Hacker News Reader

Comment by mankyd | Hacker News Reader

> but a total stranger anywhere in the world finding your address only by (B)SSID is a problem.

I am not sure I follow. Total strangers can find my address by looking up ... my address.

My ssid is probably _less_ associated with my name and other identifying info than my address is, for that matter. Whereas I regularly supply my address to forms when I sign up for things or order packages for delivery, I never really explicitly give out my ssid.

A passerby could collect my ssid. They might be able to narrow it down to my building (or maybe the neighbors), but that's not terribly interesting data to strangers trying to "find my address". There are more direct ways to go about that.

View on HN

> My ssid is probably _less_ associated with my name and other identifying info than my address is, for that matter.

But I don't have your exact address.

> Whereas I regularly supply my address to forms when I sign up for things or order packages for delivery, I never really explicitly give out my ssid.

You'd think so. But it's easy to accidentally do this by submitting/posting a crash report (they quite often contain the WiFi SSID), asking for technical support, sharing a screenshot or simply opening the wrong window while streaming. Maybe you posted once in an "AskReddit: What's a funny wifi name?" thread. I doubt you'd simply post your address freely online and it would be much harder to get you to enter it into a form controlled by me.

> A passerby could collect my ssid. They might be able to narrow it down to my building (or maybe the neighbors), but that's not terribly interesting data to strangers trying to "find my address".

Sure it is. Right now, you could be anywhere in the world; the chance that I'd just walk by your house is minuscule. Even knowing you're near Boston makes that very hard. Only thanks to this database I could find out your exact address in minutes, given your SSID and a cursory look at your profile.

>But I don't have your exact address.

You also don't have my ssid.

You do have my username. I am fairly confident that you could connect my username to my real name with some minor searching. From there, plenty of tax records, property records, and other important interesting information is just a few clicks away.

I am not arguing that we should or should not be sharing ssids. I am merely wondering why the OP is somehow worried about strangers across the globe somehow going from a list of random ssids to anything more interesting than that.

A list of names, addresses, phone numbers, emails, or other publicly available information (leaked or otherwise) is far more worrisome than a list of ssids.

I agree that a leaked SSID is less worrisome than leaked addresses, but the problem is that this list takes an nearly useless information and makes it a vital part which can basically locate someone down to the street address. And most people are absolutely unaware of how dangerous sharing an SSID is, assuming they try not be found (see: streamers, pop-stars or simply people which do not like to associate their actual name with their alias, unlike the two of us). For them it would feel like if I would tell you the color of my shoes and you'd find my address - it's simply not something you have in your mind.

It's not the end of the world, yes, sure. But it's not great either.

It's a sidenote, but the blow-up point of this is that it's one of the very few data privacy points for which you can directly show the impact. Usually, you have to go with abstract "if your data is leaked" or "someone at XCorp could ...", but in this case, if I can find your SSID I can send you your address, no further questions asked. And everyone knows people who know their SSID and/or can easily imagine this scenario. I'm pretty sure that's why this exact list is blowing up so much more than the far more egregious privacy violations we otherwise see.

> Total strangers can find my address by looking up ... my address.

Is there a global open address book with everyone's addresses?

It used to be called White Pages...

And people could ask to be delisted from it. Many celebrities and public figures exercised this option.

Google location doesn't associate identities with addresses like the white pages did, so that is not a perfect analogy. In an unfortunate case of self-reference, I'd say Google Location is much closer to a (paper) map, since it correlates addresses to physical location. As far as I know, no one[1] can delist their address from a map, not even public figures. A map will tell me where Number 8 Mulholland Drive is, nothing more, nothing less.

1. Military and TLA agencies excepted.

You had to pay a monthly fee for that privilege and talk to a customer service person to set it up. Often, your info still got sold to telemarketers.

In comparison, changing your SSID is free and something you can do yourself.

[1] https://www.nbcnews.com/business/consumer/unlisted-number-fe...

Don't know about you, but when I put any address into my maps app I expect it to guide me there.

if you know a name (or name fragment), real property owners can be found in county assessor websites in the US.

Lots of government websites will tell you who owns a property.

Meanwhile, there's no open address book associating ssids to names or ssids to addresses either.

No. For start not everyone has an address, not every address has an address.

In the U.K. the electoral roll does have most people’s addresses - about 70% of the country.

Reply on news.ycombinator.com