Posted on 04/27/2023 4:33:37 AM PDT by FarCenter
Snapdragon giant and others insist alleged data gathering is overblown
ANALYSIS Cellphones using Qualcomm chipsets may transmit data sometimes classified as personal information, specifically IP addresses, back to Qualcomm. But where such transmission is occurring, it's not secret and it has been going on for years.
That doesn't mean, however, there's no privacy risk in Qualcomm-based phones or in devices with rival chip sets for individuals like journalists or human rights advocates with sophisticated adversaries. Such scenarios, however, are unusual and not much of a worry for most mobile phone users.
Recently, hardware security firm Nitrokey published an advisory claiming that "smartphones with Qualcomm chips secretly send personal data to Qualcomm" and do so "without user consent, unencrypted, and even when using a Google-free Android distribution."
Post author "Paul Privacy" found that a Sony Xperia XA2 smartphone with a Qualcomm Snapdragon 630 processor, running /e/OS, a version of Android stripped of Google services, started communicating with Izat Cloud over unprotected HTTP.
The post goes on to claim that Izat is part of Qualcomm's XTRA service. As Qualcomm explains on the izatcloud.net website, "the Qualcomm Location XTRA Service generates and provides accurate satellite positions for extended periods of time to a mobile device."
It's basically a way to make GPS more precise and reliable while reducing use of energy-intensive radio hardware. The Izat servers provide information about satellite positions, which Qualcomm-powered phones download over HTTP. Doing so reveals to the servers the public IP addresses of the phones plus, according to NitroKey, some device metadata. That's really what this all boils down to.
"Qualcomm’s proprietary firmware is not only downloading some files to our phone to help establish the GPS location faster, but also uploads our personal data, such as the devices’ unique ID, our country code (Germany in this case), our cellphone operator code (allowing identification of country and mobile operator), our operating system and version and a list of software on the device," as Nitrokey put it, arguing this supplied metadata amounts to a unique per-person signature that harms privacy and occurs even when GPS is turned off.
A Qualcomm spokesperson disputed the research. "The article is riddled with inaccuracies and appears to be motivated by the author’s desire to sell his product," a company spokesperson told The Register in an email. "Qualcomm only collects personal information when permitted by applicable law."
Here’s the truth about all RF producing devices, you cannot trust them. The only thing you could do is put them in a fair day bag, you may want to even double or triple bag them. Even if you remove the batteries from a device, there are many times backup batteries and capacitors on the board and stuff that continue to emit RF signals that can be tracked either locally or via the Internet. If you don’t need it on just put it in an RF bag.
Location services may be expected to determine the computing device IP addresses on both the local network and the wide area network . . . or attempt to get “close enough” to such IP addresses.
If you want privacy, then disable Location Servvices and remove the Map applications. (Will probably save some battery life.)
Google Maps is an amazing crowd sourced program that we almost can’t live without these days. The accuracy of the system depends on everyone’s phone reporting back personal location data regardless if they’re using the app or not. This is the basic argument for chips like these. But it comes at a price of your privacy.
And with the adoption of social media, we threw that out long ago…
“Qualcomm only collects personal information when permitted by applicable law.”
Cute non-answer.
“The only thing you could do is put them in a fair day bag..”
What if it’s an unfair day?
L
And I hate apps which won't run without it. That's just lazy programming to not allow the user a way to manually ever a location. I bought a remote read Bluetooth thermometer which needed location to be turned on to work. I sent it back and gave it a one star review because of it
Spelling corrections...tech hazard
So rest assured, as long as you’re not a threat to some unknown entity, you’re personal information and activity is probably relatively safe.
Not entirely accurate because many apps are communicating with their “mother ship”, and sending location data to feed the advertising beast that pays the way. Many free apps including games pay their way by getting the cellphone’s location and selling it to the behemoth that is electronic advertising.
The Faraday bag is a better option than trying to manipulate the phone into total RF silence.
Just funnin’ with ya.
L
"Qualcomm only collects personal information when ordered to by applicable government entities."
If you're running Android, you can buy yourself a bit of relief by rooting your phone and installing Android Firewall (dev.ukanth.ufirewall), and denying Internet access to EVERYTHING made by G**gle (or any other app you don't trust explicitly).
A 3rd party ROM, like Graphene or LineageOS (with MicroG) is a more complete solution but not without its pitfalls. I can tell you from experience that functions like battery life, wireless reception, etc, can suffer with these non-G**gle ROMS, but that's mostly a consideration if you're installing the ROM yourself. Less a problem if you buy a phone with a de-G**gled ROM already installed and customer service is included in the price.
Android Firewall is a no-brainer mod that's simple to make, but presumes your phone is root-able.
I agree that everything google is spyware. Google free android is probably better privacy than apple but just carrying the device still gives the phone company a lot of info if it is on. Google free android is probably less privacy invading than iphone.
Over the years I have used all of the no-google variants — LineageOS, CalyxOS and GrapheneOS.
Of all of them, Graphene is hardened and the most secure and only lets apps run in a sandbox environment. Graphene has better battery life than the stock android that has google because it is not sending your information to the google mothership 3600 times a day. Graphene only runs on google pixel devices. I have never had any compatability problems or issues with graphene. On a pixel, graphene has a webinstaller that is super easy to install.
CalyxOS can be installed on google pixel phones and a few others. It is a good alternative, but it is less secure than graphene because it uses MicroG to spoof the google signatures and still interacts with google’s servers.
Lineage works on a lot more devices, but is the least secure, because you have to run it with the bootloader unlocked, which I won’t do and this won’t pass the secure setting needed to use my bank app.
I have grapheneOS on my phone.
The only thing you could do is put them in a fair day bag, ....
bump
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.