e.g the person is living, the table is standing on the second floor, life is going great --> present progressive. Notice the difference from simple present above. The action is ongoing.
          • A thing that’s going on in the past: I was standing there, the pool was being filled, the plane was getting loud --> past progressive. Again, compare with simple past from above
          • Something in the future is changing: we will be standing there, the train will be waiting on time, they are going to be partying in the hotel --> future progressive

          Alright, we have expressed points in time both static and changing, but what about actions that happen just before those points in time? They concluded or may be still happening. We call those “perfect” tenses.

          • the person has lived here for ages, the table has stood on the second floor, life has been great --> present perfect
          • I had stood there, the pool had been filled, the plane had gotten loud --> past perfect aka something that happened before a thing in the past
          • we will have stood there, the train will have waited on time, they will have partied in the hotel --> future perfect = an future past action or action that will be the past in the future

          And finally, if we look at the diagram we see one last group of progressives - perfect progressive. Remember, progressive describe something that’s still ongoing at the point in time. You may ask why they are needed when the “perfect” overlaps with the progressive - something that started before a point in time and continues to happen.
          Well, that difference might be lost with time as they tend to become less and less important. A grammar purist might disagree but in colloquial English, my experience shows less and less people can tell the difference and I do have to look it up:

          The difference between “perfect” and “perfect progressive” is the focus of the tense. “Perfect” makes the result important and “perfect progressive” makes the duration or fluidity / continuity of the action important. I invite you to read this page on Present Perfect Simple vs Present Perfect Progressive. It explains it quite well.

          Hopefully that will help you answer your two first questions.

          Anti Commercial-AI license

          • Gooey0210@sh.itjust.works
            4·
            7 个月前

            I love you for being so human

            Just a random person on the internet asked you to explain something, and you did, you’re so cool

            Thank you for the explanation, I will really remember and keep it for my whole life

            ❤️‍🩹

            (No sarcasm, really, people these days are so mean and tell you to look everything up yourself, or just get angry because you ask or don’t know. Even though you could just copy and paste, this is a human interaction. Really happy to see somebody’s still alive)

    • EunieIsTheBus@feddit.de
      72·
      7 个月前

      I’m sure there’ll be work around if you don’t want it.

      Take the battery out of the phone. No battery no energy to run bluetooth

    • lemmyingly@lemm.ee
      11·
      7 个月前

      Not a single mention in the article about whether Bluetooth is turned on or off.

      Samsung has an opt in option for the Smart thing network. I guess Google will go the same route.

    • m-p{3}@lemmy.ca
      9·
      7 个月前

      Depends how it’s implemented, my bluetooth “smartwatch” runs for around 2 years on a single CR2032.

      • ReakDuck@lemmy.ml
        4·
        7 个月前

        There is also Bluetooth low frequency thingy with less data transfer. I wonder what Google will do and use while being turned off.

  • Scolding0513@sh.itjust.works
    13·
    7 个月前

    Can someone explain where the code for this will be located (aosp, gsf)? How can I make sure that it will never ever be activated? What Graphene’s response? etc

    • HelloHotel@lemm.ee
      8·
      7 个月前

      it looks like its going to be a hardware feature. if the main CPU is off, it implies the radio circuitry and its CPU (the BBM) are still powered. give google this at least, the special new Bluetooth API will be accessible to whatever OS is alive and awake to send commands (even if I don’t trust that “off” means “off”). the fact that its using encryption (that’s too complicated to be made out of Integrated Circut logic) means its likely another software feature added to the BBM co-processor (it handles all radio tasks on the phone). this all but confirms the BBM (at least going forward) will still get power, be awake and have access to the (transmit (TX) and reseave (RX) functions of the) radios even when everything else is properly off.

      EDIT: or it could be an abuse of a generic BLE beacon mechanism that’s “just there for whatever the consumer would need it for”. but if they are doing proprietary encryption like they claim, that’s not really possible without updating the BBM’s software to add another feature.

        • HelloHotel@lemm.ee
          1·
          7 个月前

          Probably about as effective as keeping an air tag or tile tracker in one. That is, if the problem behavior isn’t correctly disabled by or even encouraged the OS.

      • DictatorGator@feddit.deEnglish
        2·
        7 个月前

        We could wait for the implementation from the GrapheneOS team ! I’m pretty sure that they would implement it in a way that would be safe for the user.

        • onlinepersona@programming.devEnglish
          41·
          7 个月前

          If it’s hardware controlled, then the Graphene OS team would have to find a flaw in the hardware, or trust that when they tell the hardware to shut off, that it really does shut off, or find a way to verify that the hardware is really of. But even if they could tell the hardware to shut off, verify that it’s off, and then shut down, the hardware could turn back on after the software is off and the software would be none the wiser.

          The only way 2 ways anybody can be relatively sure this feature is off are:

          • pulling the battery:
            • good luck with that with phones that don’t have removable batteries
            • hopefully there won’t be a small backup battery to power this specific circuit
          • physically disconnecting this circuit from other circuits:
            • that might mean saying goodbye to bluetooth functionality on the phone

          The alternative is getting a linux phone with hardware that doesn’t have this feature.

          Anti Commercial-AI license

              • HelloHotel@lemm.ee
                1·
                7 个月前

                I hate that they don’t support them after a while, those with a locked bootloader wont even get a chance. It makes these phones junk from all the CVEs that are being found.

                • What old model would you recommend?
                • Is something like postmarketOS viable yet?
                • What phones are/will be effected?
                • Do existing phones planned for the program have the payload sitting there dormant or will the system updater (on googled android) need to download the payload?
      • Scolding0513@sh.itjust.works
        2·
        7 个月前

        damn that really sucks… sounds like it may just be an OS/firmware change then that activates the radio controller?

        either way this is is exactly why we need a new community built piece of hardware. we cannot keep being slaves to Google’s whims just to use Graphene. i know there are other OS’s but either way it’s still Big Tech dependence.

  • thantik@lemmy.worldEnglish
    142·
    7 个月前

    This is mostly Bluetooth LE so that you can use their new device finder network if your phone gets lost. Thieves often turn off the phone as the first step, so this may help a lot of people recover their devices.

    • barbara@lemmy.ml
      81·
      7 个月前

      Not really. Thieves know how powerful aluminium is against waves

    • lemmyvore@feddit.nlEnglish
      3·
      7 个月前

      Thieves simply use tinfoil to block all signals. They have pockets and bags lined with tinfoil, they don’t bother turning anything off.

      Could still work against opportunity theft.

  • TCB13@lemmy.worldEnglish
    10·
    7 个月前

    The question is: when a phone is turned off is it really turned off? The amount of software that needs to be running to manage Bluetooth leds to to believe they simply kill all applications (including the UI) and most services and leave the kernel and a few other things running. I might be wrong, but I would like to see some clarification on that.

    • refalo@programming.dev
      4·
      7 个月前

      Not completely. My understanding is that the baseband radio still always runs even when the application OS is shutdown, and it (often) has its own connections to the GPS, camera and microphone, sometimes even the filesystem (Samsung RFS). The battery not being removable makes this even more problematic IMO.

  • kratoz29@lemm.eeEnglish
    51·
    7 个月前

    I guess the recommendation of turning off the Bluetooth to save battery, or the sarcastic comment that usually says “bro, just turn off the phone if you care too much about the battery” are gonna be obsolete now aren’t they?