11 ms·
They have been previously used to collect SSID names and other WiFi network metadata. See https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://w
by lalos 6y ago
They have been previously used to collect SSID names and other WiFi network metadata. See https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/
- ForHackernews 6y agoNot just metadata: Wasn't the controversy that they were sniffing data packets, too?
- uptown 6y agoYup: https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/
- shadowgovt 6y agoYes, the firmware had been configured for open logging and was slurping the packets and dumping them to a debug file.
- barbegal 6y agoYes but (if we believe they are telling the truth) this was only done accidentally and they only intended to sniff the SSIDs. https://publicpolicy.googleblog.com/2010/05/wifi-data-collection-update.html https://publicpolicy.googleblog.com/2010/05/wifi-data-collec...
- jetrink 6y agoI remember the outrage that this revelation generated and I am still stumped by it. First, the probability that a Google car happens to capture sensitive information as it drives past your residence once per year is basically zero. Even if it did, it would still require detective work to correlate it to you specifically. Second, if you are worried about people recording data broadcast by your WiFi router, it's up to you to secure your network. I would be much more concerned about a neighbor snooping on my traffic. What did people imagine that Google was doing with these random snippets of data?
- henriquez 6y ago> if you are worried about people recording data broadcast by your WiFi router, it's up to you to secure your network So that makes it okay for Google to Hoover up? This attitude is why a lot of people are angry at big tech right now. Elitism and arrogance bordering on hubris, but zero self awareness.
- _jal 6y ago"If it is not clearly illegal, I have a god-given right to monetize it and then try to exclude you from it." -- FB, Google, et al on the Commons To be fair, it isn't just them. A disturbingly large number of people in the US appear to believe acknowledging any commonweal is counter to national ideology.
- renewiltord 6y agoIt is clearly a general belief everywhere that if you can get some utility out of something and you can manage to do that for free then you should. HN does it with paywall bypasses, piracy, etc. Completely unsurprising that if you take a group of people, each of whom individually believe in deriving utility from things they can get with or without permission, then that collective group also behaves in the same manner.
- shadowgovt 6y agoNobody's excluded from doing their own wardriving and data-collection on open SSID network names, as far as I'm aware. Hell, if someone just wanted to drive around and record the radio flux sans information, perhaps to build a fun map correlating population density or income levels to broadcast emissions, that's perfectly fair.
- ashtonkem 6y agoI’m kind of surprised that you’re surprised by it. Outrage over privacy violations has very little to do with the actual harm that the privacy violation causes, and much more to do with whether or not it seems to violate a prior expectation of anonymity or privacy. This concept is even enshrined in US jurisprudence; the “expectation of privacy” is a big factor in how privacy works in America. Back to Google. The problem isn’t that they captured packets or SSIDs; the problem is that they captured it sitting outside your house. With that change it feels like Google has gone from taking photos of the city that you might be in, to sitting in the bushes taking pictures of your house.
- MertsA 6y agoTo add to the other responses, the reason why they were capturing sensitive data was most likely because instead of doing filtering and processing live while they were driving around they chose to just deal with that after the fact and process the WiFi data through whatever system they already had for post processing. Even with just recording the SSIDs and timestamps on the vehicle all of the data that was controversial would still be captured by the radio on the vehicle, it would just be discarded immediately instead of being discarded when the Google maps vehicle offloaded that data for processing. If Google wanted to do something nefarious, they could still turn it back on all in software. The only real privacy gain is that they can't retroactively do it but I doubt even originally that they kept the packet dumps around for too long after processing it.
- shadowgovt 6y agoBased on the reporting at the time, it sounds like it was unintentional; they were capturing the raw packets to a debug file that wasn't even routed for post-processing.
- panoramas4good 6y agoThanks for the tip. I have update the post to include this info.
- sorenjan 6y agoYou could also add this video showing the optimization of a GPS track if you want some visualization. https://www.youtube.com/watch?v=z00ORu4bU-A https://www.youtube.com/watch?v=z00ORu4bU-A
- ethanbond 6y agoI think "accidentally" is potentially giving Google too much credit/benefit of the doubt as far as capture of packets. They hired a famous wardriver, Marius Milner, onto Street View (then later Niantic, maker of the privacy-intrusive Pokemon Go).
- shadowgovt 6y agoThat's not particularly suspicious. They've used the SSID data as part of the ground-truth map to improve positional accuracy of geolocation in Maps; "Can SSID + signal strength be used reliably for triangulation of position" is exactly the kind of wonky doman-specific knowledge you might find in the wardriving community and not many others.
- ethanbond 6y agoI would readily buy that if they didn't also, you know, sniff network contents and then attempt to obscure that fact. > The unredacted FCC report refers to a Google "design document" written by an engineer who crafted the Street View software to collect so-called payload data, which includes telephone numbers, URLs, passwords, e-mail, text messages, medical records, video and audio files sent over open Wi-Fi networks. https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/
- shadowgovt 6y ago
- JoeAltmaier 6y agoBut 'secrecy is not security'. This nonsense about 'hiding' the SSID is foolishness. For the reason I just gave. Plus, now, when anybody IS connecting, they're 'probing' that SSID by spamming every channel with the SSID. Like hide-n-seek where your little brother won't shut up and keeps saying "Are you still in the closet Fred? Are you? I'm under the bed! We're being secret!" So no, masking the SSID in your router isn't doing anything.
- msla 6y agoPlus, there's an obvious security hole: Any access point can say "Yes, I'm that access point you're looking for! Please do your banking through me! I'm ever so much not a malicious system spoofing your laptop by lying to it!" precisely because the laptop has to ask for the SSID, and those questions, the probe requests, are not encrypted.
- zelly 6y agoHTTPS adoption is probably why this hasn't been publicly exploited yet.
- bronco21016 6y agoHTTPS and HSTS can be broken. The main hurdle to this attack vector at this point is most browsers throw up scary warnings and do not give super obvious paths to waving away the warning.
- vlan0 6y agoNah, this is a widely known issue. But the real win is credential harvesting from networks still running PEAP-MSCHAPv2. It certainly has been used to harvest credentials, but good luck discovering the dude who walks through a busy college campus with a WiFi Pineapple in his backpack.
- war1025 6y agoAs some with three little kids, that analogy was just great. A daily occurrence at our house.