6 ms·
Because of these databases if I get near you when you're using your computer, I can tell where you live: Your computer will poll for the SSID it's setup to aut
by nullc 5y ago
Because of these databases if I get near you when you're using your computer, I can tell where you live:
Your computer will poll for the SSID it's setup to auto-associate to (as they may be hidden). I get the SSID of your home network, and look it up in the database.
How creepy is it that these two not very privacy interrupting things -- collecting observed SSID in the wild, and your laptop attempting to connect to things it knows essentially broadcasts your home address when you're at a conference or a coffee shop? Hope you never have a stalker.
Worse, google's "opt out" procedure makes your SSID more unique and makes this attack even more effective.
- efraim 5y agoHow do you look it up in their database?
- fny 5y agoHere's one: https://wigle.net https://wigle.net
- onionisafruit 5y agoI just queried my home ssid on there. I thought it was a pretty unique pun, but 216 other access points have the same ssid. If my phone was probing for it then you could narrow me down quite a bit, but you would need more than that.
- lazide 5y agoIf you used the other SSIDs your phone was looking for and cross referenced, I bet confidence could get a lot closer to certain - 99%?
- modderation 5y agoI'd agree that a basic mapping of SSID name to approximate location is a bit useless on its own, but it can be combined with other information to narrow down your physical location. Geographically speaking, how were those SSID's distributed? Were they spread all around the world, across the continent, or were they all in the same city? For example, if your home SSID was known and those 216 SSID's were spread around the world, your home could likely be narrowed down based on some general facts from forum posts. "You spell honor with a U! You often complain about the rain on the forums, and those posts came from that ISP's IP block! According to the public coverage maps for that ISP in that English-speaking country that uses British spellings, your wireless network overlaps with this side of the street, give or take 30m. Let's check it out!" Paranoid fantasy? I truly hope so.
- nullc 5y agoright, but probably I can make it unique knowing a town name or just one or two extra things about you.
- jagger27 5y agoI love how it picks up in-flight WiFi.
- ruined 5y agothrough the api https://developers.google.com/maps/documentation/geolocation/intro https://developers.google.com/maps/documentation/geolocation... there are also many open source wifi location databases that can be downloaded and queried locally devices listening to ssid broadcasts for this purpose are common at grocery stores, malls, political protests, and more
- onionisafruit 5y agoThat API requires the MAC address of a wifi access point. You can't get that from a client probing for a hidden ssid.
- nullc 5y agoIt's commercially available. Joe Stalker, however, probably won't get it from google. Unfortunately there are many other databases, including ones available at low cost (or free: https://wigle.net/ https://wigle.net/ ) which the stalker is more likely to use, unless they work at google. And when you add "nomap" to turn off google's tracking you'll make your SSID more unique and trackable in every other database.
- smsm42 5y agoRich Joe Stalker probably would. Not directly from google, maybe, but from a company that gets it from a company that gets it from google.
- SamWhited 5y agoRight, Joe Stalker won't get it from Google. Joe Stalker will get it from the unprotected S3 bucket of the company that got it from Google.
- Scoundreller 5y agoYou’re broadcasting more than your ssid, but your base station MAC too. Unless you clone that too. Since ssid is used as a seed in encryption, there’s value in making it unique.
- nullc 5y agoif you use a strong passphrase the unique ssid protection against a table doesn't matter, but it's a worthwhile point to raise.
- gruez 5y ago>Your computer will poll for the SSID it's setup to auto-associate to (as they may be hidden). I get the SSID of your home network, and look it up in the database. AFAIK this sort of polling only happens if your phone has hidden networks remembered. Also, the probe it sends is for the ESSID (human readable string), not the BSSID (mac address). Most databases (including google) only allows for lookup by BSSID not ESSID so doing that sort of lookup is non-trivial.
- nullc 5y ago> AFAIK this sort of polling only happens if your phone has hidden networks remembered. Alas, no when you have a SSID remembered it doesn't know if it's hidden or not. (well maybe apple has some privacy behavior for this). It's not only used for hidden networks: clients probe so they can quickly enumerate nearby access points so they can switch over to them fast if they lose connectivity.
- gruez 5y agoSource on this? A few years ago when the whole "people are tracking your phones using wifi probes!" story got popular I ran packet captures on an android and ios device and found that neither made directed probe requests (ie. the kind that contained SSIDs). The man page for wpa_supplicant (which is used for android) seems to confirm this: scan_ssid SSID scan technique; 0 (default) or 1. Technique 0 scans for the SSID using a broadcast Probe Request frame while 1 uses a directed Probe Request frame. Access points that cloak themselves by not broadcasting their SSID require technique 1, but beware that this scheme can cause scanning to take longer to complete. https://www.daemon-systems.org/man/wpa_supplicant.conf.5.html https://www.daemon-systems.org/man/wpa_supplicant.conf.5.htm...
- jfrankamp 5y agoOk so putting this all together, if you run a hidden network at home that means your phone HAS to use a directed probe request to find that network which it will keep trying to do when you are out and about. Am I reading that right? If so the best way to have a phone that doesn't leak is to have a home network that does... maybe?
- admax88q 5y agoSounds like a vulnerability in the wifi client betraying your preferred ssid names and therefore address. Wifi needs an encrypted handshake
- blowfish721 5y agoSo basically go to the airport and look for vacationers and empty their home while they are away.
- sly010 5y agoIf you wear a T-shirt with your home address on it, people will learn your home address. The correct technical solution seems to be to NOT wear a t-shirt with your home address on it. (Don't use a device that broadcasts your home SSID in the subway)
- gpvos 5y agoUseless advice if just about every device with Wifi capability does so, and turning that feature off cripples its functionality.
- robotresearcher 5y agoSure, except that all your shirts have your address on by default without your knowledge (for >99% of people), and anyone can read your shirt under the jacket you reasonably believed to be opaque, in an instant, without line of sight and undetectably to you.
- warkdarrior 5y agoGreat comparison! /s So your suggestion is to turn off WiFi completely on your devices, right?
- c22 5y agoI have wifi off on my phone with a Tasker script that turns it on whenever I'm connected to one of the cell towers that services my neighborhood. The system works well and my battery life is amazing.
- tshaddox 5y agoInterestingly it used to be that someone would (for free and without solicitation) drop a book on my doorstep that contained a list of thousands of people's names along with their home address and telephone number. The last time I remember this happening was only 10 years ago. It's fascinating how our threat models regarding privacy have apparently changed so significantly.
- tedivm 5y agoYou're acting like people couldn't opt out of phone books, but it turns out that was actually a very common thing to do.
- seoaeu 5y agoIf I recall correctly, the phone books even included instructions on them of how to opt out. And given that they were broadly distributed it was very apparent to people that opting out was necessary if they were worried about being stalked, etc.
- kxrm 5y agoYou could opt out, I used to, however I had to pay a fee to opt out. At the time I did it, it added $1 to my bill.
- nullc 5y agoI recall there being two levels, unlisted and unpublished numbers and one you had to pay for but the other IIRC you didn't.
- drivebycomment 5y agotshaddox didn't say anything to imply that people couldn't opt out, so I think you're beating a strawman. They pointed out the seeming change in expectations in this thread (where SSID location mapping collection being opt-out is outrage) vs the phone book (which, sensitive PII was broadly shared by a profit-motivated entity that had no relationship with you and you have to opt out to not be included). If anything, SSID location is generally less sensitive than your name + phone number + city.
- notatoad 5y agoso if i'm understanding the threat model correctly here, it's based on the uniqueness of your home SSID. a privacy-preserving thing to do would be to choose an SSID that is shared by many other people, but not so many other people that your neighbours share it... is there any services that coordinate this?
- syntheticnature 5y agoThe router manufacturers do, as I was once surprised when my computer was complaining about a friend's wifi -- turns out that they had the same, manufacturer-driven SSID as my mother.
- syntheticnature 5y agoHaving noted the WiGLE database I decided to give their mutual Netgear-provided SSID a spin. Over fifty thousand results. So you could do worse than just name your access point NETGEAR followed by a two-digit number. Of course, your laptop might decide lots of other networks are yours, but it won't have the password for them.
- deleted 5y ago[deleted]