I read the new location tracking complaint against Google filed by three state AGs and DC. It shouldn’t be surprising to anyone who is familiar with Google, but it’s pretty detailed. Thread. 1/
The basic allegation is that Google (mainly via Android) made it extremely difficult to turn off location data collection, and when people *did* try to turn this off, Google still collected and used location data for advertising.
As described in the complaint, there are basically three ways Google can get your location. (1) via GPS, (2) by monitoring nearby WiFi networks, (3) through IP address. Even if you turn GPS off, Google uses some of these. 2/
Once Google has your location information, the question is whether the user can stop them from recording it. As of 2018, Google seemed to make this possible through a Location History account setting. 3/
The Location History setting was described as “let[ting] Google save your location.” Presumably to ordinary non-technical users this language was about as clear as things get. According to the complaint, however, Google saved your location regardless of the setting. 4/
Specifically, Google has another “Web & App Activity” setting that also lets Google save your location. Because why have one setting when you can have many confusing ones? 5/
A brief interlude here to see what Google employees thought of these options. “[F]eels like it is designed to make things possible, but difficult enough that people won’t figure it out” is a solid quote. 6/
The complaint has a long section on “dark patterns” and this reads like a syllabus in a course on Silicon Valley privacy invasion. 7/
All the typical stuff: (1) presenting users with complicated opt-ins once at setup; (2) repeatedly “nudging” people who opt-out; (3) rewording dialog boxes to be less specific and maximize engagement; (4) hinting that apps “need” location history to work. It goes on. 8/
The one area where I felt j needed more detail was around the scanning of Wi-Fi networks. Even if you turn off GPS, companies like Google can determine your location by seeing nearby Wi-Fi. The complaint hints that Google does these even when you disable location. 9/
In fact, from context it feels like a lot of the redacted text in this document is about Wi-Fi geolocation. I hope future amended complaints get into the details. 10/
Final note: how did Google management feel about all of this? Was it all a big misunderstanding caused by good people trying hard not to be evil? Judge for yourself. 11/11 fin.
Here is the complaint so you can read for yourself. It’s only about 20 pages long. cdn.vox-cdn.com/uploads/chorus…

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Matthew Green

Matthew Green Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @matthew_d_green

Jan 21
I don’t know what’s going on at Twitter. When CISOs leave social media companies unexpectedly it can mean all sorts of unpleasant things. nytimes.com/2022/01/21/tec…
On the other hand if @LeaKissner is interim CISO then there can’t be anything too weird going on.
(For those who don’t know the history here, it’s Alex Stamos vs Yahoo (2015) & Alex Stamos vs. Facebook (2018) arstechnica.com/tech-policy/20…
Read 4 tweets
Jan 17
This is not an experiment I’m super excited to do on my own hardware (plus I don’t have a Chinese payment method.) Has anyone tried changing their Apple account to “mainland China” on the iCloud website to see what happens to data flows on their devices? ImageImage
My question is: what warnings do you get on-device before it starts uploading your data to Guizhou? I hope someone is/has moved to China recently and is willing to try this for me.
What can I offer people to do this experiment for me? Happy to offer all the RTs in the world and I’ll even scrape up a tiny bounty if someone is willing.
Read 5 tweets
Jan 16
Although Facebook is the primary target of this pressure campaign, it’s hard not to notice how closely Apple’s client-side scanning announcement fits with the UK government’s desires.
Don’t listen to anyone who tells you “they’ll never give in to government pressure” when it’s obvious they already are.
Read 7 tweets
Jan 14
I wrote up some notes on my skim through MetaMask’s crypto. Don’t worry, nothing scary in here. blog.cryptographyengineering.com/2022/01/14/an-…
Major surprise to me in reviewing this code is how immature the JS/Node/browser crypto ecosystem is in 2022. I wanted to say “just use <standard library>” but: what should that library be?
So instead of having proper well-maintained crypto libraries for securing all these assets, we have libraries from individual contributors. This is where OpenSSL was in 2000.
Read 7 tweets
Jan 12
I decided to look at MetaMask’s crypto, and oh wow I wish I could unlook.
To be clear I didn’t even make it to a lot of the core routines yet. Just hunting through piles of poorly-commented JS and *hoping* the particular GitHub repo I’m looking at is actually the right one.
Reached a point where I was in someone’s personal GitHub repo and I was like “I think this is the right code” but honestly I dunno.
Read 4 tweets
Jan 11
I am of the opinion that NFTs are going to be important. But I am also sympathetic to the take below. Don’t mistake *believing in the significance* of a technology for accepting and supporting all of its downsides.
One of the dumbest lessons I’ve learned in my career is that you should never disregard something that has hype behind it, even if you don’t think the tech makes sense.
Most “tech adoption” problems are really human coordination problems. Hype solves those. It doesn’t matter if you have a better solution, or that you think the proposed solution is stupid.
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(