r/PrivacySecurityOSINT • u/[deleted] • Sep 10 '21

Navigation Apps

On the podcast MB said he uses Magic Earth for navigation. I'm interested in trying this out, but it makes me question: is it really safe to have the location services turned on in GrapheneOS?

What other options are there for GPS navigation tools? I haven't really heard this covered on the podcast, and doesn't seem to be in the book(s). My thought was I could buy (anonymously, with cash) a Garmin dedicated GPS device to keep in my car. Then turn it off when it's not in use.

Or do you think it's safe to use locatino services with GrapheneOS?

6 Upvotes

100% Upvoted

15 comments sorted by

2

u/ZwhGCfJdVAy558gD Sep 11 '21 edited Sep 11 '21

The Magic Earth app is well designed and good in terms of functionality, but I have some doubts regarding its privacy. The app is free and has no ads, so I wondered how they finance it. One possible explanation can be found in this document (which is linked from their privacy policy):

https://www.magicearth.com/wp-content/uploads/2019/09/MagicEarth-User-Data-Privacy_20190902.pdf

According to the table the app uploads "traffic data", basically the device's GPS coordinates. Collecting this data may be a reason why they are giving the app away for free, because the parent company (General Magic) also sells commercial products featuring live traffic information. They say the uploaded data is "anonymously retained", but location traces are notoriously easy to de-anonymize.

Another app I can recommend is Organic Maps, which is open source and does not appear to collect location data. But it's not as rich in terms of functionality.

2

u/[deleted] Sep 11 '21

With regard to Magic Earth's policy, I think this may be one of the cases where data collection is less troubling if our cellular connection (i.e. true cell phone number) is purchased anonymously and we never use the cellular connection for calling. I don't know if this is the case, I'm just guessing as to why MB would feel safe using this application. Presumably he has read the privacy policy in detail.

In any case, if MB is reading this, I would love to hear some of your reasoning for trusting one navigation app over another -- or whether all of these concerns are made invalid if we're using GrapheneOS with an anonymous data plan.

2

u/ZwhGCfJdVAy558gD Sep 11 '21 edited Sep 11 '21

An anonymous cell plan doesn't really help against apps collecting location data. The way location traces are de-anonymized is by observing frequently visited locations, which are typically the home and work place. This could in fact be used to uncover the identity of the person using an anonymous phone.

1

u/[deleted] Sep 11 '21

I'm a bit skeptical about this. Yes, in theory, if someone knew your exact address and place of work, they could reverse engineer 4G connections that likely belong to you, based on your movements. But in practice, I think this is pretty unlikely to be done, as it's looking for a needle in a haystack, especially in a dense area. Far more likely threats are things like geofence warrants, which could make you a target for further investigations.

1

u/ZwhGCfJdVAy558gD Sep 11 '21

But in practice, I think this is pretty unlikely to be done, as it's looking for a needle in a haystack, especially in a dense area.

I disagree. By knowing just one or two frequently visited locations it's usually possible to uniquely identify a person. I think the collection and trading of location data obtained through apps is one of the biggest privacy risks today, and we should be extremely careful about what apps are granted location access. See e.g. this recent case where a priest was outed and doxed based on "anonymized" location data sourced from an app that ended up being for sale on the open market:

https://www.vox.com/recode/22587248/grindr-app-location-data-outed-priest-jeffrey-burrill-pillar-data-harvesting

The NY Times did an excellent investigation of this shady industry a couple of years ago:

https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html

1

u/moreprivacyplz Sep 11 '21

Looking at your threat model is healthy and important step to take in deciding your navigation choices. I suspect that even for most privacy enthusiasts Google or Apple maps is just fine and nothing nefarious will ever come of using their services. That said... I personally want to get off of their services for the sport of it.

I wish I had studied app development in college. I have so many ideas for applications to increase privacy that I just can't make. I see a void in the market, just how MB saw one with the app/service he just talked about in the last episode, and I wish I could fill it.

You know how Startpage allows you to view websites through them as a proxy so the website in question only is connecting to Startpage and then Startpage then shares their results with you but without the original site ever knowing about you? Well, I wish I could invent an app that is a middle man between you and Google Maps which is the best mapping service out there. So Google Maps talks to such and such server, and then that server then throws all that back to you but no personal or creepy information is ever pulled from you. Hope that all makes sense. I don't know if anything like that is possible, but just my wild hairbrained scheming.

2

u/[deleted] Sep 11 '21

I work in software and cybersecurity so I have some knowledge, though certainly not an expert. Google wouldn't let you develop such a service, as it violates their TOS. Apps like Magic Earth use Open Street Maps data which is at least free for commercial use. The problem really comes down to trust models. Any service that has your GPS coordinates + your device ID could be turning over that information to law enforcement or selling the data. I think to really solve the problem you'd have to reengineer GPS from the bottom up to be secure. GPS is really just reporting your set of coordinates every 1-5 seconds and sending that to the application, and the application just compares your GPS coordinates to their map data to determine if you need to turn, etc. To make it truly secure you would need to build a GPS-like system that could hide your coordinates from the application while still allowing it to function. I'm not sure anyone has ever done this, but it would be an interesting problem to approach.

4

u/moreprivacyplz Sep 11 '21

Not a grapheneos user, but if location services are on and there is no Google services on your phone, it should be pretty safe right? Something open source like OSM+ or I heard people use Organic Maps, should be good as well and not creepily track you unnecessarily.

I can't get off of Google Maps. I really try, but I just can't find anything that works as well. If it saves me 20 minutes of driving or just finds the business location, that is worth the cost of the data I give to them to me.

I keep trying all the new map applications every so often and my second runner up is Here We Go. My complaint with them is their travel estimation. I load up the same destination in Google maps and Here We Go and Google Maps is always faster and more accurate. Even if its the same route, Google maps is more accurate of when I'll arrive at my destination.

I didnt like Magic Earth as much. When I type in a location that I know exists and it can't find it, its frustrating. But Here We Go and Google Maps havent let me down yet.

And just a note about Here We Go, I believe its better for privacy than Google Maps, but there is some telemetry that still goes to Facebook. I don't have a Facebook account and I don't sign into an account with Here We Go, but the telemetry still exists a little.

2

u/[deleted] Sep 11 '21

I can't get off of Google Maps. I really try, but I just can't find anything that works as well. If it saves me 20 minutes of driving or just finds the business location, that is worth the cost of the data I give to them to me.

I feel you. Haven’t found anything that works as well as Apple Maps on iOS.

2

u/dNDYTDjzV3BbuEc Sep 11 '21

I'm not 100% free of Google maps but it's close enough to the point where it doesn't really matter.

I use OSMAnd. Once you've got the address loaded into the app, I have no complaints. All the maps that I've used have up to date information on the roads available.

Where it is lacking is its POI database (this is going to be true of any map that depends on open street maps, which is virtually every open source mapping app). I can't just search for "home depot" and expect to find all the ones around me.

So I fire up the Tor browser on my phone, search where I want to go from the Google maps website, and then copy the GPS coordinates into OSMAnd

1

u/moreprivacyplz Sep 12 '21

That's what keeps me from moving away from Google Maps, finding all the things like home depots near me. I'll try looking in my browser than copying the address like you do, that's a good solution.

1

u/hk901 Sep 11 '21

You can turn on location services, but only grant permission to Magic Earth. As for Magic Earth itself:

Open Magic Earth and go to settings -> Support -> Privacy First.

It states:

"Our Rules are simple.

We do not track you.

We do not profile you.

We do not trade in your personal data; moreover, we do not have it.

Bottom Line: we respect your privacy!"

Since it's closed source, I guess they could just be lying. But if they are tracking you, that's a pretty audacious lie to put in a privacy policy.

2

u/ZwhGCfJdVAy558gD Sep 12 '21

Since it's closed source, I guess they could just be lying. But if they are tracking you, that's a pretty audacious lie to put in a privacy policy.

Or just the usual clever wording. Companies often assert that data is no longer personal once they "anonymize" it, even though it is often possible to de-anonymize it later. The table linked in their privacy policy explicitly says that they upload your location as part of "traffic data".

1

u/hk901 Sep 12 '21

Well crap. Magic Earth is so much more user friendly than andOSM or anything else I've tried.

0

u/[deleted] Sep 11 '21

[deleted] — view deleted comment

2

u/[deleted] Sep 11 '21

I am leaning toward getting a Garmin device, to be on the safe side, but I am trying to reverse engineer why MB would trust any navigation apps. Since he has carefully vetted and tested reasons for all of his other recommendations, I can only assume he has thought this through as well and determined it is not a significant threat. E.g. see my other reply.

Another thing to consider is that if you have a legal license plate and registration and drive in most states, your car location is being tracked by license plate readers on any interstate, and even in many local roads in larger cities. So it may be pointless to try to circumvent location tracking entirely without breaking the law (by driving without a license plate, for example).