6 ms·

You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola! I would

You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola! I wouldn't throw the elder person under the bus on this one, the tactics are sophisticated, and honestly, just a precursor to what will happen with AR. To give a bit more of how it's implemented (at least how I would propose it in iOS), Insta/FB/Whats queries available wifi SSIDs as a background process (or whatever they have for notifications/networking etc), and does the same to your therapist since you both have insta / fb / whats ... and based on the signal strength, can say with confidence you two were in the same room because XYZ Wifi strength is -Xdb just like yours (walls are strong signal augmenters), and you are both there for some time based on the background thread timestamp.

JumpCrisscross 6y ago
> and viola I love this typo.
- craftinator 6y ago
  I could play Hot Cross Buns on this typo.
- therein 6y ago
  > Then they query the adjacent SSIDs and their signal strength in a background thread, and bam, Viola is your aunt, all your privacy is violated!
rpastuszak 6y ago
haha, that's a good point, but in this case I think it's more trivial than that: she probably shared her contact book with FB or Insta (still, not her fault imho). But, at the same time I've worked with FB SDK which was just one big shit show. It's hard even to describe it without turning a comment into an essay, so I'll pick the two I found somewhat amusing: sending data to FB before the developer could pass user consent (or thereof), sending hashes of the (non-FB) libraries installed on your phone to FB servers. Minor tangent: The best thing about the web is that user agents are still pretty good at fighting some of the tracking practices (ETP/ITP, cross origin security, etc...). It's actually quite impressive. Then, native is just one big black hole. This is why the current browser changes, although positive overall (less $$ from 3p tracking), are a double edged sword (pushing people towards walled gardens).
- krrrh 6y ago
  It’s almost certainly just the phone number. Recently Instagram told me that a former business partner of mine had joined and I was surprised to learn that his account was an hair braiding service in Atlanta for women with African lineage (we’re both Canadian men with European ancestors). We figured out that years ago we had taken a business trip there and picked up temporary SIM cards back when Canadian cell phone plans charged injurious roaming fees. I still had that phone number in my contacts for him when I joined Instagram, and it had finally been recycled and used to create an account. It’s a cool thought experiment for nerds and paranoiacs to imagine how you might use relative wi-fi strengths, bluetooth beacons and complex interaction patterns, but it’s less sophisticated than that.
  - rpastuszak 6y ago
    Yeah, my first thought reading the parent comment was two words: "Occam's razor". But, I still find it amusing that companies like FB want to project the image of "informed consent" whereas we have a bunch of developers here trying to figure out what the hell happened and coming up with plausible solutions. What's interesting thought (and I know that from my professional experience in ad tech) is that the "cookiegeddon" did push companies towards non-deterministic, more fuzzy ways of cross-device targeting (and we're talking about people who already think that fingerprinting is ethical). The upside is that metrics are mostly bullshit anyway.
  - smhost 6y ago
    > It's almost certainly this one thing, and not the other thing. No, they dragnet every possible identifier and dump everything into a pattern recognizer.
  - anonymouse008 6y ago
    > It’s a cool thought experiment for nerds and paranoiacs to imagine how you might use relative wi-fi strengths I'm honored to be called a nerd on HN... I'll ignore the latter ;) Though while I agree the phone number is absolutely used, I don't think it's the only. Trying to get out ahead of the public's changing privacy tastes is a must for any advertiser that collects social-graph-like data. So strategically, if FB is not doing this, I would pull any FB investments because they aren't trying to do their job.
hanspeter 6y ago
Not sure why you're suggesting shenanigans like wifi SSID tricks (and others jumping the bandwagon), when the actual thing that happened here is obvious: GP visited their therapist's website, the website had FB/IG advertising tracker installed, the therapist had a campaign running that targeted all visitors from their site.
- anonymouse008 6y ago
  I appreciate that idea, however, I've been testing my own 'friend suggestions' and keep a strong track of my antics... also, it's become a hobby of mine to debunk each time someone says 'they're listening to my microphone!!!' Most of the time the 'listening to me' conversations are based on origin IP to insta/fb/whatsapp servers. One person talks about idea X, another person looks it up (either in the room or later at home by themselves), and now everyone who was at that IP together will get ads for X. What's more, Google maps uses Wifi SSIDs to get better location data when GPS gets a bit spotty... so, I'd venture to say it's a small step to associate accounts and make friends.
rhizome 6y ago
>You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola! The problem is that someone decided to correlate them, not to mention without asking.
- scalableUnicon 6y ago
  It is possible to opt-out of Google's Wi-Fi network location mapping by appending "_nomap" to SSID[1], I'm not sure if it works with other providers. Although I think this should have been opt-in instead of opt-out, the least we deserve is a standard, guaranteed way to universally opt-out. [1] https://www.tomshardware.com/news/Google-Maps-Wi-Fi-Location-SSID,14000.html https://www.tomshardware.com/news/Google-Maps-Wi-Fi-Location...
  - sildur 6y ago
    Why it's always us who have to do the work to avoid being harassed by google? If I don't want to have my site harvested for snippets I have to add a no-snippet tag. If I don't want my WiFi data harvested I have to append an ugly nomap to my SSID. What about being it opt-in, as you said? I'm tired of doing Google's dirty work... By the way, quoting from the article: > "Specifically, this approach helps protect against others opting out your access point without your permission." Oh, thank you for your kindness, Google. Yes, the idea of another person denying me the joy of having my WiFi data harvested by you is terrifying. Thanks, Google. You really know how to be helpful...
    - Schnitz 6y ago
      Especially because Google mapping your WiFi comes with real downsides for you. Two years ago a random stranger rung my doorbell and told me their Android phone got stolen and according to Find My Device, the device was inside my house and even showed it to me live. I told them to wait on the street and checked the roof and yard, but didn't find the device. I simply told them I can't help further and they luckily took it well, thanked me and left. Imagine how easily such a situation can get ugly though. A day or so later i realized that my Wifi router happens to be at an oddly open corner of my house, facing the backyard, and visible for much further than you'd expect since there are also no other structures for quite a distance. I bet his phone was somewhere there but saw my WiFi and so it erroneously located itself in my house. Thanks Google!
KaiserPro 6y ago
> You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola! I mean yeah, they _could_ do that, but thats a pain in the arse to do. Its far easier to do it on contact lists, interests and implied location from business page follows. I don't think iOS allows you to track SSIDs, which explains the lack of wifi scanning utilities in the app store.
- MR4D 6y ago
  WiFi SSIDs have one very nice attribute - they tend not to move around much. So every time you see a Google maps car ( or a Nuro car or a ...), your SSID is getting geomapped. Now, your IP, SSID, geolocation, and who knows what else is now sitting in a lookup table somewhere. So if they get all the other stuff that you just mentioned, they now know more about you than you do!
chrischen 6y ago
Phone GPS already uses Wifi for improved accuracy. So if fb has location access permissions it already does this for them implicitly.
deleted 6y ago
[deleted]
mrfusion 6y ago
Are apps allowed to do that on iOS? I can’t think of any good reason besides for a wifi diagnostic app.

JumpCrisscross 6y ago

> and viola I love this typo.

craftinator 6y ago
I could play Hot Cross Buns on this typo.
therein 6y ago
> Then they query the adjacent SSIDs and their signal strength in a background thread, and bam, Viola is your aunt, all your privacy is violated!

rpastuszak 6y ago

haha, that's a good point, but in this case I think it's more trivial than that: she probably shared her contact book with FB or Insta (still, not her fault imho). But, at the same time I've worked with FB SDK which was just one big shit show. It's hard even to describe it without turning a comment into an essay, so I'll pick the two I found somewhat amusing: sending data to FB before the developer could pass user consent (or thereof), sending hashes of the (non-FB) libraries installed on your phone to FB servers. Minor tangent: The best thing about the web is that user agents are still pretty good at fighting some of the tracking practices (ETP/ITP, cross origin security, etc...). It's actually quite impressive. Then, native is just one big black hole. This is why the current browser changes, although positive overall (less $$ from 3p tracking), are a double edged sword (pushing people towards walled gardens).

krrrh 6y ago
It’s almost certainly just the phone number. Recently Instagram told me that a former business partner of mine had joined and I was surprised to learn that his account was an hair braiding service in Atlanta for women with African lineage (we’re both Canadian men with European ancestors). We figured out that years ago we had taken a business trip there and picked up temporary SIM cards back when Canadian cell phone plans charged injurious roaming fees. I still had that phone number in my contacts for him when I joined Instagram, and it had finally been recycled and used to create an account. It’s a cool thought experiment for nerds and paranoiacs to imagine how you might use relative wi-fi strengths, bluetooth beacons and complex interaction patterns, but it’s less sophisticated than that.
- rpastuszak 6y ago
  Yeah, my first thought reading the parent comment was two words: "Occam's razor". But, I still find it amusing that companies like FB want to project the image of "informed consent" whereas we have a bunch of developers here trying to figure out what the hell happened and coming up with plausible solutions. What's interesting thought (and I know that from my professional experience in ad tech) is that the "cookiegeddon" did push companies towards non-deterministic, more fuzzy ways of cross-device targeting (and we're talking about people who already think that fingerprinting is ethical). The upside is that metrics are mostly bullshit anyway.
- smhost 6y ago
  > It's almost certainly this one thing, and not the other thing. No, they dragnet every possible identifier and dump everything into a pattern recognizer.
- anonymouse008 6y ago
  > It’s a cool thought experiment for nerds and paranoiacs to imagine how you might use relative wi-fi strengths I'm honored to be called a nerd on HN... I'll ignore the latter ;) Though while I agree the phone number is absolutely used, I don't think it's the only. Trying to get out ahead of the public's changing privacy tastes is a must for any advertiser that collects social-graph-like data. So strategically, if FB is not doing this, I would pull any FB investments because they aren't trying to do their job.

hanspeter 6y ago

Not sure why you're suggesting shenanigans like wifi SSID tricks (and others jumping the bandwagon), when the actual thing that happened here is obvious: GP visited their therapist's website, the website had FB/IG advertising tracker installed, the therapist had a campaign running that targeted all visitors from their site.

anonymouse008 6y ago
I appreciate that idea, however, I've been testing my own 'friend suggestions' and keep a strong track of my antics... also, it's become a hobby of mine to debunk each time someone says 'they're listening to my microphone!!!' Most of the time the 'listening to me' conversations are based on origin IP to insta/fb/whatsapp servers. One person talks about idea X, another person looks it up (either in the room or later at home by themselves), and now everyone who was at that IP together will get ads for X. What's more, Google maps uses Wifi SSIDs to get better location data when GPS gets a bit spotty... so, I'd venture to say it's a small step to associate accounts and make friends.

rhizome 6y ago

>You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola! The problem is that someone decided to correlate them, not to mention without asking.

scalableUnicon 6y ago
It is possible to opt-out of Google's Wi-Fi network location mapping by appending "_nomap" to SSID[1], I'm not sure if it works with other providers. Although I think this should have been opt-in instead of opt-out, the least we deserve is a standard, guaranteed way to universally opt-out. [1] https://www.tomshardware.com/news/Google-Maps-Wi-Fi-Location-SSID,14000.html https://www.tomshardware.com/news/Google-Maps-Wi-Fi-Location...
- sildur 6y ago
  Why it's always us who have to do the work to avoid being harassed by google? If I don't want to have my site harvested for snippets I have to add a no-snippet tag. If I don't want my WiFi data harvested I have to append an ugly nomap to my SSID. What about being it opt-in, as you said? I'm tired of doing Google's dirty work... By the way, quoting from the article: > "Specifically, this approach helps protect against others opting out your access point without your permission." Oh, thank you for your kindness, Google. Yes, the idea of another person denying me the joy of having my WiFi data harvested by you is terrifying. Thanks, Google. You really know how to be helpful...
  - Schnitz 6y ago
    Especially because Google mapping your WiFi comes with real downsides for you. Two years ago a random stranger rung my doorbell and told me their Android phone got stolen and according to Find My Device, the device was inside my house and even showed it to me live. I told them to wait on the street and checked the roof and yard, but didn't find the device. I simply told them I can't help further and they luckily took it well, thanked me and left. Imagine how easily such a situation can get ugly though. A day or so later i realized that my Wifi router happens to be at an oddly open corner of my house, facing the backyard, and visible for much further than you'd expect since there are also no other structures for quite a distance. I bet his phone was somewhere there but saw my WiFi and so it erroneously located itself in my house. Thanks Google!

KaiserPro 6y ago

> You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola! I mean yeah, they _could_ do that, but thats a pain in the arse to do. Its far easier to do it on contact lists, interests and implied location from business page follows. I don't think iOS allows you to track SSIDs, which explains the lack of wifi scanning utilities in the app store.

MR4D 6y ago
WiFi SSIDs have one very nice attribute - they tend not to move around much. So every time you see a Google maps car ( or a Nuro car or a ...), your SSID is getting geomapped. Now, your IP, SSID, geolocation, and who knows what else is now sitting in a lookup table somewhere. So if they get all the other stuff that you just mentioned, they now know more about you than you do!

chrischen 6y ago

Phone GPS already uses Wifi for improved accuracy. So if fb has location access permissions it already does this for them implicitly.

deleted 6y ago

[deleted]

mrfusion 6y ago

Are apps allowed to do that on iOS? I can’t think of any good reason besides for a wifi diagnostic app.