6 ms·

How would that work? Are you suggesting 3+ of the access points within range working together to triangulate me, and saving that information, along with the pho

by graue 14y ago

How would that work? Are you suggesting 3+ of the access points within range working together to triangulate me, and saving that information, along with the phone's MAC address or similar?

TheGateKeeper 14y ago
It is laughable, isn't it? If they're needing wifi to triangulate you chances are they already know where you are anyways.
- bigiain 14y ago
  Hmmm. If I were a "cut-the-corners to the borders of being bent" cop (al la McNulty from Wired), I'd consider dropping cheap access points around places where I'd like to know if my "suspects" frequented, with SSIDs that matched local free wifi sources so that if a target had ever connected to the free wifi at the local McDonalds or Starbucks, their phone might automatically hook up to my "cloned" version of those hotspots. You'd be able to capture mac addresses from connection attempts, or being a little more evil - you could log any resulting traffic (and mitm ssl connections too, I wonder how many smartphone email/IM/socialnetwork apps do strong certificate checking?)
bigiain 14y ago
A single access point coupled with a typically lousy phone wifi antenna's range, narrows you down to well under a few hundred feet in my experience. And Google's Streetview wifi data hoovering means thay've got a pretty good database of wifi access points to geographic co-ordinates. And I bet they're not the only ones building that database. I'd bet pretty good money that there was no ethical oversight or data retention/protection policy in place befre this started: http://www.brisbanetimes.com.au/technology/security/police-to-cruise-streets-for-unsecured-wifi-20120322-1vmof.html http://www.brisbanetimes.com.au/technology/security/police-t...
- graue 14y ago
  How is Google's wifi data relevant here? Unless Google themselves operate the hotspot, they won't know what devices polled it or connected to it. Near as I can tell, the privacy threat here is very specific. You come within a few hundred feet of a hotspot, and for as long as you are in that location, the hotspot receives polling messages with your MAC address. The hotspot's operator can in theory log information like "device with MAC address 00:11:22:33:44:55 was within a few hundred feet of [hotspot location], Sat Jul 14 from 00:29:05 to 01:13:22". How big of a threat this is depends on: 1. The difficulty of mapping a phone's MAC address to an individual. Do we know this is easy? Is there a big database with this information? A quick search suggests that it's possible to spoof the MAC address on a rooted phone, so it could be configured to change randomly every few hours. That would seem to defeat this attack on privacy, though doing so may be outside the technical know-how of most people. 2. How common is it for those who operate hotspots to log, aggregate and share this data? I'm confident the locally-owned cafe down the street doesn't log this data. What if it's something corporate-owned, like a Starbucks? Is this kind of logging, sharing and aggregating to track users just a theoretical possibility, or is it actually commonplace? I'd suspect the former. I don't have answers to the questions I posed above. But barring evidence to the contrary, I strongly suspect that setting a smartphone to wifi only makes location tracking go from trivial to at least moderately difficult.
  - smithian 14y ago
    The hotspot also passes data back to the handset, which can identify it individually. If the hotspot location is previously known that gives you coordinates. In dense areas like New York, you're within range of multiple AP's on a fairly constant basis, allowing for real time triangulation. This is why google maps prompts you to turn on wifi to improve location, even though you are not connecting to the Internet through the AP's.
    - graue 14y ago
      Yeah, but doesn't that work by polling the APs then sending the poll results to Google over 3G/4G? If data is off how could this work?

by graue 14y ago

How would that work? Are you suggesting 3+ of the access points within range working together to triangulate me, and saving that information, along with the phone's MAC address or similar?

TheGateKeeper 14y ago

It is laughable, isn't it? If they're needing wifi to triangulate you chances are they already know where you are anyways.

bigiain 14y ago
Hmmm. If I were a "cut-the-corners to the borders of being bent" cop (al la McNulty from Wired), I'd consider dropping cheap access points around places where I'd like to know if my "suspects" frequented, with SSIDs that matched local free wifi sources so that if a target had ever connected to the free wifi at the local McDonalds or Starbucks, their phone might automatically hook up to my "cloned" version of those hotspots. You'd be able to capture mac addresses from connection attempts, or being a little more evil - you could log any resulting traffic (and mitm ssl connections too, I wonder how many smartphone email/IM/socialnetwork apps do strong certificate checking?)

bigiain 14y ago

A single access point coupled with a typically lousy phone wifi antenna's range, narrows you down to well under a few hundred feet in my experience. And Google's Streetview wifi data hoovering means thay've got a pretty good database of wifi access points to geographic co-ordinates. And I bet they're not the only ones building that database. I'd bet pretty good money that there was no ethical oversight or data retention/protection policy in place befre this started: http://www.brisbanetimes.com.au/technology/security/police-to-cruise-streets-for-unsecured-wifi-20120322-1vmof.html http://www.brisbanetimes.com.au/technology/security/police-t...

graue 14y ago
How is Google's wifi data relevant here? Unless Google themselves operate the hotspot, they won't know what devices polled it or connected to it. Near as I can tell, the privacy threat here is very specific. You come within a few hundred feet of a hotspot, and for as long as you are in that location, the hotspot receives polling messages with your MAC address. The hotspot's operator can in theory log information like "device with MAC address 00:11:22:33:44:55 was within a few hundred feet of [hotspot location], Sat Jul 14 from 00:29:05 to 01:13:22". How big of a threat this is depends on: 1. The difficulty of mapping a phone's MAC address to an individual. Do we know this is easy? Is there a big database with this information? A quick search suggests that it's possible to spoof the MAC address on a rooted phone, so it could be configured to change randomly every few hours. That would seem to defeat this attack on privacy, though doing so may be outside the technical know-how of most people. 2. How common is it for those who operate hotspots to log, aggregate and share this data? I'm confident the locally-owned cafe down the street doesn't log this data. What if it's something corporate-owned, like a Starbucks? Is this kind of logging, sharing and aggregating to track users just a theoretical possibility, or is it actually commonplace? I'd suspect the former. I don't have answers to the questions I posed above. But barring evidence to the contrary, I strongly suspect that setting a smartphone to wifi only makes location tracking go from trivial to at least moderately difficult.
- smithian 14y ago
  The hotspot also passes data back to the handset, which can identify it individually. If the hotspot location is previously known that gives you coordinates. In dense areas like New York, you're within range of multiple AP's on a fairly constant basis, allowing for real time triangulation. This is why google maps prompts you to turn on wifi to improve location, even though you are not connecting to the Internet through the AP's.
  - graue 14y ago
    Yeah, but doesn't that work by polling the APs then sending the poll results to Google over 3G/4G? If data is off how could this work?