[epukaza]

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

[unglaublich]

With the proper permission set (neverForLocation), the OS shouldn't ask for geo-location permission. So the app seems malconfigured, or it's actually doing something with the Bluetooth beacons that it can't do otherwise.

https://developer.android.com/guide/topics/connectivity/blue...

[xyzzy123]

That permission is pretty new, so the app might not have been updated for it.

[gene91]

What you said sounds plausible and I believe it.

Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

[dlsa]

Trust is earnt. I can reasonably have a default level of low trust for practically any app. This isn’t some blind anger stance. Its not blanket mistrust or some kind of ignorance. It is healthy scepticism. Totally reasonable in today's environment.

Plenty of app developers have muddied the water enough that apps should have a lower level of trust given to them. Stealing data is a reasonable fear now. It is not reasonable to assert otherwise.

It is therefore reasonable for a person to wonder why geolocation is requested but then be suspicious why it doesn't seem to need it. Regardless of the underlying technical reason. Those technical reasons are part of informed consent. If I don't have informed consent, do I really have consent?

Its also not a sad state at all. Its healthy. Its part of the modern landscape that someone can be suspicious and rightly so. If not, you're setting people up for misfortune. Is there some reason you want people to blindly trust like this? That seems almost abusive to me.

[wakeupcall]

I don't know about others, but thanks to a combination of protocols, google and law-enforcement my trust on phones and anything connected to it is basically zero, despite being quite secure on a technical level.

[Schroedingersat]

> Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

This is almost all apps. Your default assumption should be that anything on the big app stores is being as malicious as they can get away with -- especially if it is a forced install leveraging some product you have already purchased that could easily be sent over a standard protocol.

[hansvm]

The Canon printer configuration app has the same sort of soft geo-permission lock. Sniff the network traffic right as you enable it, and you'll see your data happily find its way to their servers.

_Maybe_ the app is fine, but in the cases I've checked big corporations abusing your privacy is the norm.

[mrjin]

Trust is earned not granted. You don't trust a random stranger walks by, why should anyone trust apps created by some random organizations? Especially given some calculator and similar apps came with a privacy statement, how much trust do you believe we should have in apps on our phones?

[Sakos]

It's sad that so many apps can't be trusted, leading to a lack of trust in apps in general. But that's not our problem.

[chias]

I could not agree more.

[chias]

Ah, that would make sense. It is indeed a bluetooth connection and it scans for any nearby devices. Thank you for clarifying that, I appreciate it, and I feel a lot better about the app!

[tlavoie]

Can you tell if that's all it does? I don't know what all geolocation covers in Android terms, but it would certainly be a superset of just scanning for BlueTooth.

I would be curious if it does any or all of:

- Fetching GPS coordinates, which are typically to many decimal places. - Making API requests to external servers that you don't own.

A tool like MobSF (https://mobsf.github.io) might be very enlightening to understand what a given app does, or at least can do. I've tinkered a bit with an iOS app in it, but not Android so far.

Also, proxying your device through Burp Suite or ZAP could also be interesting to see what traffic occurs, especially if the developers weren't picky about valid TLS certificates.

[nybble41]

> The app needs the geolocation permission to access the bluetooth radio and scan for devices.

Sure, but why does the app need to be able to scan for any and all Bluetooth devices? There should be an entry in the manifest describing the kind(s) of devices the app wants to interact with, and only those devices should appear in the scan. Naturally the list would need to be reviewed to verify that the selected devices are related to the app, and presented to the user in the app store along with all other requested permissions.

In this particular case the same company designed both the app and the device it's connecting to, so for all we know the device could have an embedded GPS receiver to provide the app with much more detailed location information than it could get from Bluetooth alone. It could also just relay its own Bluetooth scan results. However, the app at least couldn't easily get location data from Bluetooth scans when the device isn't in range.

[MrDresden]

This permission structure has now been split up in latest versions of Android to avoid this kinds of confusion.