Google's Nearby Connections API enables any Android (and Android Things) application to provide proximitybased services to its users, regardless of their network connectivity. The API uses Bluetooth BR/EDR, Bluetooth LE and Wi-Fi to let "nearby" clients (discoverers) and servers (advertisers) connect and exchange different types of payloads. The implementation of the API is proprietary, closed-source and obfuscated. The updates of the API are automatically installed by Google across different versions of Android, without user interaction. Little is known publicly about the security guarantees offered by the API, even though it presents a significant attack surface.
No takes yet. Share an insight, caveat, or question.
Antonioli et al. (2019) studied this question.