4 ms·

They need to be much more aggressive towards apps that request access to the SSID of the current network. This is supposed to be limited, but in my experience,

They need to be much more aggressive towards apps that request access to the SSID of the current network. This is supposed to be limited, but in my experience, apps you would not expect to be doing that are doing it, and it's basically the same thing as location data.

saagarjha 8y ago
Limited? This is public and unrestricted API, to my knowledge: https://developer.apple.com/documentation/systemconfiguration/scnetworkconfiguration https://developer.apple.com/documentation/systemconfiguratio...
- gepeto42 8y ago
  Yeah, it was supposed to be - https://developer.apple.com/documentation/networkextension/nehotspothelper https://developer.apple.com/documentation/networkextension/n... Around iOS 9, Apple deprecated some of the Captive Portal APIs, then re-instated them, a lot of changes that went back and forth, but my conclusion is that today, years later, way too many apps seem to read my SSID. Doesn't really matter how they do it, but I wish there was a prompt for it and no way for an app to directly fetch it.
  - walterbell 8y ago
    Any downside to using a common SSID, https://www.wigle.net/stats#ssidstats https://www.wigle.net/stats#ssidstats?
    - chimeracoder 8y ago
      > Any downside to using a common SSID, https://www.wigle.net/stats#ssidstats https://www.wigle.net/stats#ssidstats? From the documentation, it's not clear to me if apps have permission to see either other nearby SSIDs or the names of other networks that the device has previously connected to. If the app has access to either one of those, it's equivalent to being given location data. Furthermore, last I checked, both iOS and Android broadcast the list of previously-connected SSIDs to nearby routers when connecting. That enables companies which track people's physical location over time without them having to download an app (yes, these companies exist[0]). [0] e.g. http://axper.com/ http://axper.com/
      - throwaway080383 8y ago
        As the sibling commenter said, you typically can access connected BSSID's which are essentially unique. However, to answer your question, on iOS there is no API for accessing nearby not-connected wifi, and on Android it exists but I believe it requires location permission.
      - walterbell 8y ago
        Whoa.. why do random routers need my SSID location history? Is that list removable by “forgetting” all the previous networks?
        chimeracoder 8y ago
        > Whoa.. why do random routers need my SSID location history? Is that list removable by “forgetting” all the previous networks? It's how the standard currently works and what enables fast reconnection. IIRC, the device sends out all available SSIDs, at the router responds with the one(s) it's able to use to connect. I agree that this is backwards, and I'd rather have slightly slower WiFi reconnection in exchange for better privacy. I don't know what the OS-level behavior is if you delete all previous networks. I assume it works, but I haven't tested it. Oh, and for what it's worth, this isn't just for mobile devices. Your laptop probably does it too. In fact, OS X has an annoying habit of connecting to WiFi networks in the background even when the laptop is closed and asleep, which means it's doing this broadcasting behavior as long as the WiFi setting is turned on.
        walterbell 8y ago
        This thread claims it’s only hidden SSIDs that are broadcast: https://apple.stackexchange.com/questions/244171/ios-10-warning-using-a-hidden-network-can-expose-personally-identifiable-inform https://apple.stackexchange.com/questions/244171/ios-10-warn...
    - gepeto42 8y ago
      The BSSID can be read too, so I don't think it's worth trying to figure out ways to add some obscurity to the SSID (no matter what downsides would come with that).
throwaway080383 8y ago
A few years ago, the FTC fined InMobi for doing precisely this: https://www.ftc.gov/news-events/blogs/business-blog/2016/06/track-or-treat-inmobis-location-tracking-ignored-consumers https://www.ftc.gov/news-events/blogs/business-blog/2016/06/...

saagarjha 8y ago

Limited? This is public and unrestricted API, to my knowledge: https://developer.apple.com/documentation/systemconfiguration/scnetworkconfiguration https://developer.apple.com/documentation/systemconfiguratio...

gepeto42 8y ago
Yeah, it was supposed to be - https://developer.apple.com/documentation/networkextension/nehotspothelper https://developer.apple.com/documentation/networkextension/n... Around iOS 9, Apple deprecated some of the Captive Portal APIs, then re-instated them, a lot of changes that went back and forth, but my conclusion is that today, years later, way too many apps seem to read my SSID. Doesn't really matter how they do it, but I wish there was a prompt for it and no way for an app to directly fetch it.
- walterbell 8y ago
  Any downside to using a common SSID, https://www.wigle.net/stats#ssidstats https://www.wigle.net/stats#ssidstats?
  - chimeracoder 8y ago
    > Any downside to using a common SSID, https://www.wigle.net/stats#ssidstats https://www.wigle.net/stats#ssidstats? From the documentation, it's not clear to me if apps have permission to see either other nearby SSIDs or the names of other networks that the device has previously connected to. If the app has access to either one of those, it's equivalent to being given location data. Furthermore, last I checked, both iOS and Android broadcast the list of previously-connected SSIDs to nearby routers when connecting. That enables companies which track people's physical location over time without them having to download an app (yes, these companies exist[0]). [0] e.g. http://axper.com/ http://axper.com/
    - throwaway080383 8y ago
      As the sibling commenter said, you typically can access connected BSSID's which are essentially unique. However, to answer your question, on iOS there is no API for accessing nearby not-connected wifi, and on Android it exists but I believe it requires location permission.
    - walterbell 8y ago
      Whoa.. why do random routers need my SSID location history? Is that list removable by “forgetting” all the previous networks?
      - chimeracoder 8y ago
        > Whoa.. why do random routers need my SSID location history? Is that list removable by “forgetting” all the previous networks? It's how the standard currently works and what enables fast reconnection. IIRC, the device sends out all available SSIDs, at the router responds with the one(s) it's able to use to connect. I agree that this is backwards, and I'd rather have slightly slower WiFi reconnection in exchange for better privacy. I don't know what the OS-level behavior is if you delete all previous networks. I assume it works, but I haven't tested it. Oh, and for what it's worth, this isn't just for mobile devices. Your laptop probably does it too. In fact, OS X has an annoying habit of connecting to WiFi networks in the background even when the laptop is closed and asleep, which means it's doing this broadcasting behavior as long as the WiFi setting is turned on.
        walterbell 8y ago
        This thread claims it’s only hidden SSIDs that are broadcast: https://apple.stackexchange.com/questions/244171/ios-10-warning-using-a-hidden-network-can-expose-personally-identifiable-inform https://apple.stackexchange.com/questions/244171/ios-10-warn...
  - gepeto42 8y ago
    The BSSID can be read too, so I don't think it's worth trying to figure out ways to add some obscurity to the SSID (no matter what downsides would come with that).

throwaway080383 8y ago

A few years ago, the FTC fined InMobi for doing precisely this: https://www.ftc.gov/news-events/blogs/business-blog/2016/06/track-or-treat-inmobis-location-tracking-ignored-consumers https://www.ftc.gov/news-events/blogs/business-blog/2016/06/...