question: How do hackers of the internet track a user’s location?
comment: They ask your computer to tell them where you are, or show them what your webcam sees. They are able to do this because you computer is connected to the Internet, and it contains software which facilitates tracking you and snooping on you. The key, because if you don't connect to the Internet you can't read this, is to minimize the amount of snooping software. Phones are full of it, and the phone makers side with the phone companies and tracking users. Don't use your phone for Internet stuff, don't load lots of new apps on it, or leave it at home when you don't want to be tracked. Computers are a little better, provided you don't download a bunch of sketchy programs and don't allow sketchy scripts to run in your browser.
passages: On devices with neither GPS nor Wi-Fi capabilities, such as most desktop and some laptop computers, Prey provides the location of the Internet server the device is connected to; although such server's location may be far from the device and, as such, of little use in pinpointing its location.
  
  Section::::Additional capabilities.
  
  In addition to obtaining location information and issuing commands to lock the device, it is also possible to issue other commands, including turning on a device's camera to view who is using the device at that moment.
  
  Section::::Versions.
   When a device is to be located, usually because it has been stolen and may be used by unauthorised users, the owner logs into the Prey site and reports it as missing. The Prey server then attempts to contact the device when it next connects to the Internet, asks for its location information and, optionally, submits owner-issued commands, e.g., to lock the device.
  
  For devices with GPS capability, such as smartphones with built-in GPS (satellite positioning) capability, the GPS location is used.
   For devices without GPS capability, and for computers unable to connect to GPS (either because they do not have a GPS receiver or because they are located indoors and, as such, beyond the reach of GPS satellite systems), if the device has a Wi-Fi interface, the device scans for Wi-Fi hotspots (it does not need to connect to any of them) and uses Wi-Fi positioning by means of the Google Location API to obtain location information
   When the device is connected to the Internet after Prey has been asked for information, typically by the device's registered user after theft of the device, the Prey server asks the software agent to send location information which is, subsequently, made available to the registered user.
  
  Section::::Company.
  
  Fork Ltd. is a privately held software company with offices in San Francisco and Hong Kong. It was founded in 2009 by CEO Tomás Pollak and COO Carlos Yaconi.
  
  Section::::Location information.
   In May 2016, a group of computer scientists from Kyoto University had demonstrated to Andy Greenberg at "Wired" magazine how location pinpointing is still possible even when the "show distance" feature is disabled. By exploiting a novel attack model called colluding-trilateration introduced by the group, locating any targeted user becomes a very easy and cheap task without employing any hacking technique. The attack model not only works with Grindr but also with Jack'd and Hornet, or any LBS app that shows photos of nearby users in order of proximity.
  
  Section::::Controversy and criticism.:Offensive speech.
   A dummy location is set as the true location. This is done so by pinpointing a user's specific location and transforming it into several other locations, yet keeping the true location. Suppression is a subset of these different applications where for a short period of time, when a user enters an area, the user information is temporarily suspended and the identity of the user is lost, so when they exit back out of the protected area, they have a new identity.
  
  Section::::Solutions.:Location transformation.:Cryptographic techniques.
   Online retailers and payment processors use geolocation to detect possible credit card fraud by comparing the user's location to the billing address on the account or the shipping address provided. A mismatch – an order placed from the US on an account number from Tokyo, for example – is a strong indicator of potential fraud. IP address geolocation can be also used in fraud detection to match billing address postal code or area code. Banks can prevent "phishing" attacks, money laundering and other security breaches by determining the user's location as part of the authentication process. Whois databases can also help verify IP addresses and registrants.
   Users have the option to save a home or work address for easy access. Most often, users put their actual address, but in some cases, users have been known to put an address a couple streets away, just for their safety in case data gets leaked. However, while this is a very basic level of deflection, putting a home address a couple streets away still gives a general location of where the user is stationed.
  
  Section::::Concerns.:Location aware applications.
   There are many ways in which online tracking has manifested itself. Historically, when companies wanted to track users’ online behavior, they simply had users sign in to their website. This is a form of deterministic cross-device tracking, in which the user’s devices are associated with their account credentials, such as their email or username. Consequently, while the user is logged in, the company can keep a running history of what sites the user has been to and which ads the user interacted with between computers and mobile devices.
   The "Frequent Locations" feature found in "Settings" under "Location Services" stores commonly visited locations locally on the device. This feature is said to help the accuracy of the GPS and Apple Maps since it can log information about the locations the user has frequently visited. However, this feature also keeps track of the number of times that the user has been to that location, the dates, and the exact times. Media outlets have publicized instructions on how this can be disabled for concerned users.
  
  Section::::Encryption and intelligence agency access.
   BULLET::::- "Spatial cloaking" techniques in which a user is k-anonymous if her exact location cannot be distinguished among k-1 other users
  
  BULLET::::- "Invisible cloaking", in which no locations are provided for certain zones
  
  BULLET::::- Adding random noise to the position
  
  BULLET::::- Rounding, which uses landmarks to approximate the location
  
  BULLET::::- Redefinition of possible areas of location.
  
  One example of the application of location obfuscation can be seen in the following figure.
   Relating more to the online profile created of the user, if a person solely relies on ride-sharing services to get around, one can track how long the user has been away from their home and how far away they are from their home. This becomes an opportunity for people to stalk or rob the user because they know when is the ideal time people aren't home. *citation* Looking on a broader scale, based on the demographics of the area a user interacts with, if they frequently visit the same stores within a certain area, information can be assumed, such as estimated income. *citation*
   With the advancement of global positioning systems and the development of wireless communication which are introduced in the extensive use of location-based applications, high risks have been placed on user privacy. Both the service providers and users are under the dangers of being attacked and information being abused. It has been reported that some GPS devices have been used to exploit personal information and stalk personal locations. Sometimes, only reporting location information would already indicate much private information. One of the attacks specific to location-based services is the space or time correlated inference attacks, in which the visited location is correlated with the particular time, and this could lead to the disclosure of private life and private business.
   Obfuscating a user's location means to cloud the user's location. A user's location coordinates are still being preserved, however the accuracy is just being degraded. However, this cannot be a complete solution because this would just neglect the entire reason of location-based services. So being selective in what an application is obfuscating, would help with protection.
   F-Secure discovered that the data is transmitted to Apple twice a day and postulate that Apple is using the information to construct their global location database similar to the ones constructed by Google and Skyhook through wardriving. Nevertheless, unlike the Google "Latitude" application, which performs a similar task on Android phones, the file is not dependent upon signing a specific EULA or even the user's knowledge, but it is stated in the 15,200 word-long terms and conditions of the iPhone that "Apple and [their] partners and licensees may collect, use, and share precise location data, including the real-time geographic location of [the user's] Apple computer or device".
   In 2011, Kamkar discovered the iPhone, Android and Windows Phone mobile devices were continuously sending GPS coordinates, correlated to Wi-Fi MAC addresses, back to Apple, Google and Microsoft respectively, and released his research through several front page "The Wall Street Journal" articles. The iPhone would continue to send location data "even when the location services were turned off". The Windows Phone would also continue to send location data "even when the user has not given the app permission to do so". He discovered that some of this data was exposed by Google and he released Androidmap, a tool exposing Google's database of Wi-Fi MAC addresses correlated to the physical coordinates populated by Android phones.
   Other personal data are sold by dating apps. The one that is the most bought by private companies remains the geographical information of users. When the user allow localization, apps record them and store them using Geographic Coordinate System. When a data breach happens, geographical information directly exposes users.
   Other technologies such as supercookies, which stay on computers long after the user deletes his or her cookies, and web beacons, which are unique images from a URL, are also used by trackers and advertisers to gain increased insight into users’ behavior. However, advertisers were still limited in that only one device was able to be tracked and associated with a user.
  
  Thus, cross-device tracking initially emerged as a means of generating a profile of users across multiple devices, not simply one.
   In a distributed environment, users anonymize their location information through fixed communication infrastructures, such as base stations. Usually, a certification server is introduced in a distributed scheme where users are registered. Before participating in this system, users are required to obtain a certificate which means that they are trusted. Therefore, every time after user request a location-based service and before the exact location information is forward to the server, the auxiliary users registered in this system collaborate to hide the precise location of the user. The number of assistant users involved in cloaking this region is based on K-anonymity, which is usually set be the specific user. In the cases where there are not enough users nearby, S-proximity is generally adopted to generate a high number of paired user identities and location information for the actual user to be indistinguishable in the specific area. The other profiles and location information sent to the service provider are sometimes also referred to as dummies.
   The location anonymizer could also be considered as a trusted-third party since it is trusted by the user with the accurate location information and private profile stored in the location anonymizer. However, this could also expose users’ privacy into great risks at the same time. First, since the anonymizer keeps tracking users' information and has access to the users’ exact location and profile information, it is usually the target of most attackers and thus under higher risks Second, the extent to which users trust the location anonymizers could be essential. If a fully trusted third party is integrated into the algorithm, user location information would be reported continuously to the location anonymizer, which may cause privacy issues if the anonymizer is compromised. Third, the location anonymizer may lead to a performance bottleneck when a large number of requests are presented and required to be cloaked. This is because the location anonymizer is responsible for maintaining the number of users in a region in order to provide an acceptable level of service quality.
   Location privacy is usually considered falling into the category of information privacy, though there is little consensus on the definition of location privacy. There are often three aspects of location information: identity, location(spatial information), and time(temporal information). Identity usually refers to a user's name, email address, or any characteristic which makes a user distinguishable. For example, Pokémon Go requires a consistent user identity, since users are required to log in. Spatial information is considered as the main approach to determine a location. Temporal information can be separated into real-time and non-real time and is usually described as a time stamp with a place. If a link is established between them, then the location privacy is considered violated. Accessing personal location data has been raised as a severe privacy concern, even with personal permission. Therefore, privacy-aware management of location information has been identified as an essential challenge, which is designed to provide privacy protection against abuse of location information. The overall idea of preserving location privacy is to introduce enough noise and quantization to reduce the chances of successful attacks.
   In recent years, researchers have been making a connection between social aspects and technological aspects regarding location information. For example, if co-location information is considered as the data which potential attackers would get and take into consideration, the location privacy is decreased by more than 60%. Also, by a constant report of a user's location information, a movement profile could be constructed for this specific user based on statistical analysis, and a large amount of information could be exploited and generated from this profile such as user's office location, medical records, financial status, and political views. Therefore, more and more researchers have taken account of the social influence in their algorithms, since this socially networked information is accessible to the public and might be used by potential attackers.
   BULLET::::- "Researchers at MIT and the Université catholique de Louvain, in Belgium, analyzed data on 1.5 million cellphone users in a small European country over a span of 15 months and found that just four points of reference, with fairly low spatial and temporal resolution, was enough to uniquely identify 95 percent of them. In other words, to extract the complete location information for a single person from an “anonymized” data set of more than a million people, all you would need to do is place him or her within a couple of hundred yards of a cellphone transmitter, sometime over the course of an hour, four times in one year. A few Twitter posts would probably provide all the information you needed, if they contained specific information about the person’s whereabouts."
   Serving as an intermediate between the user and location-based server, location anonymizer generally conducts the following activities:
  
  BULLET::::- Receiving users’ exact location information and private profile
  
  BULLET::::- Blurring the location into cloaked areas based on the specific privacy requirements
  
  BULLET::::- In most of the times, removing user identities from the location information
  
  BULLET::::- Reporting the cloaked area to the service provider and receiving a list of solutions, which is referred to as a candidate list, from the service provider which satisfies user's requests
   Android smartphones have the ability to report the location of Wi-Fi access points, encountered as phone users move around, to build databases containing the physical locations of hundreds of millions of such access points. These databases form electronic maps to locate smartphones, allowing them to run apps like Foursquare, Google Latitude, Facebook Places, and to deliver location-based ads. Third party monitoring software such as TaintDroid, an academic research-funded project, can, in some cases, detect when personal information is being sent from applications to remote servers.
  
  Section::::Security and privacy.:Technical security features.
  