Hacker News Reader

Comment by nullc | Hacker News Reader

Because of these databases if I get near you when you're using your computer, I can tell where you live:

Your computer will poll for the SSID it's setup to auto-associate to (as they may be hidden). I get the SSID of your home network, and look it up in the database.

How creepy is it that these two not very privacy interrupting things -- collecting observed SSID in the wild, and your laptop attempting to connect to things it knows essentially broadcasts your home address when you're at a conference or a coffee shop? Hope you never have a stalker.

Worse, google's "opt out" procedure makes your SSID more unique and makes this attack even more effective.

View on HN

>Your computer will poll for the SSID it's setup to auto-associate to (as they may be hidden). I get the SSID of your home network, and look it up in the database.

AFAIK this sort of polling only happens if your phone has hidden networks remembered. Also, the probe it sends is for the ESSID (human readable string), not the BSSID (mac address). Most databases (including google) only allows for lookup by BSSID not ESSID so doing that sort of lookup is non-trivial.

> AFAIK this sort of polling only happens if your phone has hidden networks remembered.

Alas, no when you have a SSID remembered it doesn't know if it's hidden or not. (well maybe apple has some privacy behavior for this). It's not only used for hidden networks: clients probe so they can quickly enumerate nearby access points so they can switch over to them fast if they lose connectivity.

Source on this?

A few years ago when the whole "people are tracking your phones using wifi probes!" story got popular I ran packet captures on an android and ios device and found that neither made directed probe requests (ie. the kind that contained SSIDs). The man page for wpa_supplicant (which is used for android) seems to confirm this:

     scan_ssid
             SSID scan technique; 0 (default) or 1.  Technique 0 scans for the
             SSID using a broadcast Probe Request frame while 1 uses a
             directed Probe Request frame.  Access points that cloak
             themselves by not broadcasting their SSID require technique 1,
             but beware that this scheme can cause scanning to take longer to
             complete.

https://www.daemon-systems.org/man/wpa_supplicant.conf.5.htm...

Ok so putting this all together, if you run a hidden network at home that means your phone HAS to use a directed probe request to find that network which it will keep trying to do when you are out and about. Am I reading that right?

If so the best way to have a phone that doesn't leak is to have a home network that does... maybe?

Exactly correct. Hidden network at home means your phone screams out for it all the time when not at home, because that's the only way it can find it.

If only there was a way to know the location of an SSID! /s

WPA needs help.

> if you run a hidden network at home that means your phone HAS to use a directed probe request to find that network which it will keep trying to do when you are out and about

That certainly isn't a theoretical requirement; the alternative is "if you run a hidden network, your devices will not connect to it automatically". You'd have to tell them to connect.

or you have your phone turn off wifi once it's out of range of your specified ssid(s). several apps do that; i use

https://github.com/j4velin/WiFi-Automatic

GPs second point still holds - the laptop scans for SSID, not BSSID. If all you have is SSID you can't get to location using Google's database. At most you could use it as a data point to connect someone's laptop to a location you already know.

An easy way around this would be to leave your wireless SSID on it's default (or set it to 'Linksys').

> An easy way around this would be to leave your wireless SSID on it's default (or set it to 'Linksys').

Exactly, and thus don't add _nomap.

So basically go to the airport and look for vacationers and empty their home while they are away.

Sounds like a vulnerability in the wifi client betraying your preferred ssid names and therefore address.

Wifi needs an encrypted handshake

How do you look it up in their database?

Here's one: https://wigle.net

I just queried my home ssid on there. I thought it was a pretty unique pun, but 216 other access points have the same ssid. If my phone was probing for it then you could narrow me down quite a bit, but you would need more than that.

If you used the other SSIDs your phone was looking for and cross referenced, I bet confidence could get a lot closer to certain - 99%?

I'd agree that a basic mapping of SSID name to approximate location is a bit useless on its own, but it can be combined with other information to narrow down your physical location.

Geographically speaking, how were those SSID's distributed? Were they spread all around the world, across the continent, or were they all in the same city?

For example, if your home SSID was known and those 216 SSID's were spread around the world, your home could likely be narrowed down based on some general facts from forum posts. "You spell honor with a U! You often complain about the rain on the forums, and those posts came from that ISP's IP block! According to the public coverage maps for that ISP in that English-speaking country that uses British spellings, your wireless network overlaps with this side of the street, give or take 30m. Let's check it out!"

Paranoid fantasy? I truly hope so.

right, but probably I can make it unique knowing a town name or just one or two extra things about you.

I love how it picks up in-flight WiFi.

through the api

https://developers.google.com/maps/documentation/geolocation...

there are also many open source wifi location databases that can be downloaded and queried locally

devices listening to ssid broadcasts for this purpose are common at grocery stores, malls, political protests, and more

That API requires the MAC address of a wifi access point. You can't get that from a client probing for a hidden ssid.

It's commercially available.

Joe Stalker, however, probably won't get it from google. Unfortunately there are many other databases, including ones available at low cost (or free: https://wigle.net/ ) which the stalker is more likely to use, unless they work at google. And when you add "nomap" to turn off google's tracking you'll make your SSID more unique and trackable in every other database.

Rich Joe Stalker probably would. Not directly from google, maybe, but from a company that gets it from a company that gets it from google.

Right, Joe Stalker won't get it from Google. Joe Stalker will get it from the unprotected S3 bucket of the company that got it from Google.

You’re broadcasting more than your ssid, but your base station MAC too. Unless you clone that too.

Since ssid is used as a seed in encryption, there’s value in making it unique.

if you use a strong passphrase the unique ssid protection against a table doesn't matter, but it's a worthwhile point to raise.

so if i'm understanding the threat model correctly here, it's based on the uniqueness of your home SSID. a privacy-preserving thing to do would be to choose an SSID that is shared by many other people, but not so many other people that your neighbours share it...

is there any services that coordinate this?

The router manufacturers do, as I was once surprised when my computer was complaining about a friend's wifi -- turns out that they had the same, manufacturer-driven SSID as my mother.

Having noted the WiGLE database I decided to give their mutual Netgear-provided SSID a spin. Over fifty thousand results.

So you could do worse than just name your access point NETGEAR followed by a two-digit number. Of course, your laptop might decide lots of other networks are yours, but it won't have the password for them.

If you wear a T-shirt with your home address on it, people will learn your home address. The correct technical solution seems to be to NOT wear a t-shirt with your home address on it. (Don't use a device that broadcasts your home SSID in the subway)

Useless advice if just about every device with Wifi capability does so, and turning that feature off cripples its functionality.

Sure, except that all your shirts have your address on by default without your knowledge (for >99% of people), and anyone can read your shirt under the jacket you reasonably believed to be opaque, in an instant, without line of sight and undetectably to you.

Great comparison! /s

So your suggestion is to turn off WiFi completely on your devices, right?

I have wifi off on my phone with a Tasker script that turns it on whenever I'm connected to one of the cell towers that services my neighborhood. The system works well and my battery life is amazing.

Interestingly it used to be that someone would (for free and without solicitation) drop a book on my doorstep that contained a list of thousands of people's names along with their home address and telephone number. The last time I remember this happening was only 10 years ago. It's fascinating how our threat models regarding privacy have apparently changed so significantly.

You're acting like people couldn't opt out of phone books, but it turns out that was actually a very common thing to do.

If I recall correctly, the phone books even included instructions on them of how to opt out. And given that they were broadly distributed it was very apparent to people that opting out was necessary if they were worried about being stalked, etc.

You could opt out, I used to, however I had to pay a fee to opt out. At the time I did it, it added $1 to my bill.

I recall there being two levels, unlisted and unpublished numbers and one you had to pay for but the other IIRC you didn't.

tshaddox didn't say anything to imply that people couldn't opt out, so I think you're beating a strawman. They pointed out the seeming change in expectations in this thread (where SSID location mapping collection being opt-out is outrage) vs the phone book (which, sensitive PII was broadly shared by a profit-motivated entity that had no relationship with you and you have to opt out to not be included).

If anything, SSID location is generally less sensitive than your name + phone number + city.

I didn’t act as if one couldn’t opt out. That’s actually in line with my point. The behavior was opt-out, and from what I remember hearing you actually had to pay in order to do so.

My point is that it used to be well-accepted that one’s home address and telephone number were explicitly public and indexed for easy access by anyone (at least anyone within the regional phone book’s coverage area). Now we get spooked that someone could obtain a home address using a fairly convoluted, difficult to target, and presumably expensive method involving the target’s smartphone attempting to connect to a wireless network and a large commercial database of wireless network locations.

I’m not even making judgements about this. I’m truly fascinated at how privacy threat models can vary so much from person to person and over time.

Reply on news.ycombinator.com