Possible hacker

[TAO]

There’s a person who made a game that tries to get your location.

This is the game:

https://play.creaticode.com/projects/68dfd705b8fda4381ff74086

This is a comment that peaked my interest that I think @info-creaticode will find interesting.

“Basically, they create a block that does something like this, // This block will get the user’s current latitude and longitude // and then fetch detailed geo information, storing it in ‘myGeoData’ table. get geo info for latitude latitude longitude longitude and write into table myGeoData // After this block runs, your ‘myGeoData’ table will be filled //with properties like ‘country’, ‘city’, ‘state’, etc., and their values. You can find this, by inspecting the code and finding the blocks, those are the blocks trying to obtain your location.”

[info-creaticode]

@tao

Geo info is a useful tool used by many apps, such as Google Maps or Uber. So getting the user’s location info itself is not a malicious behavior.

[TAO]

@info-creaticode Yes, but I have actually created a test (this is privated) that can return stats like this

It was just a test, and isn’t actually malicious, but this could possibly be expanded

(t button is pressed after second run)

(It can also send txt files into your computer)

(Note, the first two questions were for show, and didn’t actually do anything to your computer)

I don’t know if this could be potentially threatening, but this was only a test and I’m not sure if it can be used further than this.

[DreamSMP_Luck]

@tao it is getting our info, I just copy and pasted the longitude and lagitude (I probably spelt that wrong) and put it into Google. it then gave me the exact town I live in, here’s a photo without me doxxing myself:

[artisilv]

@dreamsmp_luck yeah… that’s how latitude and longitude coordinates work.

[DreamSMP_Luck]

@artisilv I know

[Tyller_]

@info-creaticode Their concern is a malicious actor could easily store that in a google sheet, and private the project in order to hide the sheet so it becomes significantly harder to tell, there should be some sort of system to prevent the usage of both blocks in the same project, load and save data aren’t as dangerous due to the complexity of making public data report back, but it’s still a danger, a simple boolean in location blocks that goes true when used and then stops usage of alll remote data storage blocks would likely be best, and a reverse aswell though one way should suffice

[Tyller_]

@tao The txt files is not a hazard at all, that’s just downloading data and is completely harmless, however the very simple mixture of secure data storage and location is still a notable hazard, as somebody could leave those permissions on/hap hazardly check them