3 ms·
How is Google's wifi data relevant here? Unless Google themselves operate the hotspot, they won't know what devices polled it or connected to it. Near as I can
by graue 14y ago
How is Google's wifi data relevant here? Unless Google themselves operate the hotspot, they won't know what devices polled it or connected to it.
Near as I can tell, the privacy threat here is very specific. You come within a few hundred feet of a hotspot, and for as long as you are in that location, the hotspot receives polling messages with your MAC address. The hotspot's operator can in theory log information like "device with MAC address 00:11:22:33:44:55 was within a few hundred feet of [hotspot location], Sat Jul 14 from 00:29:05 to 01:13:22".
How big of a threat this is depends on:
1. The difficulty of mapping a phone's MAC address to an individual. Do we know this is easy? Is there a big database with this information? A quick search suggests that it's possible to spoof the MAC address on a rooted phone, so it could be configured to change randomly every few hours. That would seem to defeat this attack on privacy, though doing so may be outside the technical know-how of most people.
2. How common is it for those who operate hotspots to log, aggregate and share this data? I'm confident the locally-owned cafe down the street doesn't log this data. What if it's something corporate-owned, like a Starbucks? Is this kind of logging, sharing and aggregating to track users just a theoretical possibility, or is it actually commonplace? I'd suspect the former.
I don't have answers to the questions I posed above. But barring evidence to the contrary, I strongly suspect that setting a smartphone to wifi only makes location tracking go from trivial to at least moderately difficult.
- smithian 14y agoThe hotspot also passes data back to the handset, which can identify it individually. If the hotspot location is previously known that gives you coordinates. In dense areas like New York, you're within range of multiple AP's on a fairly constant basis, allowing for real time triangulation. This is why google maps prompts you to turn on wifi to improve location, even though you are not connecting to the Internet through the AP's.
- graue 14y agoYeah, but doesn't that work by polling the APs then sending the poll results to Google over 3G/4G? If data is off how could this work?
- smithian 14y agoFor almost all smartphones, almost all of the time, 3g data will be on. Your objection above was that location tracking would require MAC to person mapping and the cooperation of innumerable hotspot operators. This is not the case.
- graue 14y agoWe've got a reading comprehension issue. You're responding to my post about how easily you can disable data on an Android smartphone, which I proposed as a way to avoid tracking.
- smithian 14y agoI yes, I missed your GGP. But it still doesn't work. If you actively use a hotspot then IP GEO tracks you. If you use wireless data then you can be tracked by cell tower triangulation by the network operator, by GPS, and also by passive wifi tracking that we've been discussing. I suppose that you might be able to try tunneling all of your outbound data through a VPN tunnel, but at that point you might as well go back to using internet cafes and phone booths. I prefer misdirection. Set up a device that will appear to be 'you' in many places at once. For instance, google and facebook both routinely believe that I commute from New York to London at least 15 times a day.
- bigiain 14y agoThere's also the problem that if your phone uses the hotspots internet connection, anything it connects to gets the ip address of the hotspot - and Google (and probably Apple, and quite likely several law enforcement agencies) can look up the geographic location of that ip address. I haven't looked to see how chatty my iPhone is when it gets a wifi internet connection, but I strongly suspect iMessage pings Apple with some unique identifier for my phone whenever it can. I'd be surprised if there wasn't some similar "phone home" process for an Android phone with an associated Google account as well. Google and Apple _probably_ won't roll over to a request from some curious local small-town cop, but I'd guess most three-letter-agencies can get pretty quick access to data about my phone if they ask the right way…