Libretube recommends local videos

ProfessorMonks

Use www.dnsleaktest.com extended test to see whether you have any leaks - if you do; this could be the explanation.

Wander12345

So the discord community helped me in figuring out that turning on airplane mode stopped the leaking of my location.

Which is wild since I don't even have a SIM on this device.

It was leaking my location probably through this code:

"private fun detectNetworkCountry(context: Context): String? {
return context.getSystemService<TelephonyManager>()?.networkCountryIso?.ifEmpty { null }"

Issue solved. Never using Libretube again.

Why on earth would they try so hard to get your location?

Bimmy

Wander12345

That's interesting. Assuming this is the true reason it indeed gives me a somewhat uneasy feeling.

Do you know if this is a check that any app is allowed to do?
Is there some control / permission to prevent this?

r134a

Wander12345 Why on earth would they try so hard to get your location?

It isn't really that hard if u see the code, just this one line returns a country code if u are connected to a mobile network, or nothing while in airplane mode.:

return context.getSystemService<TelephonyManager>()?.networkCountryIso?.ifEmpty { null }

Wander12345 Which is wild since I don't even have a SIM on this device.

To be honest i didn't know aswell that the country code could be obtained without a sim till now. Means in theory every app could obtain your country relatively easy when not in airplane mode.
I don't know if this is possible but an option to spoof that country code if (selected) apps request this would be nice indeed.

Wander12345 Issue solved. Never using Libretube again.

If u weren't using a vpn or didn't proxy through a piped instance, u were going to make connections to youtube anyway with your public ip to watch videos, so the several request to populate your feed wouldn't really have changed much on that regard i guess.

If u were using a vpn, maybe indeed the several request to populate your feed with videos related to your country could be 'problematic'.

Maybe someone more knowledgable might correct me here, my observations might be wrong.

de0u

Bimmy Do you know if this is a check that any app is allowed to do?

"Network country code" appears in the GrapheneOS FAQ.

Bimmy

de0u

Dang, you're right! Probably read it relatively long time ago but might not have realized the full consequences.

Really, I find it rather hefty, that any ordinary app can use few lines of code to easily find out in which country (i.e. country code of mobile network) the device is in - without any ways to suppress it besides staying in Airplane mode 100% of the time the app is active.

This also puts the capabilities of VPNs or even Onion-routing in pespective, considerably.

de0u

Bimmy I find it rather hefty, that any ordinary app can use few lines of code to easily find out in which country (i.e. country code of mobile network) the device is in - without any ways to suppress it besides staying in Airplane mode 100% of the time the app is active.

I suspect the thinking on the point of the Android developers is that there are many millions of people around the world for whom English is not very convenient, who find it useful for a newly installed app to operate in a language that is more convenient than English -- or at least to offer a small selection of plausible languages instead of a list of thousands.

In the other direction, most countries contain millions of people, so leaking a country by itself is not a giant entropy reduction.

Fay_Wilmont

I guess country isn't usually thought of as a private thing in the context of Android. It can reasonably be deduced from an internet facing IP address in most cases, and even without the device being connected to anything (yes, without airplane mode you're always connected to a network in order to be able to contact emergency services), the timezone, language and regional settings will in most cases give it away. Probably other things, like maybe an app can see what keyboard language you're using without any special permissions. Smartphones just aren't a good match for privacy conscious individuals.

Still an unpleasant surprise if you've done everything you can to keep apps in the dark about your country, and apps can still obtain this information through the reported network operator (I was surprised too). Could be something for GrapheneOS to take a look at and link to the location permission or something...

@Wander12345 There was probably no malicious intent from the creators of LibreTube, as they seem to aspire to be an app for the privacy conscious. If I were you, I would open an issue about it on their issue tracker to raise awareness.

Bimmy

You are both right.

The thing is: There are explicit configurations regarding language that would allow an App to find out - but with the user in control and in a direct and open manner. In contrast, an indirect approach that effectively bypasses all country and locale settings etc. to derive the info from the mobile radio appears somewhat sneaky to me.

It think it's this broken transparency plus ignorance of user's preferences what gives me that uneasy feeling.

Ghet

This is great information. I wish it was displayed more prominently in the FAQ that apps can access time zone, country code, and language without any permissions being granted. It's in there, but it's easy to miss.

trashaccount

Libretube leaks your country code to youtube unless you tuen off your sim/enable airplane mode.
Great "feature". I don't know why it still does it. I would have assumed people complained.

Probably9857

trashaccount

It probably improves the user experience, and most people would not consider sharing their home country with Google to be a major privacy risk.