2023-04-25 18:40 UTC
Replies (5)
-
@lanodan@queer.hacktivis.me 2023-04-25 18:53
@martijnbraam Wow, it's even worse than I thought…
-
@robin@digitalcourage.social 2023-04-25 19:10
@martijnbraam Using a supl-server for a-gps can leak your IMSI and the cell-id of the cellphone tower.[0] In combination this is very sensitive information. @GrapheneOS does support proxying supl-connections and removing sensitive information from your requests: https://grapheneos.social/@GrapheneOS/109960680764836371 [0] https://www.kuketz-blog.de/android-imsi-leaking-bei-gps-positionsbestimmung/
-
@kyle@social.librem.one 2023-04-25 19:13
@martijnbraam I appreciate your posting a follow-up and analysis of this post. I skimmed (and even boosted) that article this morning because I was curious about the claims and what would come of it after more eyeballs were on it.
-
@whynothugo@fosstodon.org 2023-04-25 21:19
@martijnbraam Thanks for writing this
-
@jmlich@fosstodon.org 2023-05-04 08:09
@martijnbraam You are saying "It does not contain any private data. It's just downloading an GPS almanac from Qualcomm for A-GPS.", but it seems that private data are sent via User-Agent. Screenshot is taken from https://forum.fairphone.com/t/telemetry-spyware-list-of-privacy-threats-on-fp3-android-9/55179/24 The pcap is attached as well. For me it is still not clear if latitude, longitude, and cell id are also attached.