[xapata]

Note that carrying a smartphone and using a credit card is entrusting a great deal of information to advertising companies. All major phone and credit companies are selling your data (anonymized, to the degree they feel is optimal). I'm not sure that Facebook is any worse.

To be more clear: They know where you go, who you call and text, and what you buy.

[graeme]

Even on iphone with content blockers running and location services disabled for most apps except while using?

Referring to ad companies here, not NSA etc

[jacquesm]

Yep. Unless you disable your WiFi and only use a VPN while you are connecting to the web via your phone.

[bigiain]

Even that doesn't solve the problem...

https://www.tomsguide.com/us/FCC-Mobile-Devices-iPhone-Andro...

"Devices that are not GPS-enabled must be tracked via triangulation with local cellular towers, a time consuming process that can only give an approximate location and can dangerously delay critical assistance. The new regulation will allow almost universal pinpoint location of 911 callers by emergency responders. No date was given for when non-GPS enabled devices must be discontinued, but given FCC estimates that by 2018, 75 percent of all mobile devices will be GPS capable, it is likely that the assumption is the sunsetting of obsolete devices will occur naturally as consumers chuck outdated gadgets for shiny new ones."

I'm really curious to know whether this means my iPhone will give up my GPS location against my preference setting if I call 911, or if it means the carriers are going to be required to improve non-gps derived location data from cell towers to "allow almost universal pinpoint location of 911 callers by emergency responders"...

[jacquesm]

True, but that's something your cell provider (and the providers of other base stations your phone has pinged) has access to, not your typical website.

But you are 100% correct that the cell network knows to within a rough approximation where you are and how fast you travel. This information is also used to predict where and when the next cell-hand-off will happen.

[bigiain]

Yep - as always in security, it's important to know who your adversary is.

If your adversary is the NSA(/GRU/Mossad/etc) - you're fucked. Throw away all your electronic devices, torch your house, and hope you make it to Belize before they shut the borders to you.

If your adversary is Law Enforcement, they'll get cell tower data (quite likely without a warrant by just asking), and they'll then mislead a court and jury about how accurate that data is: https://www.newyorker.com/news/news-desk/what-your-cell-phon...

This link: http://urgentcomm.com/psap/different-strokes says that since '05 wireless carriers in The US have been required to do better than just "which cell tower you're connected to", but for some percentage of connections they're required to provide 50 or 150m location accuracy - which they can apparently do using three cell towers and triangulation. Since they're happy to hand over cell tower data to law enforcement when asked (or possibly when asked with a warrant) - I wouldn't bet against then handing this E911 Phase 2 level of location accuracy over.

Somewhat more worryingly... The cell providers seem to be happily monetising that data too: https://techcrunch.com/2017/10/15/mobile-phone-companies-app... https://www.theverge.com/2013/4/9/4187654/how-carriers-sell-...

Now out of the four big technology companies - two of them own a mobile OS and so can do whatever-the-fuck they want with your phone if you're "in their camp" and of the remaining two, one of them actually sells you stuff to make a living, the other makes their money by surveilling you.

With Facebook's warchest - what do you reckon the chances are of them _not_ buying cellphone location data on the open market to add to their advertising-marketing machine?

I'm not saying I know they are - but I do know that the data about location down to perhaps 50m accuracy or less is legally required to be available to the cell operators - and they've been caught in the past selling that data - and Facebook have _very_ deep pockets to pay for data to match against theirs. (And there is almost _zero_ chance that whatever the cell companies might to to "anonymise" that cell location data, Facebook wouldn't be able to de-anonymise it by correlating to to other data they collect.)

But yeah, having your phone use a VPN no doubt helps...

[jacquesm]

> With Facebook's warchest - what do you reckon the chances are of them _not_ buying cellphone location data on the open market to add to their advertising-marketing machine?

I don't think they would have to pay for it. They're just going to give the phone company a nice fat discount on their advertising campaign. That way they don't have to own up to selling your data either, win/win. /s

Mobile phone location data is so valuable that there are whole companies dedicated to 'enriching' mobile phone OpenRTB requests with location data.

https://www.iab.com/guidelines/real-time-bidding-rtb-project...

[graeme]

So the ISP/wifi network owner sells it to advertisers? Or the advertisers are able to get it from browser data they collect even when trackers are blocked?

[hueving]

How does wifi impact it if location services are disabled? Or are you referring to apps that have permissions to list wireless networks?

[jacquesm]

You can safely assume the GPS coordinates of just about every WiFi egress IP address to be known.

[hueving]

Oh, I see. You're referring to even using the connection.

[xapata]

Your phone carrier still triangulates your location from cell towers you're connected to. It's not as accurate as GPS, but is good enough for many purposes, except in places as dense as NYC.

And don't tell me you're cash-only.