Hacker News Reader

> but a total stranger anywhere in the world finding your address only by (B)SSID is a problem.

I am not sure I follow. Total strangers can find my address by looking up ... my address.

My ssid is probably _less_ associated with my name and other identifying info than my address is, for that matter. Whereas I regularly supply my address to forms when I sign up for things or order packages for delivery, I never really explicitly give out my ssid.

A passerby could collect my ssid. They might be able to narrow it down to my building (or maybe the neighbors), but that's not terribly interesting data to strangers trying to "find my address". There are more direct ways to go about that.

> My ssid is probably _less_ associated with my name and other identifying info than my address is, for that matter.

But I don't have your exact address.

> Whereas I regularly supply my address to forms when I sign up for things or order packages for delivery, I never really explicitly give out my ssid.

You'd think so. But it's easy to accidentally do this by submitting/posting a crash report (they quite often contain the WiFi SSID), asking for technical support, sharing a screenshot or simply opening the wrong window while streaming. Maybe you posted once in an "AskReddit: What's a funny wifi name?" thread. I doubt you'd simply post your address freely online and it would be much harder to get you to enter it into a form controlled by me.

> A passerby could collect my ssid. They might be able to narrow it down to my building (or maybe the neighbors), but that's not terribly interesting data to strangers trying to "find my address".

Sure it is. Right now, you could be anywhere in the world; the chance that I'd just walk by your house is minuscule. Even knowing you're near Boston makes that very hard. Only thanks to this database I could find out your exact address in minutes, given your SSID and a cursory look at your profile.

>But I don't have your exact address.

You also don't have my ssid.

You do have my username. I am fairly confident that you could connect my username to my real name with some minor searching. From there, plenty of tax records, property records, and other important interesting information is just a few clicks away.

I am not arguing that we should or should not be sharing ssids. I am merely wondering why the OP is somehow worried about strangers across the globe somehow going from a list of random ssids to anything more interesting than that.

A list of names, addresses, phone numbers, emails, or other publicly available information (leaked or otherwise) is far more worrisome than a list of ssids.

I agree that a leaked SSID is less worrisome than leaked addresses, but the problem is that this list takes an nearly useless information and makes it a vital part which can basically locate someone down to the street address. And most people are absolutely unaware of how dangerous sharing an SSID is, assuming they try not be found (see: streamers, pop-stars or simply people which do not like to associate their actual name with their alias, unlike the two of us). For them it would feel like if I would tell you the color of my shoes and you'd find my address - it's simply not something you have in your mind.

It's not the end of the world, yes, sure. But it's not great either.

It's a sidenote, but the blow-up point of this is that it's one of the very few data privacy points for which you can directly show the impact. Usually, you have to go with abstract "if your data is leaked" or "someone at XCorp could ...", but in this case, if I can find your SSID I can send you your address, no further questions asked. And everyone knows people who know their SSID and/or can easily imagine this scenario. I'm pretty sure that's why this exact list is blowing up so much more than the far more egregious privacy violations we otherwise see.

> Total strangers can find my address by looking up ... my address.

Is there a global open address book with everyone's addresses?

It used to be called White Pages...

And people could ask to be delisted from it. Many celebrities and public figures exercised this option.

You had to pay a monthly fee for that privilege and talk to a customer service person to set it up. Often, your info still got sold to telemarketers.

In comparison, changing your SSID is free and something you can do yourself.

[1] https://www.nbcnews.com/business/consumer/unlisted-number-fe...

Google location doesn't associate identities with addresses like the white pages did, so that is not a perfect analogy. In an unfortunate case of self-reference, I'd say Google Location is much closer to a (paper) map, since it correlates addresses to physical location. As far as I know, no one[1] can delist their address from a map, not even public figures. A map will tell me where Number 8 Mulholland Drive is, nothing more, nothing less.

1. Military and TLA agencies excepted.

No. For start not everyone has an address, not every address has an address.

In the U.K. the electoral roll does have most people’s addresses - about 70% of the country.

Lots of government websites will tell you who owns a property.

Meanwhile, there's no open address book associating ssids to names or ssids to addresses either.

if you know a name (or name fragment), real property owners can be found in county assessor websites in the US.

Don't know about you, but when I put any address into my maps app I expect it to guide me there.

>This is exactly the problem here: Your neighbours or passerbys seeing your SSID is not much of a problem, but a total stranger anywhere in the world finding your address only by (B)SSID is a problem.

In what case would "a total stranger anywhere in the world" get a hold of your BSSID?

For example, via a crash log you posted on a forum to get help. And, as mentioned above, knowing only the SSID is already pretty bad.

That seems very contrived Which crash logs would contain the SSID? You reporting a bug with wpa_supplicant? What's the risk of that compared to crash logs containing other pieces of sensitive information?

Most SSIDs are not unique and can't be used to geolocate on their own. You need to show off a BSSID which is buried in utility menus and unlikely to be accidentally opened by a user. I suppose malware could share your BSSID with a malicious party to geolocate you, but at that point you're being specifically targeted by a sophisticated adversary and whether or not Google helps along the way is not going to determine whether you win or not.

> Most SSIDs are not unique

It's enough to look at your profile to find out you're in Stamford, so locally unique is sufficient. I don't intend to find out your address, but it is usually quite easy to narrow down someones location to state or city level (you'd probably be able to do the same for me). So unless there are hundreds of SSIDs with the same name in your city, finding you is probably not that hard. For mine, state would be sufficient.

> and can't be used to geolocate on their own.

Sure thing! https://wigle.net/ has a perfectly fine API which allows you to search by SSID.

I'm not in Stamford, but nice try :) Regardless you didn't use my SSID to figure that out, which is my point, we all have lots of data points out there that are more public than SSIDs and those will be used to compromise us much faster than the SSID method will.

> I'm not in Stamford, but nice try :)

I really though you'd study CompSci ;) Oh well.

> Regardless you didn't use my SSID to figure that out, which is my point, we all have lots of data points out there that are more public than SSIDs and those will be used to compromise us much faster than the SSID method will.

I think we intermingled two separate points there:

- An SSID is not unique. My point was, despite this being true, it is usually possible to narrow down the location far enough using auxiliary information so that an SSID is sufficiently unique. That was the point of my previous response to you.

- An SSID is usually not considered sensitive. For the two of us there are enough other data points, but quite a few people prefer not to have their nick linked to their real name. I doubt they are aware how fatal sharing it would be. As mentioned in sister comments, the name is also quite often in crash logs, so something as simple as seeking technical help might lead to your home address being compromised.

Now, this list is surely not the end of the world, but the privacy implications are pretty bad IMO.

I can agree with this. It's not ideal at all.