4 ms·

What's even more fun is that your phone is also broadcasting those SSIDs to the world as you walk down the street, if you have wifi enabled, and likely also you

What's even more fun is that your phone is also broadcasting those SSIDs to the world as you walk down the street, if you have wifi enabled, and likely also your unique MAC address. So anyone in wireless range of you can 1) track you and recognize you again, and 2) possibly figure out where you work and live (although of course they may see your friends' wifi networks too and not be able to tell which is your network.)

hamandchris 8y ago
Phones don't broadcast previously-seen SSIDs. Where did you get that idea?
- YouKnowBetter 8y ago
  You are so wrong. Your phone is constantly broadcasting ALL the SSIDs it was ever connected to (and you did not remove). I show this live when I do general security presentations. Live on stage with nothing more then a Raspi and a Wifi USB dongle. It freaks people out to see there home, holiday, local bar, family in law and other historic SSIDs scroll by.
- dTal 8y ago
  I suggest you Google "phones broadcast ssids". And then go get a stiff drink.
- jsjohnst 8y ago
  Set a wifi chip in monitor mode, fire up wireshark, then see for yourself. Rather easy to do and once you do, you’ll learn to keep wifi off when you aren’t intentionally wanting it.
  - distances 8y ago
    On Android there are apps to manage this automatically. I'm using Smarter WiFi Manager myself, and it does work pretty well.
    - LeftTurnSignal 8y ago
      On iOS they have Shortcuts that can do something like that too. It's real limited in what it does, but it can turn wifi / bluetooth / other stuff on depending on time, location, the usual stuff. I would love to have a real "Tasker" type app for iOS, but I doubt that will happen anytime soon.
- phyzome 8y ago
  You can read up on it here: https://robertheaton.com/2019/01/15/a-brief-history-of-wi-fi-privacy-vulnerabilities/ https://robertheaton.com/2019/01/15/a-brief-history-of-wi-fi... Looks like more recent phones are better about this, but there are still a lot of older phones out there! And there are still leakages that allow tracking. Note that with "real computers", just keeping the software up to date is enough to get you the latest in MAC randomization and whatnot; with phones, you may or may not be able to upgrade your software. -.-
cesarb 8y ago
Only if those SSIDs were configured as a "hidden SSID" (WifiConfiguration.hiddenSSID). AFAIK, that will only happen when you type the SSID manually, instead of selecting it from the list of scan results. And using a "hidden SSID" is a bad idea in the first place (https://superuser.com/questions/43836/automatically-connecting-to-hidden-ssid-wifi-network/48280#48280 https://superuser.com/questions/43836/automatically-connecti...).
- jsjohnst 8y ago
  That is entirely not true, both iOS and Android send out requests for known APs when not connected to Wi-Fi. iOS does it VERY often in fact (depending on your list of known APs, could be upwards of 50x/min while device is in use). If you have a wifi chipset you can put in monitor mode, it’s easy to see how noisy mobile devices are.
  - cesarb 8y ago
    I looked at it back in 2015 (https://news.ycombinator.com/item?id=9217589 https://news.ycombinator.com/item?id=9217589), it seems there was a bug (https://www.eff.org/deeplinks/2014/07/your-android-device-telling-world-where-youve-been https://www.eff.org/deeplinks/2014/07/your-android-device-te...) which sent these probe requests when the screen was off. I don't know if it has been fixed yet.
    - jsjohnst 8y ago
      Don’t know about the bug you linked (will read up on it later), but I can easily provide radio captures to prove that most Android devices do what I described, with no “hidden” networks ever in use. There are retail analytics startups who literally use this exact type of data to allow brick and mortar stores to gain insights into their passive customer behavior. Source: I used to work for one of them and designed and built a bunch of the hardware / software stack.

hamandchris 8y ago

Phones don't broadcast previously-seen SSIDs. Where did you get that idea?

YouKnowBetter 8y ago
You are so wrong. Your phone is constantly broadcasting ALL the SSIDs it was ever connected to (and you did not remove). I show this live when I do general security presentations. Live on stage with nothing more then a Raspi and a Wifi USB dongle. It freaks people out to see there home, holiday, local bar, family in law and other historic SSIDs scroll by.
dTal 8y ago
I suggest you Google "phones broadcast ssids". And then go get a stiff drink.
jsjohnst 8y ago
Set a wifi chip in monitor mode, fire up wireshark, then see for yourself. Rather easy to do and once you do, you’ll learn to keep wifi off when you aren’t intentionally wanting it.
- distances 8y ago
  On Android there are apps to manage this automatically. I'm using Smarter WiFi Manager myself, and it does work pretty well.
  - LeftTurnSignal 8y ago
    On iOS they have Shortcuts that can do something like that too. It's real limited in what it does, but it can turn wifi / bluetooth / other stuff on depending on time, location, the usual stuff. I would love to have a real "Tasker" type app for iOS, but I doubt that will happen anytime soon.
phyzome 8y ago
You can read up on it here: https://robertheaton.com/2019/01/15/a-brief-history-of-wi-fi-privacy-vulnerabilities/ https://robertheaton.com/2019/01/15/a-brief-history-of-wi-fi... Looks like more recent phones are better about this, but there are still a lot of older phones out there! And there are still leakages that allow tracking. Note that with "real computers", just keeping the software up to date is enough to get you the latest in MAC randomization and whatnot; with phones, you may or may not be able to upgrade your software. -.-

cesarb 8y ago

Only if those SSIDs were configured as a "hidden SSID" (WifiConfiguration.hiddenSSID). AFAIK, that will only happen when you type the SSID manually, instead of selecting it from the list of scan results. And using a "hidden SSID" is a bad idea in the first place (https://superuser.com/questions/43836/automatically-connecting-to-hidden-ssid-wifi-network/48280#48280 https://superuser.com/questions/43836/automatically-connecti...).

jsjohnst 8y ago
That is entirely not true, both iOS and Android send out requests for known APs when not connected to Wi-Fi. iOS does it VERY often in fact (depending on your list of known APs, could be upwards of 50x/min while device is in use). If you have a wifi chipset you can put in monitor mode, it’s easy to see how noisy mobile devices are.
- cesarb 8y ago
  I looked at it back in 2015 (https://news.ycombinator.com/item?id=9217589 https://news.ycombinator.com/item?id=9217589), it seems there was a bug (https://www.eff.org/deeplinks/2014/07/your-android-device-telling-world-where-youve-been https://www.eff.org/deeplinks/2014/07/your-android-device-te...) which sent these probe requests when the screen was off. I don't know if it has been fixed yet.
  - jsjohnst 8y ago
    Don’t know about the bug you linked (will read up on it later), but I can easily provide radio captures to prove that most Android devices do what I described, with no “hidden” networks ever in use. There are retail analytics startups who literally use this exact type of data to allow brick and mortar stores to gain insights into their passive customer behavior. Source: I used to work for one of them and designed and built a bunch of the hardware / software stack.