Hacker News Reader

Comment by rnk | Hacker News Reader

The saluspa from "bestway" demands your location before allowing you to setup wifi remote control of the portable hot tub on the android app. I wonder how on android I can spoof the location used by an app, or if anyone figured out if you can control it without the app.

I set it up away from my house and use a separate wifi network but it pissed me off.

View on HN

Android apps used to need "location" access for bluetooth discovery. https://www.androidpolice.com/2021/05/19/android-12-apps-won...

Because your location can be inferred by finding which Bluetooth devices are around you, as that article says...

> See, back in Android 6 Marshmallow, Google changed things so that apps needed location permissions to scan for Bluetooth devices. At the time, the rationale was that Bluetooth was going to be used for things like interior navigation or location tracking in a more abstract sense, and your location could indirectly be inferred via Bluetooth scanning alone if a given hardware identifier was tied to a specific location.

I have always assumed that is a way for Google to normalize granting the position permission.

You could "pair" apps with devices if Bluetooth position spyware was a concern.

Before Android required that permission, there were marketing companies selling malls the ability to see who was around by the ID of their Bluetooth beacon.

But pairing work well without the app involved, we could just give a permission to a specific already-paired devices and keep location for apps that actually need to scan.

Again - That still sends out a beacon. Searching for already-paired bluetooth devices still sends a bluetooth frame with your bluetooth MAC address, (which has to be consistent, because that's how bluetooth devices identify each other).

> Searching for already-paired bluetooth devices still sends a bluetooth frame with your bluetooth MAC address, (which has to be consistent, because that's how bluetooth devices identify each other).

It doesn't have to be readable by third parties. Given that the devices are already paired, it's perfectly feasible for that frame to be encrypted gibberish that only the other device can understand.

I think that the math of battery life if you had to decrypt anything that looked like a handshake packet to see if it's for you is the opposite of feasible.

The other poster already explained the old permission. There's also a new permission specifically for Bluetooth LE now as well for newer devices so location shouldn't be needed.

However, scanning and connecting to Wi-Fi IoT devices still requires it.

No it doesn't, there's a whole API for last few years where app can connect to its own IoT device without getting location or full scanning grant.

Why do you think that? I literally just wrote an app to do this. From my notes:

> Android 13 still requires `ACCESS_FINE_LOCATION` to call `startScan()` and `getScanResults()` - `NEARBY_WIFI_DEVICES` is not sufficient

See here: https://developer.android.com/reference/android/net/wifi/Wif...()

I tried getting by without it, but it was required.

That poster I assume is referring to this for your own devices. https://developer.android.com/guide/topics/connectivity/comp....

Depends on the specific use case but you ideally shouldn't need those calls. Our app request both the old location permission and the new nearby permission just because not all of our vendors keep their libraries up to date and its not unreasonable for the app to know where you are when using those features.

Thank you! I will give this a try.

The APIs to connect to IoT devices is called CompanionDeviceManager - https://developer.android.com/guide/topics/connectivity/comp...

Wow, thanks for that. I will have to try this. It is annoying that it is hidden under the Bluetooth breadcrumbs.

Yeah, the WiFi part seems a bit like an afterthought.

I tried to use Fanduel last night to place some bets for my friend in prison. It requires your location. You have to install some horrible app that installs a Windows Service and has no UI. It still won't work.

After a lot of digging around, I discovered you cannot use Fanduel if you have a wired device. The app _requires_ you to connect to your router by Wifi or it will not work. WTF.

I wonder if their terms of service states claims to give them permission to distribute malware or if they think they won't get caught.

Maybe it's for compliance reasons? in other words they really want to know you're in a jurisdiction that allows gambling, and not using a VPN or whatever.

That's exactly what it's for, but historically these sites would just do an IP check at the server, not install some horrible malware on your PC and then tell you an ethernet connection is evil.

The 4 outlet water timer I bought came with bluetooth remote functionality. It needs GPS location data for it to work. Nope. Should have known some shit like that would be part of the deal, and could have saved a few bucks by getting the version without remote.

People need to just stop with this tracking bullshit.

In fairness, some of those pull precipitation, heat and transpiration info from weather reports.

It still shouldn’t require it though. At least on iOS, requiring it should get them banned from the app store.

I want side loading to exist for iOS, but I also want bans like the above to apply at my discretion to anything I pay money for.

anyone making a "smart" water timer using today's weather forecasting would be something that could be called "The Plant Killer". my area can say that there's 80% chance of rain, yet not one drop can fall where I am while other areas can say they received .25" of rain. sounds like watering isn't necessary. oops. dead plants. There's other times where no weather is forecast, yet I've received .25" of rain. oops. wasted water. also, your "smart" decision to not water because of rain means all of the plants on my patio didn't get watered while I was on vacation/work trip/etc, which is the primary reason I bought the timer in the first place.

Your smart is dumb. Just turn the water on at the time I said. That's plenty smart for me. If I can update the schedule from my couch, great! But...not at the expense of all of this tracking bullshit

Bluetooth permission implies location permission since you can use Bluetooth beacons to find your location.

This could be a overly cautious legal requirement. I know heaters(dyson) won't allow you to control heat remotely in some locations, so instead of yanking out hot water from the app, they decide to ask your location to verify you're home.

I would have returned it for a refund, personally.

Reply on news.ycombinator.com