3 ms·

How dare you write down my name, which I was shouting in public, in your diary?! How dare you write down where I was standing when I was shouting my name?! Re

How dare you write down my name, which I was shouting in public, in your diary?! How dare you write down where I was standing when I was shouting my name?! Respect my privacy!

ratww 5y ago
It's also not a fair comparison to equate a database containing the whole world's SSIDs and location data with a personal diary... Repeating what I said in other comment: What Google is doing is a cool hack and might be fully legit, but it's foolish to claim there's no potential privacy issues in it.
- betterunix2 5y ago
  I do not see how there are any privacy concerns here. We are talking about radio broadcasts in a band set aside to be a free-for-all (no licensing, no permissions, no coordination required -- the only limit is on transmitter power). Moreover, people have many options available to them; among other things, you can not use an SSID (BSSID-only wifi networks are common), you can reduce your transmission power and use directional antennas to prevent the signal from propagating beyond your home, you can use the 60Ghz band which will not propagate through walls, and if all else fails, you can just use wired connections. People who want privacy can have it without having to do anything extraordinary. Wifi is convenient because it is unlicensed and loosely regulated. The price of that convenience is that you have no particular claim to privacy with your wifi transmissions, and everyone knows it -- that is why we encrypt the contents of those transmissions. Building a database of AP locations is not a privacy issue at all -- it is no different from building a database of landmarks (or publishing a travel guide with a list of landmarks in various towns), or for that matter, creating a map by gathering information about roads/buildings/etc.
  - xvector 5y ago
    If there weren't privacy concerns, then the SSID API wouldn't be behind a Location permission toggle for iOS and Android. It's not just Google doing it - see https://wigle.net/ https://wigle.net/ with over 10B observations. So your privacy would be at risk even if Google didn't collect SSID/location information. Fundamentally, asking people not to do something has never been a security measure that's worked. You need to implement some tangible, real protections. We already have those in the case of SSIDs, namely, the SSID and AP information aren't accessible to an app without location permissions in modern operating systems.
    - betterunix2 5y ago
      You are talking about the privacy of a device user, who may want to prevent apps from learning the location of their own device (and that is the point of the location permission). The claimed privacy issue I was responding to has to do with the privacy of the owner of an AP whose SSID is included in the database.
      - xvector 5y ago
        How is this at all a privacy issue for the SSID owner? Are you putting PII in your SSID?
kortilla 5y ago
No, it’s more like “how dare you go around and record the license plate of every vehicle observable on the street and put it in a location/time database”. You’re right that it’s technically public, just like the license plate on a vehicle. However, there is still a privacy expectation that all of that localized data won’t be pulled into a massive database for correlation. It’s beyond the SSID, using your logic, it would also be fine if Google observed all of the client frames to track the locations of users that don’t use Google services. Randomized MACs aren’t usually used for home WiFi so this is completely feasible and well within your “privacy” framework.

How dare you write down my name, which I was shouting in public, in your diary?! How dare you write down where I was standing when I was shouting my name?! Respect my privacy!

ratww 5y ago

It's also not a fair comparison to equate a database containing the whole world's SSIDs and location data with a personal diary... Repeating what I said in other comment: What Google is doing is a cool hack and might be fully legit, but it's foolish to claim there's no potential privacy issues in it.

betterunix2 5y ago
I do not see how there are any privacy concerns here. We are talking about radio broadcasts in a band set aside to be a free-for-all (no licensing, no permissions, no coordination required -- the only limit is on transmitter power). Moreover, people have many options available to them; among other things, you can not use an SSID (BSSID-only wifi networks are common), you can reduce your transmission power and use directional antennas to prevent the signal from propagating beyond your home, you can use the 60Ghz band which will not propagate through walls, and if all else fails, you can just use wired connections. People who want privacy can have it without having to do anything extraordinary. Wifi is convenient because it is unlicensed and loosely regulated. The price of that convenience is that you have no particular claim to privacy with your wifi transmissions, and everyone knows it -- that is why we encrypt the contents of those transmissions. Building a database of AP locations is not a privacy issue at all -- it is no different from building a database of landmarks (or publishing a travel guide with a list of landmarks in various towns), or for that matter, creating a map by gathering information about roads/buildings/etc.
- xvector 5y ago
  If there weren't privacy concerns, then the SSID API wouldn't be behind a Location permission toggle for iOS and Android. It's not just Google doing it - see https://wigle.net/ https://wigle.net/ with over 10B observations. So your privacy would be at risk even if Google didn't collect SSID/location information. Fundamentally, asking people not to do something has never been a security measure that's worked. You need to implement some tangible, real protections. We already have those in the case of SSIDs, namely, the SSID and AP information aren't accessible to an app without location permissions in modern operating systems.
  - betterunix2 5y ago
    You are talking about the privacy of a device user, who may want to prevent apps from learning the location of their own device (and that is the point of the location permission). The claimed privacy issue I was responding to has to do with the privacy of the owner of an AP whose SSID is included in the database.
    - xvector 5y ago
      How is this at all a privacy issue for the SSID owner? Are you putting PII in your SSID?

kortilla 5y ago

No, it’s more like “how dare you go around and record the license plate of every vehicle observable on the street and put it in a location/time database”. You’re right that it’s technically public, just like the license plate on a vehicle. However, there is still a privacy expectation that all of that localized data won’t be pulled into a massive database for correlation. It’s beyond the SSID, using your logic, it would also be fine if Google observed all of the client frames to track the locations of users that don’t use Google services. Randomized MACs aren’t usually used for home WiFi so this is completely feasible and well within your “privacy” framework.