4 ms·

Google is mapping publicly broadcast wifi access points to provide location services to augment GPS (faster locks for example) or when GPS is unavailable due to

Google is mapping publicly broadcast wifi access points to provide location services to augment GPS (faster locks for example) or when GPS is unavailable due to location or device. It's a very useful service - if you use a smartphone with mapping software, you likely benefit from this on a daily basis without realizing it. Apple does the same thing, although they collect it from user's iphones and ipads: http://www.apple.com/pr/library/2011/04/27Apple-Q-A-on-Location-Data.html http://www.apple.com/pr/library/2011/04/27Apple-Q-A-on-Locat... One of the original companies that did this was skyhook and they also use vehicles driving around: http://www.skyhookwireless.com/howitworks/ http://www.skyhookwireless.com/howitworks/ Google is actually going above and beyond normal industry privacy protections by offering a reasonably simple opt-out. They are recommending that others in the industry do the same. Calling instead for an opt-in system effectively destroys this whole service's effectiveness for everyone.

dotBen 15y ago
You are absolutely right, an opt-in system would destroy the whole location-by-wifi-ssid service for everyone. ...but that doesn't create leverage or a good reason for having such a poor and inelegant opt-out. This is an "ends justifies the means" argument, which is in itself Machiavellian. From a different perspective, there are other ways Google could handle an opt-out list - such as letting people add their SSID/Mac Address to a central opt-out registry they maintain. This would be trivial to implement, but I would suggest that Google have intentionally created a high-friction solution of "-nomap" to your SSID simply to make it as difficult and unpalatable as possible. And that really stinks.
- gregable 15y ago
  For the average access point user, changing the SSID is probably the least difficult option. It also has the useful feature that it actually indicates the owner is the one taking the opt-out action, rather than someone else who can wardrive and opt-out access points for a region. The HN crowd might skew a little different distribution in their technical ability to do things like identify a mac adddress.
- gst 15y ago
  There are two problems with the MAC approach: 1) The amount of Mac addresses for each vendor is very limited. Blacklisting a few Mac addresses would therefore blacklist lots of routers. Combining this with the SSID doesn't really help that much, as many users will stick to the default SSID. (And if you require that users change their SSID to a non-default one you can as well require that they just add a given suffix). 2) In the EU there have not only been complaints about Google offering the data, but also about Google processing the data. So I guess they want to make sure that their streetview cars that log this data don't log opt-opt routers at all. It's simple to do if the SSID has such a suffix. It'd be much harder if the software system in the card would need to query a central opt-out database before processing a router's data.
  - dpark 15y ago
    >The amount of Mac addresses for each vendor is very limited. Blacklisting a few Mac addresses would therefore blacklist lots of routers. MAC addresses should be globally unique. If your hardware vendor is shipping lots of routers with a shared MAC, they've messed up really badly.
    - gst 15y ago
      They should, but in practice it seems they aren't. In the past (working at an ISP) I've seen collisions on Ethernet hardware (two Ethernet cards with the same MAC address). So if that even happens in a relatively small Ethernet, I assume that this will be fairly common if your address space includes each active WiFi router.
      - lotu 15y ago
        That has to mac address cloning where, the router clones a computer's Mac address; then that computer is given to someone else who connects it to the network.
      - dpark 15y ago
        I think lotu's probably right. I'd suspect users causing these collissions before I'd suspect that network hardware manufacturers don't know to allocate unique MAC addresses to each card. You can generally trust than a hardware-embedded MAC is unique. http://blogs.msdn.com/b/oldnewthing/archive/2004/02/11/71307.aspx http://blogs.msdn.com/b/oldnewthing/archive/2004/02/11/71307...
- cpeterso 15y ago
  > I would suggest that Google have intentionally created a high-friction solution of "-nomap" to your SSID simply to make it as difficult and unpalatable as possible. A serendipitous example of the difficulty of Google's opt-out "solution" is that the correct SSID suffix is "_nomap", not "-nomap"! The Icrontic article is incorrect. I would hope Google forgivingly matches any "*nomap" SSID. http://googleblog.blogspot.com/2011/11/greater-choice-for-wireless-access.html http://googleblog.blogspot.com/2011/11/greater-choice-for-wi...
- amartya916 15y ago
  I don't know why your comment is being down voted. It's perfectly okay for people on Hacker News to be expected to add "_nomap" to the SSID but for most people, they just won't even be aware that Google's collecting this data, let alone figure out how to opt-out. I love Google as a company but it seems that more and more of it seems to be getting shrouded behind lawyer speak. It makes me uncomfortable.
  - dotBen 15y ago
    I don't know why your comment is being down voted. Thank you, that's a kind comment. But this happens on almost every comment I leave: I get downvoted once or twice and then the comment slowly gets upvoted. I think I have a troll (or even a script) that downvotes new comments I make to HN. Sad.
rickmb 15y ago
No. Google is not going above and beyond normal privacy protections outside the US. Just because you can collect the data, doesn't mean you are allowed to. In countries with other definitions of privacy it can be considered a reasonable expectation the your AP's SSID is only visible to people within a small radius. The owners clearly didn't have the intention to have it collected by a major corporation, collated with other data about their location and then published world wide for entirely different purposes then for which the AP was set up. In many countries, the law protects people against those kind of unintended consequences, and several European authorities have made it clear that they consider this kind of use an invasion of privacy. And that is considered more important than multinational giant's ability to offer an "effective" service. You can argue the merits of this, but Google's stance of "just fucking opt-out then" is blatantly disrespectful.
- airlocksoftware 15y ago
  When it comes to privacy violations in the digital age, this is so far down the list of concerns that I don't understand why we're talking about it. Probably just because some politicians in (I believe it was) Germany misunderstood what it is and took legal action against Google. Facebook / other social networks, poorly secured databases, warrantless GPS tracking (in the U.S.), cell phone data being stored; these are all orders of magnitude more worrying and more likely to cause harm.
  - rickmb 15y ago
    Oh, I agree it's way down the list. But this attitude is exactly what I mean: nobody misunderstood anything. Really. Just because people have different values and priorities doesn't mean that they are too stupid to understand the issues. It certainly doesn't mean their laws can simply be ignored if you do business in their country. Anyway, I'm going to stop arguing that point, since apparently this place is turning into Reddit, and downvotes our now used just to bury other opinions.
- lotu 15y ago
  Personally I see this as being much less invasive then taking pictures of someone's house and posting the location of the picture. Which is pretty much Google Street View, are you opposed Street View as well?

dotBen 15y ago

You are absolutely right, an opt-in system would destroy the whole location-by-wifi-ssid service for everyone. ...but that doesn't create leverage or a good reason for having such a poor and inelegant opt-out. This is an "ends justifies the means" argument, which is in itself Machiavellian. From a different perspective, there are other ways Google could handle an opt-out list - such as letting people add their SSID/Mac Address to a central opt-out registry they maintain. This would be trivial to implement, but I would suggest that Google have intentionally created a high-friction solution of "-nomap" to your SSID simply to make it as difficult and unpalatable as possible. And that really stinks.

gregable 15y ago
For the average access point user, changing the SSID is probably the least difficult option. It also has the useful feature that it actually indicates the owner is the one taking the opt-out action, rather than someone else who can wardrive and opt-out access points for a region. The HN crowd might skew a little different distribution in their technical ability to do things like identify a mac adddress.
gst 15y ago
There are two problems with the MAC approach: 1) The amount of Mac addresses for each vendor is very limited. Blacklisting a few Mac addresses would therefore blacklist lots of routers. Combining this with the SSID doesn't really help that much, as many users will stick to the default SSID. (And if you require that users change their SSID to a non-default one you can as well require that they just add a given suffix). 2) In the EU there have not only been complaints about Google offering the data, but also about Google processing the data. So I guess they want to make sure that their streetview cars that log this data don't log opt-opt routers at all. It's simple to do if the SSID has such a suffix. It'd be much harder if the software system in the card would need to query a central opt-out database before processing a router's data.
- dpark 15y ago
  >The amount of Mac addresses for each vendor is very limited. Blacklisting a few Mac addresses would therefore blacklist lots of routers. MAC addresses should be globally unique. If your hardware vendor is shipping lots of routers with a shared MAC, they've messed up really badly.
  - gst 15y ago
    They should, but in practice it seems they aren't. In the past (working at an ISP) I've seen collisions on Ethernet hardware (two Ethernet cards with the same MAC address). So if that even happens in a relatively small Ethernet, I assume that this will be fairly common if your address space includes each active WiFi router.
    - lotu 15y ago
      That has to mac address cloning where, the router clones a computer's Mac address; then that computer is given to someone else who connects it to the network.
    - dpark 15y ago
      I think lotu's probably right. I'd suspect users causing these collissions before I'd suspect that network hardware manufacturers don't know to allocate unique MAC addresses to each card. You can generally trust than a hardware-embedded MAC is unique. http://blogs.msdn.com/b/oldnewthing/archive/2004/02/11/71307.aspx http://blogs.msdn.com/b/oldnewthing/archive/2004/02/11/71307...
cpeterso 15y ago
> I would suggest that Google have intentionally created a high-friction solution of "-nomap" to your SSID simply to make it as difficult and unpalatable as possible. A serendipitous example of the difficulty of Google's opt-out "solution" is that the correct SSID suffix is "_nomap", not "-nomap"! The Icrontic article is incorrect. I would hope Google forgivingly matches any "*nomap" SSID. http://googleblog.blogspot.com/2011/11/greater-choice-for-wireless-access.html http://googleblog.blogspot.com/2011/11/greater-choice-for-wi...
amartya916 15y ago
I don't know why your comment is being down voted. It's perfectly okay for people on Hacker News to be expected to add "_nomap" to the SSID but for most people, they just won't even be aware that Google's collecting this data, let alone figure out how to opt-out. I love Google as a company but it seems that more and more of it seems to be getting shrouded behind lawyer speak. It makes me uncomfortable.
- dotBen 15y ago
  I don't know why your comment is being down voted. Thank you, that's a kind comment. But this happens on almost every comment I leave: I get downvoted once or twice and then the comment slowly gets upvoted. I think I have a troll (or even a script) that downvotes new comments I make to HN. Sad.

rickmb 15y ago

No. Google is not going above and beyond normal privacy protections outside the US. Just because you can collect the data, doesn't mean you are allowed to. In countries with other definitions of privacy it can be considered a reasonable expectation the your AP's SSID is only visible to people within a small radius. The owners clearly didn't have the intention to have it collected by a major corporation, collated with other data about their location and then published world wide for entirely different purposes then for which the AP was set up. In many countries, the law protects people against those kind of unintended consequences, and several European authorities have made it clear that they consider this kind of use an invasion of privacy. And that is considered more important than multinational giant's ability to offer an "effective" service. You can argue the merits of this, but Google's stance of "just fucking opt-out then" is blatantly disrespectful.

airlocksoftware 15y ago
When it comes to privacy violations in the digital age, this is so far down the list of concerns that I don't understand why we're talking about it. Probably just because some politicians in (I believe it was) Germany misunderstood what it is and took legal action against Google. Facebook / other social networks, poorly secured databases, warrantless GPS tracking (in the U.S.), cell phone data being stored; these are all orders of magnitude more worrying and more likely to cause harm.
- rickmb 15y ago
  Oh, I agree it's way down the list. But this attitude is exactly what I mean: nobody misunderstood anything. Really. Just because people have different values and priorities doesn't mean that they are too stupid to understand the issues. It certainly doesn't mean their laws can simply be ignored if you do business in their country. Anyway, I'm going to stop arguing that point, since apparently this place is turning into Reddit, and downvotes our now used just to bury other opinions.
lotu 15y ago
Personally I see this as being much less invasive then taking pictures of someone's house and posting the location of the picture. Which is pretty much Google Street View, are you opposed Street View as well?