Mastodawn

Greg Slepak Jan 31

@GrapheneOS Are Pixel devices running GOS vulnerable to this GNSS baseband processor tracking?
https://an.dywa.ng/carrier-gnss.html

Mobile carriers can get your GPS location

In iOS 26.3, Apple introduced a new privacy feature which limits “precise location” data made available to cellular networks via cell towers. The feature is only available to devices with Apple’s in-house modem introduced in 2025. The announcement1 says https://support.apple.com/en-us/126101 ↩

an.dy wa.ng

GrapheneOS Jan 31

@taoeffect No, but this article isn't accurate in general.

@GrapheneOS @taoeffect
What specifically is inaccurate? How does GrapheneOS mitigate this?

GrapheneOS Feb 4

@jksc @taoeffect We're not talking about GrapheneOS specifically. The article is inaccurate about how this works in general including for iOS. This is an example of someone being aware of certain things existing and then making a whole bunch of assumptions about it which they're communicating as fact. It's the responsibility of the person making these claims to provide evidence. The article is open about the fact that they're not familiar with how it actually works in practice and are assuming.

GrapheneOS Feb 4

@jksc @taoeffect

> A major caveat is that I don’t know if RRLP and LPP are the exact techniques, and the only techniques, used by DEA, Shin Bet, and possibly others to collect GNSS data; there could be other protocols or backdoors we’re not privy to.

You should not be basing your understanding on an article written by someone making assumptions about how things work without knowing how things are actually implemented. They're claiming the changes made by Apple aren't useful without evidence.

@GrapheneOS @taoeffect To be clear, you have answered "No" to the question "Are Pixel devices running GOS vulnerable to this GNSS baseband processor tracking?"

How does the operating system mitigate Control Plane LCS for all modems running on Pixel devices? Is this even publicly documented anywhere?

I'm fine with the article cited being inaccurate, but it's unclear on what you're basing your answer that GOS Pixels "are not vulnerable".

GrapheneOS Feb 4

@jksc @taoeffect

> To be clear, you have answered "No" to the question "Are Pixel devices running GOS vulnerable to this GNSS baseband processor tracking?"

Correct.

> How does the operating system mitigate Control Plane LCS for all modems running on Pixel devices? Is this even publicly documented anywhere?

Location detection based on the cellular connection itself can only be avoided with airplane mode. Apple hasn't changed that for iPhones, they're only trying to reduce the precision.

GrapheneOS Feb 4

@jksc @taoeffect

> I'm fine with the article cited being inaccurate, but it's unclear on what you're basing your answer that GOS Pixels "are not vulnerable".

The cellular radio has no direct connection to GNSS on Pixels and doesn't control it. It's the operating system implementing support for providing supplementary location data to the cellular radio for E911 support. Many regions including Europe don't use E911 in the first place but rather a different standard not implemented by AOSP.

GrapheneOS Feb 4

@jksc @taoeffect We don't yet have an answer to how it works on Snapdragon where GNSS and cellular are both implemented by the SoC but we'll get that information as part of our OEM partnership and can set things up differently if there's any reason to do that. SUPL and other integration between GNSS and cellular is performed by the OS on Pixels. Apple decides how this works for iPhones as shown by these recent changes. We don't think assuming Apple doesn't know what they're doing makes sense...

Val Packett 🧉Feb 5

@GrapheneOS @jksc @taoeffect maybe how specifically responding to those requests works is not widely known… but at least it's very much known that GNSS is part of the modem. Support for talking to it has been implemented in FOSS projects like ModemManager.

https://wiki.postmarketos.org/wiki/GPS

At least in normal operation the OS has to specifically enable GNSS on the modem (and can load assistance data for AGPS). Now the interesting question is whether the firmware would forcibly enable GNSS at the network's request for "emergency reasons"… We don't have proof, but it's definitely not impossible either.

GPS - postmarketOS Wiki

GrapheneOS Feb 5

@valpackett @jksc @taoeffect

> maybe how specifically responding to those requests works is not widely known

No, the information in the post is wrong.

> but at least it's very much known that GNSS is part of the modem

No, that's incorrect. Every Pixel model from 6th through 10th generation has a separate GNSS chip. Qualcomm includes GNSS with their cellular radios but that does not mean it does what the post claims. You're making an incorrect assumption without the full information.

GrapheneOS Feb 5

@valpackett @jksc @taoeffect

> Support for talking to it has been implemented in FOSS projects like ModemManager.

That's not how it's implemented in the Android Open Source Project where GNSS has separate hardware abstraction layers and services.

Qualcomm choosing to implement GNSS and on non-low-end platforms also Wi-Fi and Bluetooth with the same baseband processor doesn't mean that's how it's done everywhere. There's no inherent reason it has to be done together and it's not on Pixels.

GrapheneOS Feb 5

@valpackett @jksc @taoeffect

> Now the interesting question is whether the firmware would forcibly enable GNSS at the network's request for "emergency reasons"… We don't have proof, but it's definitely not impossible either.

It's not a black box but rather largely unobfuscated firmware which can be reviewed and understood. It's wrong to post speculation as fact and lead people to believe something is the case which isn't. It's also wrong to conflate every platform as working the same way.

Val Packett 🧉Feb 5

@GrapheneOS @jksc @taoeffect why did you think I was talking about Pixels when I replied specifically to the toot about Qualcomm?

GrapheneOS Feb 6

@valpackett @jksc @taoeffect The blog post was about iPhones and our response was primarily about Pixels. The post you replied to wasn't only about Snapdragon. The claims made in the blog post are very broad and unsubstantiated. We know those claims are inaccurate for Pixels where GNSS is implement as a separate chip and the OS handles features like SUPL. Snapdragon having cellular, Wi-Fi, Bluetooth and GNSS as isolated components with one baseband doesn't mean that the claims are true for it.

Andromxda 🇺🇦🇵🇸🇹🇼Feb 5

@GrapheneOS Will GrapheneOS implement ETSI TS 103 625 support?