3 ms·

This is also why I replace all of my APs when I move (new BSSIDs) and don’t put identifying information like phone numbers, names, or domains in SSIDs.

by sneak 2y ago

ssl-3 2y ago
Why is that important to you? (And do you change the MAC addresses of your bluetooth devices, too? Some of us do gather up bluetooth location information, as well.)
- sneak 2y ago
  Because I don’t want my residential location moves being tracked, as the person who goes from zip code A to zip code B to zip code C is possibly a unique track. I don’t use much bluetooth at home. Zigbee is becoming an issue, but I haven’t moved since I’ve set it up.
  - lotsofpulp 2y ago
    In the US, I would assume your employer (via payroll or “work number”, or your banks/credit cards/credit reporting agencies, or even retailers like Amazon or Walmart are selling that information. Or the USPS when you let them know where to forward your mail to after you move: https://www.forbes.com/sites/adamtanner/2013/07/08/how-the-post-office-sells-your-new-address-with-anyone-who-pays-and-the-little-known-loophole-to-opt-out/ https://www.forbes.com/sites/adamtanner/2013/07/08/how-the-p... Edit: and of course, as kstrauser points out, voter registration records.
    - sneak 2y ago
      None of those organizations ever receive my primary residential address, only my tertiary one. Fortunately in the US you are allowed to have more than one home. Absolutely nothing with my name on it goes to where I usually sleep. To divulge sensitive information like that is actively unsafe for certain types of people, because, as you note, almost every single vendor with whom you do business will blast it out all over the ecosystem until it shows up on SEO spam websites forever.
  - kstrauser 2y ago
    There are much easier ways to track authoritative details about a person's moves, e.g. voter registration.
    - kube-system 2y ago
      Or through any of the data being sold by companies who send someone mail.
    - DANmode 2y ago
      Hackers often do not vote.
      - kstrauser 2y ago
        Unless they legally can't, say because of a felony conviction, that seems highly unusual.
        DANmode 2y ago
        It really depends on how much data one wants to create. What one is optimizing for. I've come across some folks pretty committed to staying "effectively off-grid" - even today.
        DANmode 2y ago
        Separately (assuming US): would you actually find it surprising there would exist a subset of hackers unimpressed with the R and D parade to the point that they abstain?
        kstrauser 2y ago
        Surprised, no, because I've known plenty of ahem security researchers who were contrarian just for the sake of it.
        sneak 2y ago
        A third of the US population doesn’t vote. It’s not even normal unusual, it’s common.
  - ssl-3 2y ago
    It only takes takes one Bluetooth device sitting there and shouting its name to track a move, if that's what a person wants to focus on doing. Most of the Bluetooth devices that I am able to identify are things like televisions. When a Samsung TV moves, it's pretty likely that the people who own that TV have moved along with it.
  - cchance 2y ago
    You realize your residential record of location is... public, you can get it pretty easily from most records offices.
    - DANmode 2y ago
      Landlords that take cash still exist. So I'm told.
    - sneak 2y ago
      This isn’t true. Only one residential record of location is. I have three. I sleep at the one on my driver’s license only a few nights per year. Some vanlife types use a post box, which is also legal. It would be actively dangerous for people like me if we were forced to regularly sleep in a location available to the general public.
  - deleted 2y ago
    [deleted]
NewJazz 2y ago
Can't you set the BSSID? I am fairly sure hostapd exposes that knob in its config.
- Scoundreller 2y ago
  Just set it to mine: AA:AA:AA:AA:AA:AA:AA:AA (or something like that)
  - chatmasta 2y ago
    You should set it to the most common bssid of your preferred anonymity set. You can look up tables of most common MAC addresses and SSIDs and pick from there. Still, the distribution of these identifiers will vary by region, manufacturer and other factors. The best way to stay anonymous is to avoid using the wireless spectrum. You’ll never be in full control of your anonymity as long as anyone around you is broadcasting a unique identifier and your device is logging its observations of these identifiers, correlating them with GPS, and sending them to the cloud…
- hoherd 2y ago
  hostapd definitely exposes this as it was used extensively to spoof 3DS streetpass relays for a variety fun reasons, back before Nintendo shut down the service in March 2018 :( https://github.com/danielhoherd/homepass/blob/master/RaspberryPi/hostapd.conf#L6 https://github.com/danielhoherd/homepass/blob/master/Raspber...
Kerrick 2y ago
I took the opposite approach: make the SSID equal the street address. If it's going to be mapped anyways, might as well name it with a location-based name.
- Terr_ 2y ago
  Disagree: That feels like a failure of defense-in-depth, handing unnecessary bonus information to an attacker while providing no actual convenience to legitimate users who already know their own street address. For example, suppose a device on your network is compromised: The attacker instantly get a freebie for a mailing-address they could use for identity-theft/impersonation, blackmail/extortion threats, or scams pretending to be an authority figure. If you also have something like a home security system, they'll immediately know where to go if someone wants to burgle a room full of goodies (possibly visible via camera) as soon as the owner leaves. The reverse direction is also an issue: Suppose someone already knows your street address, and is trying to figure out which wireless network to target in order to harass/hack/burgle you. Even if these all seem unlikely, the information leak is all downside, no benefit.
  - cchance 2y ago
    THIS! Lol knowing your in an area is one thing, knowing if it's coming from you or the neighbors window 5ft away easily is a big difference
    - deleted 2y ago
      [deleted]
- gruez 2y ago
  Honestly anything other than the auto-generated SSID is going to add more entropy and make you stick out. Moreover, AFAIK they track the BSSID (ie. MAC address), so unless you also spoof that, changing the network name is not going to matter.
  - DANmode 2y ago

This is also why I replace all of my APs when I move (new BSSIDs) and don’t put identifying information like phone numbers, names, or domains in SSIDs.

by sneak 2y ago

This is also why I replace all of my APs when I move (new BSSIDs) and don’t put identifying information like phone numbers, names, or domains in SSIDs.

ssl-3 2y ago

Why is that important to you? (And do you change the MAC addresses of your bluetooth devices, too? Some of us do gather up bluetooth location information, as well.)

sneak 2y ago
Because I don’t want my residential location moves being tracked, as the person who goes from zip code A to zip code B to zip code C is possibly a unique track. I don’t use much bluetooth at home. Zigbee is becoming an issue, but I haven’t moved since I’ve set it up.
- lotsofpulp 2y ago
  In the US, I would assume your employer (via payroll or “work number”, or your banks/credit cards/credit reporting agencies, or even retailers like Amazon or Walmart are selling that information. Or the USPS when you let them know where to forward your mail to after you move: https://www.forbes.com/sites/adamtanner/2013/07/08/how-the-post-office-sells-your-new-address-with-anyone-who-pays-and-the-little-known-loophole-to-opt-out/ https://www.forbes.com/sites/adamtanner/2013/07/08/how-the-p... Edit: and of course, as kstrauser points out, voter registration records.
  - sneak 2y ago
    None of those organizations ever receive my primary residential address, only my tertiary one. Fortunately in the US you are allowed to have more than one home. Absolutely nothing with my name on it goes to where I usually sleep. To divulge sensitive information like that is actively unsafe for certain types of people, because, as you note, almost every single vendor with whom you do business will blast it out all over the ecosystem until it shows up on SEO spam websites forever.
- kstrauser 2y ago
  There are much easier ways to track authoritative details about a person's moves, e.g. voter registration.
  - kube-system 2y ago
    Or through any of the data being sold by companies who send someone mail.
  - DANmode 2y ago
    Hackers often do not vote.
    - kstrauser 2y ago
      Unless they legally can't, say because of a felony conviction, that seems highly unusual.
      - DANmode 2y ago
        It really depends on how much data one wants to create. What one is optimizing for. I've come across some folks pretty committed to staying "effectively off-grid" - even today.
      - DANmode 2y ago
        Separately (assuming US): would you actually find it surprising there would exist a subset of hackers unimpressed with the R and D parade to the point that they abstain?
        kstrauser 2y ago
        Surprised, no, because I've known plenty of ahem security researchers who were contrarian just for the sake of it.
      - sneak 2y ago
        A third of the US population doesn’t vote. It’s not even normal unusual, it’s common.
- ssl-3 2y ago
  It only takes takes one Bluetooth device sitting there and shouting its name to track a move, if that's what a person wants to focus on doing. Most of the Bluetooth devices that I am able to identify are things like televisions. When a Samsung TV moves, it's pretty likely that the people who own that TV have moved along with it.
- cchance 2y ago
  You realize your residential record of location is... public, you can get it pretty easily from most records offices.
  - DANmode 2y ago
    Landlords that take cash still exist. So I'm told.
  - sneak 2y ago
    This isn’t true. Only one residential record of location is. I have three. I sleep at the one on my driver’s license only a few nights per year. Some vanlife types use a post box, which is also legal. It would be actively dangerous for people like me if we were forced to regularly sleep in a location available to the general public.
- deleted 2y ago
  [deleted]

NewJazz 2y ago

Can't you set the BSSID? I am fairly sure hostapd exposes that knob in its config.

Scoundreller 2y ago
Just set it to mine: AA:AA:AA:AA:AA:AA:AA:AA (or something like that)
- chatmasta 2y ago
  You should set it to the most common bssid of your preferred anonymity set. You can look up tables of most common MAC addresses and SSIDs and pick from there. Still, the distribution of these identifiers will vary by region, manufacturer and other factors. The best way to stay anonymous is to avoid using the wireless spectrum. You’ll never be in full control of your anonymity as long as anyone around you is broadcasting a unique identifier and your device is logging its observations of these identifiers, correlating them with GPS, and sending them to the cloud…
hoherd 2y ago
hostapd definitely exposes this as it was used extensively to spoof 3DS streetpass relays for a variety fun reasons, back before Nintendo shut down the service in March 2018 :( https://github.com/danielhoherd/homepass/blob/master/RaspberryPi/hostapd.conf#L6 https://github.com/danielhoherd/homepass/blob/master/Raspber...

Kerrick 2y ago

I took the opposite approach: make the SSID equal the street address. If it's going to be mapped anyways, might as well name it with a location-based name.

Terr_ 2y ago
Disagree: That feels like a failure of defense-in-depth, handing unnecessary bonus information to an attacker while providing no actual convenience to legitimate users who already know their own street address. For example, suppose a device on your network is compromised: The attacker instantly get a freebie for a mailing-address they could use for identity-theft/impersonation, blackmail/extortion threats, or scams pretending to be an authority figure. If you also have something like a home security system, they'll immediately know where to go if someone wants to burgle a room full of goodies (possibly visible via camera) as soon as the owner leaves. The reverse direction is also an issue: Suppose someone already knows your street address, and is trying to figure out which wireless network to target in order to harass/hack/burgle you. Even if these all seem unlikely, the information leak is all downside, no benefit.
- cchance 2y ago
  THIS! Lol knowing your in an area is one thing, knowing if it's coming from you or the neighbors window 5ft away easily is a big difference
  - deleted 2y ago
    [deleted]
gruez 2y ago
Honestly anything other than the auto-generated SSID is going to add more entropy and make you stick out. Moreover, AFAIK they track the BSSID (ie. MAC address), so unless you also spoof that, changing the network name is not going to matter.
- DANmode 2y ago