8 ms·

I'm trying to think of how one could do this in a way that wasn't even more intrusive? This way Google doesn't have to tie any identifying information about yo

I'm trying to think of how one could do this in a way that wasn't even more intrusive? This way Google doesn't have to tie any identifying information about you to your SSID/AP, it can just silently discard the location data about those SSIDs. Otherwise people could abusively de-register SSIDs by doing the same sort of scanning Google is doing to improve location services, or have to force a user to authenticate and "claim" an SSID, which is much more intrusive. (disclosure: googler, but not in any way associated with any of this)

awakeasleep 5y ago
Opt-in
- whatshisface 5y ago
  Well, then nobody would do it. Maybe Google would have to pay them, or give them free stuff.
  - ocdtrekkie 5y ago
    If Google wants to use other people's stuff for their purposes, they should pay them. Not force them to jump through hoops to avoid Google abusing them.
    - betterunix2 5y ago
      How would that work? Keep in mind that we are talking about parts of the radio spectrum that were deliberately set aside for unlicensed use, without any sort of registration, centralized control, or reporting on the part of users. So how would Google or any other company know who to pay? Do you want to force users to register their APs, or to include some kind of payment information in wifi beacons? Or are you proposing that new restrictions be added to the ISM rules e.g. forbidding people from monitoring the band without first asking for permission from each station operator (note: this would completely break wifi)?
      - ocdtrekkie 5y ago
        I think a user registration system would make sense: People who wanted to register their APs are probably using Google Location Services, and the incentive is hence, self-serving. Businesses may want to register their APs to help customers' devices locate themselves at their buildings. And yes, Google could incentivize people to register in some way. One thing you'll notice is that the most valuable companies in the world seem incredibly reliant on free labor: They take for free what other companies used to pay for or pay staff to create or gather themselves.
        alyandon 5y ago
        Those FCC registration records would then be public information. Would you feel comfortable with your name, address and MAC + SSID of your wireless AP(s) being registered in a public database and the onus on you to keep that registration information up to date every time you changed the SSID or swapped in something with a different MAC address? I'm not sure I would be. The ethics around Google's behavior aside - this is a tricky problem to solve. Edit: Why the downvotes? I'd really like for people that disagree to engage and tell me where I am either wrong or not arguing in good faith. If you believe this is a Google specific problem or somehow an easy problem to solve under the current FCC regulatory regime I'd be happy to hear about it.
        ratww 5y ago
        There's no need for a database. Just add the suffix "_optin" to your SSDI and you're opted in. This is what they're currently requiring for the opt-out, I can't see why the same solution can't be used for opt-in...
        alyandon 5y ago
        I just don't see either approach (opt-in vs opt-out) being workable in practice though. Taking it to a bit of a silly extreme - what happens when 100 different companies want to use public SSID data? 100 different opt-in codes? 1 code for all? What if I want to allow 5 companies out of that 100 to use that data and exclude the other 95?
  - loudmax 5y ago
    Free stuff, like a free web browser? Or a free smartphone OS? If you don't want to be tracked by Google, don't use their software. Now, if you're having a hard time avoiding their software because it's become a de-facto standard that's a separate problem. The bottom line is that we shouldn't be in a position where we don't have a choice not to use software from Google (or Apple, or Microsoft, etc). As long as these companies are in a position to offer software that can't reasonably be avoided, you should expect them to optimize these offerings at the expense of their users.
    - ratww 5y ago
      But this whole discussion is not about software. I don't have to use their free browser, their free smartphone OS or even their search engine, but they will still freeload on my Wi-Fi for location tracking and will record my router location without consent, and the only way to opt-out is appending a stupid _nomap to the end of my ID.
      - betterunix2 5y ago
        That is kind of like saying, "How dare you listen to me when I am shouting my name in public?!" You are broadcasting your SSID on an unlicensed band, all wifi stations in your area have been listening to and analyzing those transmissions, and your wifi stations (APs and client devices) have done the same with all your neighbors' wifi networks. In fact the wifi standard requires more than just monitoring nearby beacons -- wifi stations monitor all wifi frames being transmitted from nearby stations, even those connected to a different AP, to avoid interference. You don't want anyone to monitor your wifi network? Either don't use wifi, or switch to a band that will not propagate beyond your home (60 ghz).
        ratww 5y ago
        > "How dare you listen to me when I am shouting my name in public?!" Listening and putting it in a massive database along with other sensitive data, such as location, are two completely different things, though.
CogitoCogito 5y ago
> I'm trying to think of how one could do this in a way that wasn't even more intrusive? Not to do it.
- oh_sigh 5y ago
  We haven't figured out how to make websites not be able to fingerprint you. Better not use the internet until we do.
  - Retric 5y ago
    We have figured out how to avoid being tracked. Hide your IP address behind Tor. Transmit identical information as a significant group of people. Don’t store information from websites. The issue is that degrades the web in ways unrelated to tracking.
    - NaturalPhallacy 5y ago
      >The issue is that degrades the web in ways unrelated to tracking. And so many sites, and CDNs treat those as hostile by default, and some outright refuse service. It's infuriating as a mere VPN user.
      - paranoidrobot 5y ago
        I suspect that this is because a huge amount of traffic coming from those services is abusive. I know that's the reason we classed all traffic from those sources as suspicious unless they were willing to log in.
hn8788 5y ago
Instead of thinking "We can't think of a less intrusive way, so deal with it", how about "We can't think of a less intrusive way, so let's not do it until we do".
- calvinmorrison 5y ago
  I frequently get something like "why would you want to do that" running my unconventional browser settings. It's like people can't even comprehend people don't want to get tracked by FAANG
  - jfrunyon 5y ago
    I'm not sure how "associating a publicly broadcast BSSID with coordinates" is tracking a person.
    - drofmij 5y ago
      This is probably related to them getting in trouble for scanning networks while mapping. If I remember correctly they were doing a bit of port scanning and looking for share drives in an attempt to id which SSID was attached to which address. This is probably part of the wrist slap they got from FCC. "Oh well you can totally opt out now so it's ok"
    - bingidingi 5y ago
      If I have a unique SSID (let's say, my social security number because why not at this point) and I move to a different apartment and keep the same SSID... then Google's effectively tracking a person. If you have basic address/name info you can even pinpoint who owns the SSID.
    - callmeal 5y ago
      >I'm not sure how "associating a publicly broadcast BSSID with coordinates" is tracking a person. But it's not just that is it? If you log in to a google site from that publicly broadcast BSSID, you will get tracked by association, even if you have your location tracking turned off.
stefan_ 5y ago
You can transfer lots of information elements in a beacon, you don't need to shit on the SSID.
- jfrunyon 5y ago
  Okay, now how do users set their devices to transfer this non-standard information in the beacon?
  - stefan_ 5y ago
    The same way you configure everything? You check a box where you configured your SSID in the first place.
    - Sebb767 5y ago
      If you run OpenWRT you might have hope for this (assuming the firmware supports it). This would not land in your average consumer router for a few years, if at all.
      - ocdtrekkie 5y ago
        I mean, if Google was as zealous about standardizing privacy as they are about standardizing ways to track people, Google could get that configuration option introduced to the firmware of most common consumer routers.
iudqnolq 5y ago
The guide says to open Google maps after making the change so that it can propagate. That makes me think it isn't that they ignore _nomaps, it's that they submit their locations to a database and clear the previous data for there. At that point it could just be a webpage that asks you for your location and SSID.
utucuro 5y ago
Actually, having read the opt-out method article and knowing the personal data protection law of my country due to professional needs, I can say that what Google is doing is illegal in certain cases here. If Google ends up personal data as defined by law here, which does include present location coupled with name, then that ends up being illegal without a detailed data protection declaration and withdrawable explicit consent granted before ANY data can be collected at all. Intrusivity is not important, convenience must not be allowed to trump legality though.

awakeasleep 5y ago

Opt-in

whatshisface 5y ago
Well, then nobody would do it. Maybe Google would have to pay them, or give them free stuff.
- ocdtrekkie 5y ago
  If Google wants to use other people's stuff for their purposes, they should pay them. Not force them to jump through hoops to avoid Google abusing them.
  - betterunix2 5y ago
    How would that work? Keep in mind that we are talking about parts of the radio spectrum that were deliberately set aside for unlicensed use, without any sort of registration, centralized control, or reporting on the part of users. So how would Google or any other company know who to pay? Do you want to force users to register their APs, or to include some kind of payment information in wifi beacons? Or are you proposing that new restrictions be added to the ISM rules e.g. forbidding people from monitoring the band without first asking for permission from each station operator (note: this would completely break wifi)?
    - ocdtrekkie 5y ago
      I think a user registration system would make sense: People who wanted to register their APs are probably using Google Location Services, and the incentive is hence, self-serving. Businesses may want to register their APs to help customers' devices locate themselves at their buildings. And yes, Google could incentivize people to register in some way. One thing you'll notice is that the most valuable companies in the world seem incredibly reliant on free labor: They take for free what other companies used to pay for or pay staff to create or gather themselves.
      - alyandon 5y ago
        Those FCC registration records would then be public information. Would you feel comfortable with your name, address and MAC + SSID of your wireless AP(s) being registered in a public database and the onus on you to keep that registration information up to date every time you changed the SSID or swapped in something with a different MAC address? I'm not sure I would be. The ethics around Google's behavior aside - this is a tricky problem to solve. Edit: Why the downvotes? I'd really like for people that disagree to engage and tell me where I am either wrong or not arguing in good faith. If you believe this is a Google specific problem or somehow an easy problem to solve under the current FCC regulatory regime I'd be happy to hear about it.
        ratww 5y ago
        There's no need for a database. Just add the suffix "_optin" to your SSDI and you're opted in. This is what they're currently requiring for the opt-out, I can't see why the same solution can't be used for opt-in...
        alyandon 5y ago
        I just don't see either approach (opt-in vs opt-out) being workable in practice though. Taking it to a bit of a silly extreme - what happens when 100 different companies want to use public SSID data? 100 different opt-in codes? 1 code for all? What if I want to allow 5 companies out of that 100 to use that data and exclude the other 95?
- loudmax 5y ago
  Free stuff, like a free web browser? Or a free smartphone OS? If you don't want to be tracked by Google, don't use their software. Now, if you're having a hard time avoiding their software because it's become a de-facto standard that's a separate problem. The bottom line is that we shouldn't be in a position where we don't have a choice not to use software from Google (or Apple, or Microsoft, etc). As long as these companies are in a position to offer software that can't reasonably be avoided, you should expect them to optimize these offerings at the expense of their users.
  - ratww 5y ago
    But this whole discussion is not about software. I don't have to use their free browser, their free smartphone OS or even their search engine, but they will still freeload on my Wi-Fi for location tracking and will record my router location without consent, and the only way to opt-out is appending a stupid _nomap to the end of my ID.
    - betterunix2 5y ago
      That is kind of like saying, "How dare you listen to me when I am shouting my name in public?!" You are broadcasting your SSID on an unlicensed band, all wifi stations in your area have been listening to and analyzing those transmissions, and your wifi stations (APs and client devices) have done the same with all your neighbors' wifi networks. In fact the wifi standard requires more than just monitoring nearby beacons -- wifi stations monitor all wifi frames being transmitted from nearby stations, even those connected to a different AP, to avoid interference. You don't want anyone to monitor your wifi network? Either don't use wifi, or switch to a band that will not propagate beyond your home (60 ghz).
      - ratww 5y ago
        > "How dare you listen to me when I am shouting my name in public?!" Listening and putting it in a massive database along with other sensitive data, such as location, are two completely different things, though.

CogitoCogito 5y ago

> I'm trying to think of how one could do this in a way that wasn't even more intrusive? Not to do it.

oh_sigh 5y ago
We haven't figured out how to make websites not be able to fingerprint you. Better not use the internet until we do.
- Retric 5y ago
  We have figured out how to avoid being tracked. Hide your IP address behind Tor. Transmit identical information as a significant group of people. Don’t store information from websites. The issue is that degrades the web in ways unrelated to tracking.
  - NaturalPhallacy 5y ago
    >The issue is that degrades the web in ways unrelated to tracking. And so many sites, and CDNs treat those as hostile by default, and some outright refuse service. It's infuriating as a mere VPN user.
    - paranoidrobot 5y ago
      I suspect that this is because a huge amount of traffic coming from those services is abusive. I know that's the reason we classed all traffic from those sources as suspicious unless they were willing to log in.

hn8788 5y ago

Instead of thinking "We can't think of a less intrusive way, so deal with it", how about "We can't think of a less intrusive way, so let's not do it until we do".

calvinmorrison 5y ago
I frequently get something like "why would you want to do that" running my unconventional browser settings. It's like people can't even comprehend people don't want to get tracked by FAANG
- jfrunyon 5y ago
  I'm not sure how "associating a publicly broadcast BSSID with coordinates" is tracking a person.
  - drofmij 5y ago
    This is probably related to them getting in trouble for scanning networks while mapping. If I remember correctly they were doing a bit of port scanning and looking for share drives in an attempt to id which SSID was attached to which address. This is probably part of the wrist slap they got from FCC. "Oh well you can totally opt out now so it's ok"
  - bingidingi 5y ago
    If I have a unique SSID (let's say, my social security number because why not at this point) and I move to a different apartment and keep the same SSID... then Google's effectively tracking a person. If you have basic address/name info you can even pinpoint who owns the SSID.
  - callmeal 5y ago
    >I'm not sure how "associating a publicly broadcast BSSID with coordinates" is tracking a person. But it's not just that is it? If you log in to a google site from that publicly broadcast BSSID, you will get tracked by association, even if you have your location tracking turned off.

stefan_ 5y ago

You can transfer lots of information elements in a beacon, you don't need to shit on the SSID.

jfrunyon 5y ago
Okay, now how do users set their devices to transfer this non-standard information in the beacon?
- stefan_ 5y ago
  The same way you configure everything? You check a box where you configured your SSID in the first place.
  - Sebb767 5y ago
    If you run OpenWRT you might have hope for this (assuming the firmware supports it). This would not land in your average consumer router for a few years, if at all.
    - ocdtrekkie 5y ago
      I mean, if Google was as zealous about standardizing privacy as they are about standardizing ways to track people, Google could get that configuration option introduced to the firmware of most common consumer routers.

iudqnolq 5y ago

The guide says to open Google maps after making the change so that it can propagate. That makes me think it isn't that they ignore _nomaps, it's that they submit their locations to a database and clear the previous data for there. At that point it could just be a webpage that asks you for your location and SSID.

utucuro 5y ago

Actually, having read the opt-out method article and knowing the personal data protection law of my country due to professional needs, I can say that what Google is doing is illegal in certain cases here. If Google ends up personal data as defined by law here, which does include present location coupled with name, then that ends up being illegal without a detailed data protection declaration and withdrawable explicit consent granted before ANY data can be collected at all. Intrusivity is not important, convenience must not be allowed to trump legality though.