8 ms·

tl;dr: Your phone gives off a Bluetooth signal that often times is unique due to variation in manufacture. A motivated attacker could isolate what your phone's

tl;dr: Your phone gives off a Bluetooth signal that often times is unique due to variation in manufacture. A motivated attacker could isolate what your phone's pattern is (if it's unique enough) by following you to a few different locations and checking what pattern repeats. This is a lot less powerful than I expected from the title but perhaps I'm not thinking big enough. A powerful adversary could set up sniffers all over the city and track the population, I guess, but I imagine the value of this method goes down the more phones that are being distinguished (variability among millions of phones probably means a lot of overlap, especially considering it doesn't seem that variation in signal is consistent).

koolba 5y ago
I assumed that every store has been doing this for years. One of the major complaints of iOS 13 (or maybe 12?) was that it by default it automatically enabled Bluetooth every morning even when you manually disabled it.
- judge2020 5y ago
  It only re-enables auto-joining devices every morning, it doesn't re-enable the BT radio if you disable it in settings. Bluetooth stays on after you hit the control center toggle because most consumers want that button to mean "don't connect to any BT audio devices", not "disable connection to my apple watch".
  - mnadkvlb 5y ago
    not most consumers, “apple wants”.
  - jsilence 5y ago
    If you are sharing BT headphones between multiple devices this is horrible. I turn off BT on the device where I do not need the headphone to avoid BT connection confusion.
    - hnaccount_rng 5y ago
      That’s only because you don’t use AirPods. And I don’t actually mean that snarkingly. I’m a truly lazy person, so I bought AirPods just because I knew they’d work and I wouldn’t have to fiddle with them. But reading these kinds of replies, especially in a tech savvy forum, makes me realize how valuable these little conveniences are
      - rickdeckard 5y ago
        Tech savvy guy here. Would have been nicer of Apple to just contribute a generic improvement back to the Bluetooth Standard, instead of solving a problem by creating "AirPods Bluetooth" and split the market. Using that course, Google went and made Google-custom enhancements to Bluetooth as well, to apply nearly the same improvements to the user experience as Apple did. And now here we are, with a universal standard that should work across different products and industries, but for good user experience you now have to brand-match your Bluetooth devices... Really sad to watch common standards die. With all its flaws aside, I wonder if anything like Bluetooth would even be possible to happen today...
        jsilence 5y ago
        Bluetoth as a standard ist pretty botched, sadly. If I understood correctly it is a bunch of only loosely related protocols between major versions. And implementations often seem to be lacking. At least my experience with BT is horrible and over time loaded with hate and anger. Interesting to hear that Apple managed to solve the issues within their closed ecosystem. So at least a solution DOES exists. The world could be so much better! Agree that it would be nice it thos solutions could penetrate the non-Apple world also.
- deleted 5y ago
  [deleted]
- notjulianjaynes 5y ago
  Same here, I'm fairly certain that's a thing [1]. Anecdotally, I've started turning off wifi/Bluetooth in the parking lot before entering a big box store like Walmart, and it seems like I get less ads for stuff in the aisle of the store I walked down. Ironically, this method of tracking is one of the conter-arguments I've heard to the "Facebook is recording my conversations" theory. I don't know enough about it to understand how this attack is different than in-store phone tracking. [1] https://www.vox.com/platform/amp/recode/2019/12/19/21011527/retail-tracking-apps-wifi-bluetooth-facebook-ads https://www.vox.com/platform/amp/recode/2019/12/19/21011527/...
- sodality2 5y ago
  Did you disable it in the control panel or in settings? IIRC it used to temporarily disable it from control panel but permanently from regular settings.
  - mlok 5y ago
    Thank you for this information, it seems to work.
- uncletammy 5y ago
  It kind of astounds me that so many people are willing to use a product who's UI so blatently and unapologetically violates it's users consent. I would have immediately run for the hills.
  - Gigachad 5y ago
    Don’t care because it actually does what I want. I turn off Bluetooth or wifi usually because something isn’t working or I just want a quick way to disconnect from Bluetooth audio. I like that it turns it back on for me when I forget.
- GhettoComputers 5y ago
  It never turns off in control center in iOS. You only disconnect it from devices. https://www.lifewire.com/how-to-turn-off-bluetooth-on-phones-4171879 https://www.lifewire.com/how-to-turn-off-bluetooth-on-phones...
pessimizer 5y ago
> I imagine the value of this method goes down the more phones that are being distinguished (variability among millions of phones probably means a lot of overlap If you're building up profiles, wouldn't you build them up enough to be able to later disambiguate phones with identical signatures that got too close to each other? The devices are probably each going to more-or-less continue in their long-established habits after they part. I guess that adds a bit of irregular latency, because you'd often have to label some device/location pairs retrospectively.
- chasil 5y ago
  There is an app on F-Droid called Greentooth that is supposed to shut off Bluetooth after a period of inactivity. I've found that it is not reliable, and I try to turn it off myself. https://f-droid.org/en/packages/com.smilla.greentooth/ https://f-droid.org/en/packages/com.smilla.greentooth/
  - pmontra 5y ago
    I turn Bluetooth on (manually) when I get into my car and I turn it off when I leave. Same with WiFi and my house. That's because of battery and privacy. Sometimes I forget, it's more trouble than most people want to go through and it's feasible only because I don't have watches and headsets but it's worth it IMHO.
    - tinus_hn 5y ago
      Modern Bluetooth can run for years on a button cell battery. That’s just not an issue anymore.
monkeybutton 5y ago
Set up sniffers all over the city and track the population? Where I live has been doing exactly that for years! https://techcrunch.com/2016/12/19/heres-how-montreal-is-turning-to-bluetooth-to-address-traffic-congestion/ https://techcrunch.com/2016/12/19/heres-how-montreal-is-turn...
- walterbell 5y ago
  Alphabet/Google Sidewalk Labs has kiosks on NYC streets, each with dozens of sensors https://news.ycombinator.com/item?id=16214791 https://news.ycombinator.com/item?id=16214791
throwawayboise 5y ago
I keep Bluetooth off on my phone. Always have.
- tpxl 5y ago
  Do you really or is your phone lying to you? IIRC both iOS and Android still responded to beacons on some versions, even with Bluetooth set to "off" in the settings.
superjan 5y ago
Isn’t my phone already broadcasting a list of my favourite WiFi SSID’s?
- mPReDiToR 5y ago
  https://play.google.com/store/apps/details?id=be.uhasselt.privacypolice https://play.google.com/store/apps/details?id=be.uhasselt.pr... I don't know how good this is, can anyone comment? It's supposed to mitigate that leak.
- tinus_hn 5y ago
  No, but a device does broadcast a list of ‘hidden’ SSIDs you have set to auto connect. Does anybody still use these?
  - WelcomeShorty 5y ago
    You are wrong about the "hidden SSID's" unfortunately. ALL the remembered WiFi networks get broadcasted.
    - tinus_hn 5y ago
      Right, so we are to believe that Apple went through all of the trouble to randomize the MAC address, only to broadcast the literally hundreds of SSIDs I have stored over the years. And waste battery life doing so. And why? It isn’t necessary, the access points broadcast their SSID so you just need to listen to the radio to know what’s around you. I have looked for information on this but not found it. If this issue really exists, please provide a link to a description.
  - superjan 5y ago
    Ok. I recall that it used to be an issue, great if it is no longer.
- WelcomeShorty 5y ago
  Yes it does. And not just your favs, ALL of the SSID's of networks you (-r phone) has remembered.
quitit 5y ago
An adage of computer security: Direct access to a machine = no security. (paraphrased and grossly simplified here.) I feel this extends to surveillance of this type: the threat seems much less important if it can only be conducted when access to the individual is already required. Say we’ve followed some chap around and identified this issue with his phone or watch etc - and we can then keep tracking this chap on the proviso that we are nearby to confirm an ID, he has those items with him and we have our sensors ready and waiting. Like… why not just follow the guy then.
- johnchristopher 5y ago
  > An adage of computer security: Direct access to a machine = no security. (paraphrased and grossly simplified here.) What about an encrypted partition, unlocked at boot. If I give you my laptop, how is the data accessible ?
  - gmueckl 5y ago
    Are you expecting to get the laptop back? If so, the data will be accessible the moment you mount that partition again.
    - johnchristopher 5y ago
      I am not expecting it back. I give an encrypted laptop/ machine and I want the other party to prove that having access to the device = no security and so they can read data out of it. No if, no but: I give the machine, show me that having it=no security.
      - sideshowb 5y ago
        I think that's what (paraphrased and grossly simplified here.) means. In most cases the adversary would choose to use their physical access at a time when you will use it again afterwards, so they could install a hardware keylogger. Cases where you will never use the machine again are more the exception than the rule.
hnlmorg 5y ago
I think your cynicism is fair. In fact I'd go further and say I already expect people are already tracked around cities (by skin colour, facial recognition, clothing, travel card (for public transport heavy cities). Any digital signals (WiFi, BT) are just going to be extensions of those systems rather than anything revolutionary new surveillance measures.
karlkloss 5y ago
For sure a much higher risk of being tracked than the imaginary risk of being tracked by microchips in Covid-19 vaccines, that many anti-vaxxers fear so much. And yet they keep using their phones to spread lies and hate on Facebook.
tjpnz 5y ago
>A powerful adversary could set up sniffers all over the city and track the population, I guess, but I imagine the value of this method goes down the more phones that are being distinguished (variability among millions of phones probably means a lot of overlap, especially considering it doesn't seem that variation in signal is consistent). You may be able to achieve the same goal without exploiting this security weakness. A few years back I built a "people counter" app - it was mostly a learning exercise to see what I could do with the Android Bluetooth API, but I was also curious to see how useful a signal Bluetooth might be in finding the least crowded car on a packed commuter train. After a week of testing it on the ride home I had data to suggest that it was. I also found that based on MAC addresses and device names I was among the same group of strangers most nights of the week. And this was despite MAC address randomization which IIRC was already implemented in iDevices.
GhettoComputers 5y ago
Just buy the metadata of cellular devices. 100% tracking and they can’t ever get away unless they’re in airplane mode.
- jmnicolas 5y ago
  I always wondered if airplane mode is really 100% silent. I wish I had the tools & knowledge to test it. If I really needed this kind of discretion, I would still put the phone in a Faraday cage.
  - kortilla 5y ago
    On the cell radio likely. WiFi and Bluetooth are still fine.
  - GhettoComputers 5y ago
    Use this. https://www.rtl-sdr.com https://www.rtl-sdr.com
    - jmnicolas 5y ago
      There goes my weekend! Thanks :)
marcosdumay 5y ago
If you need to hack the physical layer of a protocol to identify a phone, you are doing something very wrong. I guess any wireless channel will have the same vulnerability, but your phone already identifies itself on a huge variety of ways with much more standard interfaces. By the way, you are already tracked countrywards. The only questions are if your phone operator is allowed to keep the data and whether it does.
jacquesm 5y ago
Why use sniffers when all you need is to get people to download some app on their phone that allows access to the bluetooth stack and then phone home the results? That way other phones will act as the receivers and finger printers without having to install anything at all. The phones fingerprint each other.

koolba 5y ago

I assumed that every store has been doing this for years. One of the major complaints of iOS 13 (or maybe 12?) was that it by default it automatically enabled Bluetooth every morning even when you manually disabled it.

judge2020 5y ago
It only re-enables auto-joining devices every morning, it doesn't re-enable the BT radio if you disable it in settings. Bluetooth stays on after you hit the control center toggle because most consumers want that button to mean "don't connect to any BT audio devices", not "disable connection to my apple watch".
- mnadkvlb 5y ago
  not most consumers, “apple wants”.
- jsilence 5y ago
  If you are sharing BT headphones between multiple devices this is horrible. I turn off BT on the device where I do not need the headphone to avoid BT connection confusion.
  - hnaccount_rng 5y ago
    That’s only because you don’t use AirPods. And I don’t actually mean that snarkingly. I’m a truly lazy person, so I bought AirPods just because I knew they’d work and I wouldn’t have to fiddle with them. But reading these kinds of replies, especially in a tech savvy forum, makes me realize how valuable these little conveniences are
    - rickdeckard 5y ago
      Tech savvy guy here. Would have been nicer of Apple to just contribute a generic improvement back to the Bluetooth Standard, instead of solving a problem by creating "AirPods Bluetooth" and split the market. Using that course, Google went and made Google-custom enhancements to Bluetooth as well, to apply nearly the same improvements to the user experience as Apple did. And now here we are, with a universal standard that should work across different products and industries, but for good user experience you now have to brand-match your Bluetooth devices... Really sad to watch common standards die. With all its flaws aside, I wonder if anything like Bluetooth would even be possible to happen today...
      - jsilence 5y ago
        Bluetoth as a standard ist pretty botched, sadly. If I understood correctly it is a bunch of only loosely related protocols between major versions. And implementations often seem to be lacking. At least my experience with BT is horrible and over time loaded with hate and anger. Interesting to hear that Apple managed to solve the issues within their closed ecosystem. So at least a solution DOES exists. The world could be so much better! Agree that it would be nice it thos solutions could penetrate the non-Apple world also.
deleted 5y ago
[deleted]
notjulianjaynes 5y ago
Same here, I'm fairly certain that's a thing [1]. Anecdotally, I've started turning off wifi/Bluetooth in the parking lot before entering a big box store like Walmart, and it seems like I get less ads for stuff in the aisle of the store I walked down. Ironically, this method of tracking is one of the conter-arguments I've heard to the "Facebook is recording my conversations" theory. I don't know enough about it to understand how this attack is different than in-store phone tracking. [1] https://www.vox.com/platform/amp/recode/2019/12/19/21011527/retail-tracking-apps-wifi-bluetooth-facebook-ads https://www.vox.com/platform/amp/recode/2019/12/19/21011527/...
sodality2 5y ago
Did you disable it in the control panel or in settings? IIRC it used to temporarily disable it from control panel but permanently from regular settings.
- mlok 5y ago
  Thank you for this information, it seems to work.
uncletammy 5y ago
It kind of astounds me that so many people are willing to use a product who's UI so blatently and unapologetically violates it's users consent. I would have immediately run for the hills.
- Gigachad 5y ago
  Don’t care because it actually does what I want. I turn off Bluetooth or wifi usually because something isn’t working or I just want a quick way to disconnect from Bluetooth audio. I like that it turns it back on for me when I forget.
GhettoComputers 5y ago
It never turns off in control center in iOS. You only disconnect it from devices. https://www.lifewire.com/how-to-turn-off-bluetooth-on-phones-4171879 https://www.lifewire.com/how-to-turn-off-bluetooth-on-phones...

pessimizer 5y ago

> I imagine the value of this method goes down the more phones that are being distinguished (variability among millions of phones probably means a lot of overlap If you're building up profiles, wouldn't you build them up enough to be able to later disambiguate phones with identical signatures that got too close to each other? The devices are probably each going to more-or-less continue in their long-established habits after they part. I guess that adds a bit of irregular latency, because you'd often have to label some device/location pairs retrospectively.

chasil 5y ago
There is an app on F-Droid called Greentooth that is supposed to shut off Bluetooth after a period of inactivity. I've found that it is not reliable, and I try to turn it off myself. https://f-droid.org/en/packages/com.smilla.greentooth/ https://f-droid.org/en/packages/com.smilla.greentooth/
- pmontra 5y ago
  I turn Bluetooth on (manually) when I get into my car and I turn it off when I leave. Same with WiFi and my house. That's because of battery and privacy. Sometimes I forget, it's more trouble than most people want to go through and it's feasible only because I don't have watches and headsets but it's worth it IMHO.
  - tinus_hn 5y ago
    Modern Bluetooth can run for years on a button cell battery. That’s just not an issue anymore.

monkeybutton 5y ago

Set up sniffers all over the city and track the population? Where I live has been doing exactly that for years! https://techcrunch.com/2016/12/19/heres-how-montreal-is-turning-to-bluetooth-to-address-traffic-congestion/ https://techcrunch.com/2016/12/19/heres-how-montreal-is-turn...

walterbell 5y ago
Alphabet/Google Sidewalk Labs has kiosks on NYC streets, each with dozens of sensors https://news.ycombinator.com/item?id=16214791 https://news.ycombinator.com/item?id=16214791

throwawayboise 5y ago

I keep Bluetooth off on my phone. Always have.

tpxl 5y ago
Do you really or is your phone lying to you? IIRC both iOS and Android still responded to beacons on some versions, even with Bluetooth set to "off" in the settings.

superjan 5y ago

Isn’t my phone already broadcasting a list of my favourite WiFi SSID’s?

mPReDiToR 5y ago
https://play.google.com/store/apps/details?id=be.uhasselt.privacypolice https://play.google.com/store/apps/details?id=be.uhasselt.pr... I don't know how good this is, can anyone comment? It's supposed to mitigate that leak.
tinus_hn 5y ago
No, but a device does broadcast a list of ‘hidden’ SSIDs you have set to auto connect. Does anybody still use these?
- WelcomeShorty 5y ago
  You are wrong about the "hidden SSID's" unfortunately. ALL the remembered WiFi networks get broadcasted.
  - tinus_hn 5y ago
    Right, so we are to believe that Apple went through all of the trouble to randomize the MAC address, only to broadcast the literally hundreds of SSIDs I have stored over the years. And waste battery life doing so. And why? It isn’t necessary, the access points broadcast their SSID so you just need to listen to the radio to know what’s around you. I have looked for information on this but not found it. If this issue really exists, please provide a link to a description.
- superjan 5y ago
  Ok. I recall that it used to be an issue, great if it is no longer.
WelcomeShorty 5y ago
Yes it does. And not just your favs, ALL of the SSID's of networks you (-r phone) has remembered.

quitit 5y ago

An adage of computer security: Direct access to a machine = no security. (paraphrased and grossly simplified here.) I feel this extends to surveillance of this type: the threat seems much less important if it can only be conducted when access to the individual is already required. Say we’ve followed some chap around and identified this issue with his phone or watch etc - and we can then keep tracking this chap on the proviso that we are nearby to confirm an ID, he has those items with him and we have our sensors ready and waiting. Like… why not just follow the guy then.

johnchristopher 5y ago
> An adage of computer security: Direct access to a machine = no security. (paraphrased and grossly simplified here.) What about an encrypted partition, unlocked at boot. If I give you my laptop, how is the data accessible ?
- gmueckl 5y ago
  Are you expecting to get the laptop back? If so, the data will be accessible the moment you mount that partition again.
  - johnchristopher 5y ago
    I am not expecting it back. I give an encrypted laptop/ machine and I want the other party to prove that having access to the device = no security and so they can read data out of it. No if, no but: I give the machine, show me that having it=no security.
    - sideshowb 5y ago
      I think that's what (paraphrased and grossly simplified here.) means. In most cases the adversary would choose to use their physical access at a time when you will use it again afterwards, so they could install a hardware keylogger. Cases where you will never use the machine again are more the exception than the rule.

hnlmorg 5y ago

I think your cynicism is fair. In fact I'd go further and say I already expect people are already tracked around cities (by skin colour, facial recognition, clothing, travel card (for public transport heavy cities). Any digital signals (WiFi, BT) are just going to be extensions of those systems rather than anything revolutionary new surveillance measures.

karlkloss 5y ago

For sure a much higher risk of being tracked than the imaginary risk of being tracked by microchips in Covid-19 vaccines, that many anti-vaxxers fear so much. And yet they keep using their phones to spread lies and hate on Facebook.

tjpnz 5y ago

>A powerful adversary could set up sniffers all over the city and track the population, I guess, but I imagine the value of this method goes down the more phones that are being distinguished (variability among millions of phones probably means a lot of overlap, especially considering it doesn't seem that variation in signal is consistent). You may be able to achieve the same goal without exploiting this security weakness. A few years back I built a "people counter" app - it was mostly a learning exercise to see what I could do with the Android Bluetooth API, but I was also curious to see how useful a signal Bluetooth might be in finding the least crowded car on a packed commuter train. After a week of testing it on the ride home I had data to suggest that it was. I also found that based on MAC addresses and device names I was among the same group of strangers most nights of the week. And this was despite MAC address randomization which IIRC was already implemented in iDevices.

GhettoComputers 5y ago

Just buy the metadata of cellular devices. 100% tracking and they can’t ever get away unless they’re in airplane mode.

jmnicolas 5y ago
I always wondered if airplane mode is really 100% silent. I wish I had the tools & knowledge to test it. If I really needed this kind of discretion, I would still put the phone in a Faraday cage.
- kortilla 5y ago
  On the cell radio likely. WiFi and Bluetooth are still fine.
- GhettoComputers 5y ago
  Use this. https://www.rtl-sdr.com https://www.rtl-sdr.com
  - jmnicolas 5y ago
    There goes my weekend! Thanks :)

marcosdumay 5y ago

If you need to hack the physical layer of a protocol to identify a phone, you are doing something very wrong. I guess any wireless channel will have the same vulnerability, but your phone already identifies itself on a huge variety of ways with much more standard interfaces. By the way, you are already tracked countrywards. The only questions are if your phone operator is allowed to keep the data and whether it does.

jacquesm 5y ago

Why use sniffers when all you need is to get people to download some app on their phone that allows access to the bluetooth stack and then phone home the results? That way other phones will act as the receivers and finger printers without having to install anything at all. The phones fingerprint each other.