17 ms·

It's still so incredible to me that someone thought "oh, yeah, let's make people change their SSID explicitly to opt-out of being used by our services, such tha

It's still so incredible to me that someone thought "oh, yeah, let's make people change their SSID explicitly to opt-out of being used by our services, such that it forces them to re-add all of their Wi-Fi devices", and that passed any sort of muster at Google. Presumably the only reason they picked this strategy is that they know it is such an absolutely ridiculous step that nobody does it.

mattzito 5y ago
I'm trying to think of how one could do this in a way that wasn't even more intrusive? This way Google doesn't have to tie any identifying information about you to your SSID/AP, it can just silently discard the location data about those SSIDs. Otherwise people could abusively de-register SSIDs by doing the same sort of scanning Google is doing to improve location services, or have to force a user to authenticate and "claim" an SSID, which is much more intrusive. (disclosure: googler, but not in any way associated with any of this)
- awakeasleep 5y ago
  Opt-in
  - whatshisface 5y ago
    Well, then nobody would do it. Maybe Google would have to pay them, or give them free stuff.
    - ocdtrekkie 5y ago
      If Google wants to use other people's stuff for their purposes, they should pay them. Not force them to jump through hoops to avoid Google abusing them.
      - betterunix2 5y ago
        How would that work? Keep in mind that we are talking about parts of the radio spectrum that were deliberately set aside for unlicensed use, without any sort of registration, centralized control, or reporting on the part of users. So how would Google or any other company know who to pay? Do you want to force users to register their APs, or to include some kind of payment information in wifi beacons? Or are you proposing that new restrictions be added to the ISM rules e.g. forbidding people from monitoring the band without first asking for permission from each station operator (note: this would completely break wifi)?
        ocdtrekkie 5y ago
        I think a user registration system would make sense: People who wanted to register their APs are probably using Google Location Services, and the incentive is hence, self-serving. Businesses may want to register their APs to help customers' devices locate themselves at their buildings. And yes, Google could incentivize people to register in some way. One thing you'll notice is that the most valuable companies in the world seem incredibly reliant on free labor: They take for free what other companies used to pay for or pay staff to create or gather themselves.
        alyandon 5y ago
        Those FCC registration records would then be public information. Would you feel comfortable with your name, address and MAC + SSID of your wireless AP(s) being registered in a public database and the onus on you to keep that registration information up to date every time you changed the SSID or swapped in something with a different MAC address? I'm not sure I would be. The ethics around Google's behavior aside - this is a tricky problem to solve. Edit: Why the downvotes? I'd really like for people that disagree to engage and tell me where I am either wrong or not arguing in good faith. If you believe this is a Google specific problem or somehow an easy problem to solve under the current FCC regulatory regime I'd be happy to hear about it.
        ratww 5y ago
    - loudmax 5y ago
      Free stuff, like a free web browser? Or a free smartphone OS? If you don't want to be tracked by Google, don't use their software. Now, if you're having a hard time avoiding their software because it's become a de-facto standard that's a separate problem. The bottom line is that we shouldn't be in a position where we don't have a choice not to use software from Google (or Apple, or Microsoft, etc). As long as these companies are in a position to offer software that can't reasonably be avoided, you should expect them to optimize these offerings at the expense of their users.
      - ratww 5y ago
        But this whole discussion is not about software. I don't have to use their free browser, their free smartphone OS or even their search engine, but they will still freeload on my Wi-Fi for location tracking and will record my router location without consent, and the only way to opt-out is appending a stupid _nomap to the end of my ID.
        betterunix2 5y ago
        That is kind of like saying, "How dare you listen to me when I am shouting my name in public?!" You are broadcasting your SSID on an unlicensed band, all wifi stations in your area have been listening to and analyzing those transmissions, and your wifi stations (APs and client devices) have done the same with all your neighbors' wifi networks. In fact the wifi standard requires more than just monitoring nearby beacons -- wifi stations monitor all wifi frames being transmitted from nearby stations, even those connected to a different AP, to avoid interference. You don't want anyone to monitor your wifi network? Either don't use wifi, or switch to a band that will not propagate beyond your home (60 ghz).
        ratww 5y ago
        > "How dare you listen to me when I am shouting my name in public?!" Listening and putting it in a massive database along with other sensitive data, such as location, are two completely different things, though.
- CogitoCogito 5y ago
  > I'm trying to think of how one could do this in a way that wasn't even more intrusive? Not to do it.
  - oh_sigh 5y ago
    We haven't figured out how to make websites not be able to fingerprint you. Better not use the internet until we do.
    - Retric 5y ago
      We have figured out how to avoid being tracked. Hide your IP address behind Tor. Transmit identical information as a significant group of people. Don’t store information from websites. The issue is that degrades the web in ways unrelated to tracking.
      - NaturalPhallacy 5y ago
        >The issue is that degrades the web in ways unrelated to tracking. And so many sites, and CDNs treat those as hostile by default, and some outright refuse service. It's infuriating as a mere VPN user.
        paranoidrobot 5y ago
        I suspect that this is because a huge amount of traffic coming from those services is abusive. I know that's the reason we classed all traffic from those sources as suspicious unless they were willing to log in.
- hn8788 5y ago
  Instead of thinking "We can't think of a less intrusive way, so deal with it", how about "We can't think of a less intrusive way, so let's not do it until we do".
  - calvinmorrison 5y ago
    I frequently get something like "why would you want to do that" running my unconventional browser settings. It's like people can't even comprehend people don't want to get tracked by FAANG
    - jfrunyon 5y ago
      I'm not sure how "associating a publicly broadcast BSSID with coordinates" is tracking a person.
      - drofmij 5y ago
        This is probably related to them getting in trouble for scanning networks while mapping. If I remember correctly they were doing a bit of port scanning and looking for share drives in an attempt to id which SSID was attached to which address. This is probably part of the wrist slap they got from FCC. "Oh well you can totally opt out now so it's ok"
      - bingidingi 5y ago
        If I have a unique SSID (let's say, my social security number because why not at this point) and I move to a different apartment and keep the same SSID... then Google's effectively tracking a person. If you have basic address/name info you can even pinpoint who owns the SSID.
      - callmeal 5y ago
        >I'm not sure how "associating a publicly broadcast BSSID with coordinates" is tracking a person. But it's not just that is it? If you log in to a google site from that publicly broadcast BSSID, you will get tracked by association, even if you have your location tracking turned off.
- stefan_ 5y ago
  You can transfer lots of information elements in a beacon, you don't need to shit on the SSID.
  - jfrunyon 5y ago
    Okay, now how do users set their devices to transfer this non-standard information in the beacon?
    - stefan_ 5y ago
      The same way you configure everything? You check a box where you configured your SSID in the first place.
      - Sebb767 5y ago
        If you run OpenWRT you might have hope for this (assuming the firmware supports it). This would not land in your average consumer router for a few years, if at all.
        ocdtrekkie 5y ago
        I mean, if Google was as zealous about standardizing privacy as they are about standardizing ways to track people, Google could get that configuration option introduced to the firmware of most common consumer routers.
- iudqnolq 5y ago
  The guide says to open Google maps after making the change so that it can propagate. That makes me think it isn't that they ignore _nomaps, it's that they submit their locations to a database and clear the previous data for there. At that point it could just be a webpage that asks you for your location and SSID.
- utucuro 5y ago
  Actually, having read the opt-out method article and knowing the personal data protection law of my country due to professional needs, I can say that what Google is doing is illegal in certain cases here. If Google ends up personal data as defined by law here, which does include present location coupled with name, then that ends up being illegal without a detailed data protection declaration and withdrawable explicit consent granted before ANY data can be collected at all. Intrusivity is not important, convenience must not be allowed to trump legality though.
notriddle 5y ago
It doesn't seem hard to understand. They figured that SSIDs aren't private information, so having any method of opting-out at all is just a courtesy.
- stingraycharles 5y ago
  By that definition, IP addresses are also public information. It’s not about the SSID or IP itself, it’s about it being connected to an individual.
  - TheCapn 5y ago
    Its one of those cases where data becomes dangerous when there's enough of it. Google knows practically every SSID location in the developed world. Now your Android phone browsing and mapping every SSID it sees as you move about is a reliable "Location mapping" of the user even though they may have no GPS or have it disabled. You can map a person's movement through cities/towns just based on the SSIDs their device(s) saw as they moved about.
    - skybrian 5y ago
      You say that like it’s always a bad thing, but sometimes we actually do want to use our phones to find out our location, and GPS is often slow or doesn’t always work. The issue here is having control over when your phone looks up your location, not the existence of a database that makes it work.
      - mindslight 5y ago
        The existence of that database under the control of a surveillance company is the problem. If Google published the dataset so that many others could use it freely, then they would have an argument that they're just promulgating public data. However, by keeping it to themselves and forcing queries to go through Google (with a bunch of fine print attached), they're agglomerating personal data for their own private purpose.
taneq 5y ago
It's perfectly in line with all of the other Google policies which are thinly disguised versions of "we want your data and if you don't give it to us, we'll punish you."
- oblio 5y ago
  Simple example, at least in Google Maps on Android. They have some sort of activity tracking. If you enable that, you can save locations, so that, for example, you can "favorite" your home and your office for easy access. If you disable activity tracking, you can't save anything. Those two are totally unrelated, and you're still using Google Maps through your Google account, so there are 0 technical reasons they couldn't just persist your saved locations in the Google Cloud. They just don't do it to force you to let them track your location.
  - mateo1 5y ago
    To me the most infuriating practice is that if you don't enable your location when you open google maps they will passive aggressively position your view at the most inconvenient place possibly, some times in the middle of the atlantic, as if they can't tell which city you are in.
    - Nasrudith 5y ago
      Personally I consider that an odd form of "politeness". It is 'creepy' when you buy a large ticket item and ad networks try to seranade you with a demand you already fuffilled. They can geolocate by IP but instead choose to "look away". I guess they do that because those who aren't familiar with it would be freaked out at how close it got. Geo-IP is mostly just hilarious to me from how they get it off like when loging in to gmail in Pennsylvania saying there was a login attempt from Washington DC. It shows some respect that you don't want focus on your actual geography but I also do stuff like look at real life places to see how well it matched with my initial imagination.
      - tyingq 5y ago
oh_sigh 5y ago
How would you prove ownership of an SSID otherwise?
8note 5y ago
It sounds a lot like robots.txt
anfilt 5y ago
Just don't broadcast your SSID. While it still possible for google to probably scan for these I doubt they do.
NaturalPhallacy 5y ago
>Presumably the only reason they picked this strategy is that they know it is such an absolutely ridiculous step that nobody does it. Oh absolutely. But to play devil's advocate, your wifi device is basically an always broadcasting radio antenna that rarely moves or changes. And SSIDs are broadcast by design. It's a digital landmark. I bet there are a lot of other companies other than google using it too. And even if you used google's opt out, they're not going to care. So opting out is pretty pointless anyway. So while it feels invasive because we lack a sensory organ for radio, your router is constantly broadcasting (advertising?) itself as a part of normal operations. SSIDs aren't private information. It's more akin to an amateur radio callsign, except you can change it at will. And since they're no consistent convention for naming your wifi there are probably 10,000 "FBI surveillance van"s. The only useful data to an outsider is location. This was going to be utilized by someone, and probably already is by the NSA. So google doing it is no big surprise. Again, devil's advocate here, but SSIDs are broadcast on purpose. Sacrificing security for convenience as always when people are involved.
- deleted 5y ago
  [deleted]
- soraminazuki 5y ago
  By your logic, your house is a "landmark," so it'd be totally okay to surveil it. I don't think that flies.
  - aeraiC5m 5y ago
    Houses can indeed be landmarks. Why are you equating landmarks to surveillance. That makes zero sense. No one is surveilling you through your WiFi SSID.
    - just-ok 5y ago
      Except they are: Google undoubtedly uses the set of WiFi networks near you for location-based tracking on Android, even if your GPS is off.
hetspookjee 5y ago
Well Judging by the blog a person working in ads recently published it's perfectly fine to throw up these dark patterns and misleading terms in the name of "free internet". And to top it off half of their half million salary is donated so any residing moral debt is taken care off like so.
aconsult1 5y ago
Pretty sure in a few years people will have to name their kids John Notrack Doe as the only way to have FB stop ghosting them.
- crocodiletears 5y ago
  Being able to prevent that at all would be a massive improvement
DannyBee 5y ago
Yeah, i mean who else would ever do such a thing https://location.services.mozilla.com/optout https://location.services.mozilla.com/optout https://support.apple.com/en-us/HT207056 https://support.apple.com/en-us/HT207056 Presumably the only reason they picked this strategy is that they know it is such an absolutely ridiculous step that nobody does it. No, actually, i'm just kidding. Mozilla, for example, literally blames it all on everyone else in their page. You see, they are forced to do this because everyone else did it!

mattzito 5y ago

I'm trying to think of how one could do this in a way that wasn't even more intrusive? This way Google doesn't have to tie any identifying information about you to your SSID/AP, it can just silently discard the location data about those SSIDs. Otherwise people could abusively de-register SSIDs by doing the same sort of scanning Google is doing to improve location services, or have to force a user to authenticate and "claim" an SSID, which is much more intrusive. (disclosure: googler, but not in any way associated with any of this)

awakeasleep 5y ago
Opt-in
- whatshisface 5y ago
  Well, then nobody would do it. Maybe Google would have to pay them, or give them free stuff.
  - ocdtrekkie 5y ago
    If Google wants to use other people's stuff for their purposes, they should pay them. Not force them to jump through hoops to avoid Google abusing them.
    - betterunix2 5y ago
      How would that work? Keep in mind that we are talking about parts of the radio spectrum that were deliberately set aside for unlicensed use, without any sort of registration, centralized control, or reporting on the part of users. So how would Google or any other company know who to pay? Do you want to force users to register their APs, or to include some kind of payment information in wifi beacons? Or are you proposing that new restrictions be added to the ISM rules e.g. forbidding people from monitoring the band without first asking for permission from each station operator (note: this would completely break wifi)?
      - ocdtrekkie 5y ago
        I think a user registration system would make sense: People who wanted to register their APs are probably using Google Location Services, and the incentive is hence, self-serving. Businesses may want to register their APs to help customers' devices locate themselves at their buildings. And yes, Google could incentivize people to register in some way. One thing you'll notice is that the most valuable companies in the world seem incredibly reliant on free labor: They take for free what other companies used to pay for or pay staff to create or gather themselves.
        alyandon 5y ago
        Those FCC registration records would then be public information. Would you feel comfortable with your name, address and MAC + SSID of your wireless AP(s) being registered in a public database and the onus on you to keep that registration information up to date every time you changed the SSID or swapped in something with a different MAC address? I'm not sure I would be. The ethics around Google's behavior aside - this is a tricky problem to solve. Edit: Why the downvotes? I'd really like for people that disagree to engage and tell me where I am either wrong or not arguing in good faith. If you believe this is a Google specific problem or somehow an easy problem to solve under the current FCC regulatory regime I'd be happy to hear about it.
        ratww 5y ago
  - loudmax 5y ago
    Free stuff, like a free web browser? Or a free smartphone OS? If you don't want to be tracked by Google, don't use their software. Now, if you're having a hard time avoiding their software because it's become a de-facto standard that's a separate problem. The bottom line is that we shouldn't be in a position where we don't have a choice not to use software from Google (or Apple, or Microsoft, etc). As long as these companies are in a position to offer software that can't reasonably be avoided, you should expect them to optimize these offerings at the expense of their users.
    - ratww 5y ago
      But this whole discussion is not about software. I don't have to use their free browser, their free smartphone OS or even their search engine, but they will still freeload on my Wi-Fi for location tracking and will record my router location without consent, and the only way to opt-out is appending a stupid _nomap to the end of my ID.
      - betterunix2 5y ago
        That is kind of like saying, "How dare you listen to me when I am shouting my name in public?!" You are broadcasting your SSID on an unlicensed band, all wifi stations in your area have been listening to and analyzing those transmissions, and your wifi stations (APs and client devices) have done the same with all your neighbors' wifi networks. In fact the wifi standard requires more than just monitoring nearby beacons -- wifi stations monitor all wifi frames being transmitted from nearby stations, even those connected to a different AP, to avoid interference. You don't want anyone to monitor your wifi network? Either don't use wifi, or switch to a band that will not propagate beyond your home (60 ghz).
        ratww 5y ago
        > "How dare you listen to me when I am shouting my name in public?!" Listening and putting it in a massive database along with other sensitive data, such as location, are two completely different things, though.
CogitoCogito 5y ago
> I'm trying to think of how one could do this in a way that wasn't even more intrusive? Not to do it.
- oh_sigh 5y ago
  We haven't figured out how to make websites not be able to fingerprint you. Better not use the internet until we do.
  - Retric 5y ago
    We have figured out how to avoid being tracked. Hide your IP address behind Tor. Transmit identical information as a significant group of people. Don’t store information from websites. The issue is that degrades the web in ways unrelated to tracking.
    - NaturalPhallacy 5y ago
      >The issue is that degrades the web in ways unrelated to tracking. And so many sites, and CDNs treat those as hostile by default, and some outright refuse service. It's infuriating as a mere VPN user.
      - paranoidrobot 5y ago
        I suspect that this is because a huge amount of traffic coming from those services is abusive. I know that's the reason we classed all traffic from those sources as suspicious unless they were willing to log in.
hn8788 5y ago
Instead of thinking "We can't think of a less intrusive way, so deal with it", how about "We can't think of a less intrusive way, so let's not do it until we do".
- calvinmorrison 5y ago
  I frequently get something like "why would you want to do that" running my unconventional browser settings. It's like people can't even comprehend people don't want to get tracked by FAANG
  - jfrunyon 5y ago
    I'm not sure how "associating a publicly broadcast BSSID with coordinates" is tracking a person.
    - drofmij 5y ago
      This is probably related to them getting in trouble for scanning networks while mapping. If I remember correctly they were doing a bit of port scanning and looking for share drives in an attempt to id which SSID was attached to which address. This is probably part of the wrist slap they got from FCC. "Oh well you can totally opt out now so it's ok"
    - bingidingi 5y ago
      If I have a unique SSID (let's say, my social security number because why not at this point) and I move to a different apartment and keep the same SSID... then Google's effectively tracking a person. If you have basic address/name info you can even pinpoint who owns the SSID.
    - callmeal 5y ago
      >I'm not sure how "associating a publicly broadcast BSSID with coordinates" is tracking a person. But it's not just that is it? If you log in to a google site from that publicly broadcast BSSID, you will get tracked by association, even if you have your location tracking turned off.
stefan_ 5y ago
You can transfer lots of information elements in a beacon, you don't need to shit on the SSID.
- jfrunyon 5y ago
  Okay, now how do users set their devices to transfer this non-standard information in the beacon?
  - stefan_ 5y ago
    The same way you configure everything? You check a box where you configured your SSID in the first place.
    - Sebb767 5y ago
      If you run OpenWRT you might have hope for this (assuming the firmware supports it). This would not land in your average consumer router for a few years, if at all.
      - ocdtrekkie 5y ago
        I mean, if Google was as zealous about standardizing privacy as they are about standardizing ways to track people, Google could get that configuration option introduced to the firmware of most common consumer routers.
iudqnolq 5y ago
The guide says to open Google maps after making the change so that it can propagate. That makes me think it isn't that they ignore _nomaps, it's that they submit their locations to a database and clear the previous data for there. At that point it could just be a webpage that asks you for your location and SSID.
utucuro 5y ago
Actually, having read the opt-out method article and knowing the personal data protection law of my country due to professional needs, I can say that what Google is doing is illegal in certain cases here. If Google ends up personal data as defined by law here, which does include present location coupled with name, then that ends up being illegal without a detailed data protection declaration and withdrawable explicit consent granted before ANY data can be collected at all. Intrusivity is not important, convenience must not be allowed to trump legality though.

notriddle 5y ago

It doesn't seem hard to understand. They figured that SSIDs aren't private information, so having any method of opting-out at all is just a courtesy.

stingraycharles 5y ago
By that definition, IP addresses are also public information. It’s not about the SSID or IP itself, it’s about it being connected to an individual.
- TheCapn 5y ago
  Its one of those cases where data becomes dangerous when there's enough of it. Google knows practically every SSID location in the developed world. Now your Android phone browsing and mapping every SSID it sees as you move about is a reliable "Location mapping" of the user even though they may have no GPS or have it disabled. You can map a person's movement through cities/towns just based on the SSIDs their device(s) saw as they moved about.
  - skybrian 5y ago
    You say that like it’s always a bad thing, but sometimes we actually do want to use our phones to find out our location, and GPS is often slow or doesn’t always work. The issue here is having control over when your phone looks up your location, not the existence of a database that makes it work.
    - mindslight 5y ago
      The existence of that database under the control of a surveillance company is the problem. If Google published the dataset so that many others could use it freely, then they would have an argument that they're just promulgating public data. However, by keeping it to themselves and forcing queries to go through Google (with a bunch of fine print attached), they're agglomerating personal data for their own private purpose.

taneq 5y ago

It's perfectly in line with all of the other Google policies which are thinly disguised versions of "we want your data and if you don't give it to us, we'll punish you."

oblio 5y ago
Simple example, at least in Google Maps on Android. They have some sort of activity tracking. If you enable that, you can save locations, so that, for example, you can "favorite" your home and your office for easy access. If you disable activity tracking, you can't save anything. Those two are totally unrelated, and you're still using Google Maps through your Google account, so there are 0 technical reasons they couldn't just persist your saved locations in the Google Cloud. They just don't do it to force you to let them track your location.
- mateo1 5y ago
  To me the most infuriating practice is that if you don't enable your location when you open google maps they will passive aggressively position your view at the most inconvenient place possibly, some times in the middle of the atlantic, as if they can't tell which city you are in.
  - Nasrudith 5y ago
    Personally I consider that an odd form of "politeness". It is 'creepy' when you buy a large ticket item and ad networks try to seranade you with a demand you already fuffilled. They can geolocate by IP but instead choose to "look away". I guess they do that because those who aren't familiar with it would be freaked out at how close it got. Geo-IP is mostly just hilarious to me from how they get it off like when loging in to gmail in Pennsylvania saying there was a login attempt from Washington DC. It shows some respect that you don't want focus on your actual geography but I also do stuff like look at real life places to see how well it matched with my initial imagination.
    - tyingq 5y ago

oh_sigh 5y ago

How would you prove ownership of an SSID otherwise?

8note 5y ago

It sounds a lot like robots.txt

anfilt 5y ago

Just don't broadcast your SSID. While it still possible for google to probably scan for these I doubt they do.

NaturalPhallacy 5y ago

>Presumably the only reason they picked this strategy is that they know it is such an absolutely ridiculous step that nobody does it. Oh absolutely. But to play devil's advocate, your wifi device is basically an always broadcasting radio antenna that rarely moves or changes. And SSIDs are broadcast by design. It's a digital landmark. I bet there are a lot of other companies other than google using it too. And even if you used google's opt out, they're not going to care. So opting out is pretty pointless anyway. So while it feels invasive because we lack a sensory organ for radio, your router is constantly broadcasting (advertising?) itself as a part of normal operations. SSIDs aren't private information. It's more akin to an amateur radio callsign, except you can change it at will. And since they're no consistent convention for naming your wifi there are probably 10,000 "FBI surveillance van"s. The only useful data to an outsider is location. This was going to be utilized by someone, and probably already is by the NSA. So google doing it is no big surprise. Again, devil's advocate here, but SSIDs are broadcast on purpose. Sacrificing security for convenience as always when people are involved.

deleted 5y ago
[deleted]
soraminazuki 5y ago
By your logic, your house is a "landmark," so it'd be totally okay to surveil it. I don't think that flies.
- aeraiC5m 5y ago
  Houses can indeed be landmarks. Why are you equating landmarks to surveillance. That makes zero sense. No one is surveilling you through your WiFi SSID.
  - just-ok 5y ago
    Except they are: Google undoubtedly uses the set of WiFi networks near you for location-based tracking on Android, even if your GPS is off.

hetspookjee 5y ago

Well Judging by the blog a person working in ads recently published it's perfectly fine to throw up these dark patterns and misleading terms in the name of "free internet". And to top it off half of their half million salary is donated so any residing moral debt is taken care off like so.

aconsult1 5y ago

Pretty sure in a few years people will have to name their kids John Notrack Doe as the only way to have FB stop ghosting them.

crocodiletears 5y ago
Being able to prevent that at all would be a massive improvement

DannyBee 5y ago

Yeah, i mean who else would ever do such a thing https://location.services.mozilla.com/optout https://location.services.mozilla.com/optout https://support.apple.com/en-us/HT207056 https://support.apple.com/en-us/HT207056 Presumably the only reason they picked this strategy is that they know it is such an absolutely ridiculous step that nobody does it. No, actually, i'm just kidding. Mozilla, for example, literally blames it all on everyone else in their page. You see, they are forced to do this because everyone else did it!