Hacker News Reader

Comment by pravda | Hacker News Reader

A question for the Android experts: is it possible to block or spoof location data, through a custom build?

Could I have an Android phone running a program that spoofs a long steady drive from Tampa to Butte?

Yes, but that does not stop the cell providers from selling your location [1].

You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble [2].

[1] https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hu...

[2] https://www.nytimes.com/2020/01/22/technology/jeff-bezos-hac...

> You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble

The article also points to WhatsApp as the infection vector.

I agree that anything Facebook produces is fair game as far as being sketchy goes, but it’s not the only messaging platform to have been exploited.

Do we run all messaging services in independent sandboxes in VMs?

[2] says Bezos' iPhone was hacked via WhatsApp with the NSO Group-developed exploit. It is not possible to run iOS VM in the cloud, and even for Android it does not sound practical at all.

I had the option to spoof location data under "Developer options" in Settings with the original OnePlus ROM, but it's even easier to accomplish now that I'm running LineageOS.

In short, yes.

Yes, it’s very possible, I did similar work years ago patching functions on jail broken phones for seamless encryption.

Why bother spoofing when you can simply turn location permission off ?

Spoofing adds noise to the data, making it worth less.

If enough people do it in a way that cannot be easily detected, the market for this sort of data will shrink quickly.

I don't see how spoofing is better than blocking. If enough people block it, the market will shrink even faster. It's also much easier for people to block than "spoof". Spoofing seems practically pointless and academic compared to blocking.

On a custom ROM, sure. That's why games like Pokemon Go blocked them.

Using it as a daily driver is not advisable though.

At worst, having root should be the most that's required, which only on some phones requires a custom rom.

Android has built in support for location spoofing with the developer mode option, select mock location app.

Other apps can easily check whether the location comes from a mock source and discard such data.

https://developer.android.com/reference/android/location/Loc...

These type of security vulnerabilities are due to the core OS/APIs being developed by a surveillance company that isn't concerned with user privacy, and they're countless.

There isn't enough will in the Free world to mitigate even the most glaring ones either, such as LineageOS not incorporating the MicroG patches. The end result being more forks, more confusion, and groups of users remaining unprotected.

Commoditize your complements, indeed.

Reply on news.ycombinator.com