Mobile Devices as Digital Sextants for Zero-Permission Geolocation

摘要

Sensors in mobile devices can be used to infer information about a user's context, most notably the location. Android apps and websites shown in Firefox for Android allow software to read the ambient light sensor, gyroscope and accelerometer without asking the user for permission. We show that these three sensors are sufficient to determine the rough geographical location of a user by turning the mobile device into a digital sextant. Despite low-quality sensor data, our approach is able to determine the position of the sun and thereby the geographical area where the user is located. Our approach works even if the user holding the device does not cooperate in being located or employs location-disguising techniques such as a VPN. We analyze in detail the different error sources and show in which settings and situations our approach works best. The location accuracy was at best 146 km with a medium accuracy better than 500 km. Truncating the positional sensor readings minimizes the privacy threat, while truncation of the ambient light sensor has almost no effect.