Everyone knows your location: tracking myself down through in-app ads

Is WiFi access point geolocation by SSID or MAC address? Do mobile OS's require additional permissions for apps to get either of these data points?

>Do mobile OS's require additional permissions for apps to get either of these data points?

Yes on both iOS and Android as far as I can remember.

iOS definitely requires Precise location permission allowed for the app to see your WiFi name / ssid and other WiFi around you

Android for sure, since version 8 I'm certain but probably even 5 or 4.x (so 10+ years ago)

Always annoys me when I want to use a WiFi scanner to determine the range of an access point in different locations for example and it needs me to turn on location access first before it can get WiFi data. The open source app doesn't have an Internet connection so there's no way for it to send back data to the mothership even if it had an SSID database baked into the apk. For me, and traditionally, the location switch is to turn on or off energy-hungry GPS hardware, not gatekeep when I trust apps to collect my location. I can set those to "only while in use", deny their Internet access, or just not install them if I don't trust them with the location permission

But all it takes is one app with that permission to tie you to all the others. And there are always apps that need your location at some point to provide useful data. At this point I’m not sure there’s any single app I trust.

On iOS at least you can set the MAC address to be different per access point or to rotate on the same access point or to use your normal MAC

> apps that need your location

And, triangulating client's public IP address will also give away location with decent precision: https://news.ycombinator.com/item?id=37507355

btw, we need a securephones.io [0] part 2 focusing on apps.

[0] cert has expired