14 ms·

Is this really a thing? WTF? I feel very ashamed, as someone who works in IT, everytime this happens. I mean, people can opt-out, of course - but, in order to

Is this really a thing? WTF? I feel very ashamed, as someone who works in IT, everytime this happens. I mean, people can opt-out, of course - but, in order to do that, they need to know what an SSID is, and how to change it. What about people who don't? Will we just assume that they don't care or that their opinion doesn't matter?

zz1 12y ago
I guess you have a better suggestion, and am curious to hear about it.
- walterbell 12y ago
  An option during router setup when SSID is named? An organized promotion of this approach, e.g. list of routers that make it simple, list of services that honor it. A cool name other than "Do Not Track".
  - zz1 12y ago
    That would require an action on the router-side, not on the mapping one. I think it could be a good option, but this doesn't apply for this case. Also, what if I agree to put my SSID into an open database but not in a locked one? Apple's and Google's location databases do not compare, for me, to Mozilla's one: I am more than glad to be in the latter, but not to be in the two formers.
- justcommenting 12y ago
  the obvious option is to request consent instead of violating people's privacy and make a dragnet data collection effort like this opt-in instead of opt-out. but that's clearly not the intention here, because how dare anyone question someone else's motives/objectives/priorities for collecting data about devices they don't own. in fact, we're supposed to think this is the "nice" version because a google-funded nonprofit is doing it instead of google doing it unlawfully with cars or through waze. seeing mozilla move in this direction while talking about how much they respect everyone's privacy is a strategic stumble indeed.
  - zz1 12y ago
    Did you ever count APs during a short walk in a relatively low density neighbourhood? You have hundreds in under 100m. Tell me, how do you plan to ask each and everyone of them? Ring on every doorbell? -Sorry, is FritzBox!239? -No, here is YouMakeTooMuchNoiseWTF -Oh, I see, could you please pass a message to your neighbour? I'd very much appreciate if he could please fill in this form and send it back through paper mail to Mozilla…
    - justcommenting 12y ago
      that would be one respectful way to do it, and yes, challenging. but the premise of your comment is that of course my device's SSID and related location should be collected in someone else's database because a google-funded nonprofit wrote an app for people to go wardriving with. just because SSIDs can be legally observed and collected doesn't mean i have to be happy about it. I wasn't talking about this as a technical problem as much as an ethical/political one for an organization that claims to be committed to my privacy...except when it's not.
      - Touche 12y ago
        Your SSID is being broadcast on public property. You have no claims of privacy there.
        justcommenting 12y ago
        i never disputed the lawfulness of doing this--in fact i explicitly acknowledged it in my last comment. i'm not making any legal claims to privacy--just pointing out that collecting everything that's lawful to collect runs counter to mozilla's policy stance of being committed to users' privacy.
      - Ygg2 12y ago
        How is this any different than robots.txt? I don't see your point. If you are ignorant enough to not know how to secure against such measly attempts at privacy breach, how will you secure against a more determined hacker? Further more the SSID is publicly broadcast, so that any device you authorized can identify and connect.
- paulojreis 12y ago
  Of course I do. Make this "opt-in". Using SSID naming conventions to do this is just dishonest: most of the people who will be scanned won't know what an SSID is. Even if they do, and do have the competence to change it, how many of them will know about this convention? More than this: how many "home network owners" know that their networks are being scanned and georeferenced? This opt-out scheme is ridiculous and plain "hand-washing" - they obviously don't expect people to use it.
  - zz1 12y ago
    "Make this "opt-in"" is a statement, not a procedure. How, and why? Would the cons outwheigh the pros?
    - paulojreis 12y ago
      > "Make this "opt-in"" is a statement, not a procedure. How, and why? I don't really care about the procedure; Snailmail, if need be. Convenience is not a valid argument for breaking privacy. > Would the cons outwheigh the pros? The answer to this is dependent on one's stance. As you may imagine, from where I stand, they do (clearly). I can't see any "logistical inconvenience" justify breaking privacy by default.
    - anonymousDan 12y ago
      Why not simply require the SSID to end in _map? If Google think it's so easy for users to do, then surely this shouldn't present a problem?
JackC 12y ago
Can you say more about your privacy concern here? I'm not seeing it. As far as I know, the sole use of this database is to say, "if you can see this set of wifi networks, then you are probably at this GPS location." It's literally the same thing, except at a different electromagnetic frequency, as saying "if you can see houses with these addresses, you are probably at this GPS location." Kind of like a street map. I definitely think that privacy concerns can emerge when you aggregate public data -- is there something I'm missing here?
- paulojreis 12y ago
  Your point is wrong from the beginning: I don't have to explain my privacy concerns, and neither do the others who don't know what an SSID is. "Privacy" should be the default and without need for justification, not the other way around.
  - antsar 12y ago
    How do you feel that privacy is being violated by scanning SSIDs and pinning those SSIDs to GPS coordinates? I believe JackC's point is that there isn't a privacy concern here. The consumer's router is blasting out the SSID for everyone to hear, just like if you were standing on your roof shouting, or had a poster on the outside of your house. There's nothing wrong with those things being recorded, what makes SSIDs different?
  - publicfig 12y ago
    I understand the sentiment but really feel like it falls when looking at the actual situation. It's checking on things that are broadcast outside of your own property, and even offering a way to opt out. It's like transmitting radio waves from your property and asking that no one listens. You have a control over the distribution method or whether or not it even exists.
    - justcommenting 12y ago
      so everyone should have to choose between having their home router's info added to large, aggregated databases and reconfiguring/not operating a router? i know plenty of people for whom that's not a choice they're likely to know about. perhaps mozilla/google shouldn't be able to dictate my SSID or its visibility just because they don't want to incur the cost/complexity of obtaining affirmative, informed consent.
DCKing 12y ago
As someone who works in IT, I always feel ashamed to see outrage over this. We somehow want both privacy as well as a freaking radio beacon spreading out a signal to hundreds of meters away. Let there be no mistake: using a Wi-Fi router in your house means you are voluntarily broadcasting an identifier to anyone within hundreds of meters. There can be no honest expectation of privacy there. If you don't want people obtaining information from a radio beacon in your house then do not put a radio beacon in your house. But don't pester companies for opting out of the passive database of radio signals you are voluntarily sending into the world. You cannot have your cake and eat it too. Furthermore, there is nothing intrinsically revealing about an SSID. If your SSID tells people information about you, the problem is the SSID and not the collection of that information. It is trivial to change your SSID to a pseudonymous one. I know that a lot of people are not aware of the privacy consequences, but those people are not the ones making a point out of this. Once you educate yourself about the privacy consequences of using a Wi-Fi router, do not blame people for collecting information that you are actively and voluntarily broadcasting!
- fulafel 12y ago
  Well, having your curtains open also broadcasts an image of your living room on EM spectrum for hundreds of meters for anyone with optics... Same for eavesdropping (laser mic). Easy to listen maybe but you will still get convicted in both cases.
  - DCKing 12y ago
    The difference being that having a Wi-Fi router means actively powering a device that sends a signal beyond the perimeter and privacy of your home. A signal that, as evidenced by this app, can be passively [1] picked up and processed by any casual passer-by. Having a Wi-Fi router with an SSID is the equivalent of installing a speaker on the top of your house and have it constantly spell a uniquish name to the neighborhood. It might be useful for you to have that, but you might want to think a bit about what it means for your privacy. [1]: Not having to aim or target anything, not having to have exotic instruments, but being able to be picked up by anyone at all by just listening.

zz1 12y ago

I guess you have a better suggestion, and am curious to hear about it.

walterbell 12y ago
An option during router setup when SSID is named? An organized promotion of this approach, e.g. list of routers that make it simple, list of services that honor it. A cool name other than "Do Not Track".
- zz1 12y ago
  That would require an action on the router-side, not on the mapping one. I think it could be a good option, but this doesn't apply for this case. Also, what if I agree to put my SSID into an open database but not in a locked one? Apple's and Google's location databases do not compare, for me, to Mozilla's one: I am more than glad to be in the latter, but not to be in the two formers.
justcommenting 12y ago
the obvious option is to request consent instead of violating people's privacy and make a dragnet data collection effort like this opt-in instead of opt-out. but that's clearly not the intention here, because how dare anyone question someone else's motives/objectives/priorities for collecting data about devices they don't own. in fact, we're supposed to think this is the "nice" version because a google-funded nonprofit is doing it instead of google doing it unlawfully with cars or through waze. seeing mozilla move in this direction while talking about how much they respect everyone's privacy is a strategic stumble indeed.
- zz1 12y ago
  Did you ever count APs during a short walk in a relatively low density neighbourhood? You have hundreds in under 100m. Tell me, how do you plan to ask each and everyone of them? Ring on every doorbell? -Sorry, is FritzBox!239? -No, here is YouMakeTooMuchNoiseWTF -Oh, I see, could you please pass a message to your neighbour? I'd very much appreciate if he could please fill in this form and send it back through paper mail to Mozilla…
  - justcommenting 12y ago
    that would be one respectful way to do it, and yes, challenging. but the premise of your comment is that of course my device's SSID and related location should be collected in someone else's database because a google-funded nonprofit wrote an app for people to go wardriving with. just because SSIDs can be legally observed and collected doesn't mean i have to be happy about it. I wasn't talking about this as a technical problem as much as an ethical/political one for an organization that claims to be committed to my privacy...except when it's not.
    - Touche 12y ago
      Your SSID is being broadcast on public property. You have no claims of privacy there.
      - justcommenting 12y ago
        i never disputed the lawfulness of doing this--in fact i explicitly acknowledged it in my last comment. i'm not making any legal claims to privacy--just pointing out that collecting everything that's lawful to collect runs counter to mozilla's policy stance of being committed to users' privacy.
    - Ygg2 12y ago
      How is this any different than robots.txt? I don't see your point. If you are ignorant enough to not know how to secure against such measly attempts at privacy breach, how will you secure against a more determined hacker? Further more the SSID is publicly broadcast, so that any device you authorized can identify and connect.
paulojreis 12y ago
Of course I do. Make this "opt-in". Using SSID naming conventions to do this is just dishonest: most of the people who will be scanned won't know what an SSID is. Even if they do, and do have the competence to change it, how many of them will know about this convention? More than this: how many "home network owners" know that their networks are being scanned and georeferenced? This opt-out scheme is ridiculous and plain "hand-washing" - they obviously don't expect people to use it.
- zz1 12y ago
  "Make this "opt-in"" is a statement, not a procedure. How, and why? Would the cons outwheigh the pros?
  - paulojreis 12y ago
    > "Make this "opt-in"" is a statement, not a procedure. How, and why? I don't really care about the procedure; Snailmail, if need be. Convenience is not a valid argument for breaking privacy. > Would the cons outwheigh the pros? The answer to this is dependent on one's stance. As you may imagine, from where I stand, they do (clearly). I can't see any "logistical inconvenience" justify breaking privacy by default.
  - anonymousDan 12y ago
    Why not simply require the SSID to end in _map? If Google think it's so easy for users to do, then surely this shouldn't present a problem?

JackC 12y ago

Can you say more about your privacy concern here? I'm not seeing it. As far as I know, the sole use of this database is to say, "if you can see this set of wifi networks, then you are probably at this GPS location." It's literally the same thing, except at a different electromagnetic frequency, as saying "if you can see houses with these addresses, you are probably at this GPS location." Kind of like a street map. I definitely think that privacy concerns can emerge when you aggregate public data -- is there something I'm missing here?

paulojreis 12y ago
Your point is wrong from the beginning: I don't have to explain my privacy concerns, and neither do the others who don't know what an SSID is. "Privacy" should be the default and without need for justification, not the other way around.
- antsar 12y ago
  How do you feel that privacy is being violated by scanning SSIDs and pinning those SSIDs to GPS coordinates? I believe JackC's point is that there isn't a privacy concern here. The consumer's router is blasting out the SSID for everyone to hear, just like if you were standing on your roof shouting, or had a poster on the outside of your house. There's nothing wrong with those things being recorded, what makes SSIDs different?
- publicfig 12y ago
  I understand the sentiment but really feel like it falls when looking at the actual situation. It's checking on things that are broadcast outside of your own property, and even offering a way to opt out. It's like transmitting radio waves from your property and asking that no one listens. You have a control over the distribution method or whether or not it even exists.
  - justcommenting 12y ago
    so everyone should have to choose between having their home router's info added to large, aggregated databases and reconfiguring/not operating a router? i know plenty of people for whom that's not a choice they're likely to know about. perhaps mozilla/google shouldn't be able to dictate my SSID or its visibility just because they don't want to incur the cost/complexity of obtaining affirmative, informed consent.

DCKing 12y ago

As someone who works in IT, I always feel ashamed to see outrage over this. We somehow want both privacy as well as a freaking radio beacon spreading out a signal to hundreds of meters away. Let there be no mistake: using a Wi-Fi router in your house means you are voluntarily broadcasting an identifier to anyone within hundreds of meters. There can be no honest expectation of privacy there. If you don't want people obtaining information from a radio beacon in your house then do not put a radio beacon in your house. But don't pester companies for opting out of the passive database of radio signals you are voluntarily sending into the world. You cannot have your cake and eat it too. Furthermore, there is nothing intrinsically revealing about an SSID. If your SSID tells people information about you, the problem is the SSID and not the collection of that information. It is trivial to change your SSID to a pseudonymous one. I know that a lot of people are not aware of the privacy consequences, but those people are not the ones making a point out of this. Once you educate yourself about the privacy consequences of using a Wi-Fi router, do not blame people for collecting information that you are actively and voluntarily broadcasting!

fulafel 12y ago
Well, having your curtains open also broadcasts an image of your living room on EM spectrum for hundreds of meters for anyone with optics... Same for eavesdropping (laser mic). Easy to listen maybe but you will still get convicted in both cases.
- DCKing 12y ago
  The difference being that having a Wi-Fi router means actively powering a device that sends a signal beyond the perimeter and privacy of your home. A signal that, as evidenced by this app, can be passively [1] picked up and processed by any casual passer-by. Having a Wi-Fi router with an SSID is the equivalent of installing a speaker on the top of your house and have it constantly spell a uniquish name to the neighborhood. It might be useful for you to have that, but you might want to think a bit about what it means for your privacy. [1]: Not having to aim or target anything, not having to have exotic instruments, but being able to be picked up by anyone at all by just listening.