Google staff 'knew of wi-fi snooping' | Hacker News Reader

Google staff 'knew of wi-fi snooping'

bbc.co.uk

56 pointsed20933 comments

The next news story:

Google KNEW it was providing internet services to everyone in Kansas City. This gave them access to ALL of the emails, ALL of the passwords, unless people took extraordinary measures, such as using a hypothetical "https" access. We spoke with one researcher and he said he didn't trust https because it ends in an 's', just like the word 'snakes.' Senior officials at Google knew that they had spent billions of dollars to provide this service to residents of the unsuspecting town. Congress to have hearings about this so-called "Internet Service." Top officials at the FCC scoffed, "How can they claim to not be evil when they provide internet service to children - some of whom are probably watching pornography?!"

You do realize that Google promised not datamine your email when building a Google-wide profile of you until March 1st?

I'm not sure I understand the point of your reply. The https here is a red herring: Google can read your email even if you use https. https only prevents intermediaries from reading your email.

It was a joke.

the joke is on VikingCoder and Google.

In this article, Google was the intermediary. I was pointing out that when they're an ISP, they're ALWAYS an intermediary. As is every other ISP.

https is absolutely not a red herring. If you use an unencrypted wifi, and use http to access your online services, you do not care at all about security.

After the fact, blaming Google for recording open wifi data is absurd.

The point of my post was, if you're concerned about Google accessing the data between a computer and random services on the internet, then you should be REALLY concerned about them being an ISP. Just like you should be concerned about every OTHER ISP. The solution to not having ISPs - or other intermediaries - have access to all of your data is to use an https connection to your web services.

Do you see the acronym "https" show up, at all in the linked article? No. That's absurd. It is THE SOLUTION to people sniffing your emails and passwords.

Just because my door is open doesn't mean you can just walk in my house and steal my television.

I find your analogy absurd in every respect.

What about if your door is open and you're talking loudly to your friend on speakerphone with the volume way up? Do I have to plug my ears when I walk past?

Still doesn't give you the right to steal my tv.

Is passive war-driving illegal? The only precedent I've found is State v. Allen (1996) [1] where war-dialing was ruled legal so long as one didn't actively try to gain access beyond the connection to the "public interface."

As billpg points out in [2], in passive war-driving you have to receive the whole 802.11 frame before you even know if it's a beacon frame, which ostensibly was Google's primary interest here. Is it odd that Google stored all captured frames to disk? It's true, they could have just logged network information and discarded the frames. Then again, consider that the default in kismet is to save both a log of networks and a pcap dump. So this may have just been an engineering shortcut -- collect the data and process it centrally.

[1] http://en.wikipedia.org/w/index.php?title=State_v._Allen

[2] https://news.ycombinator.com/item?id=3908794

Of course it makes technical sense to just log everything. Especially at a company with the culture of google.

Ugh, I hate this whole story.

Digital privacy is a really important issue. There are debates we should be having about this stuff, as a society. Google accidentally capturing some stray packets from unsecured wifi is not one of them.

I've long been curious if G uses(d) the wifi data to augment its android location triangulation resolution...

They definitely use WiFi data for geolocation. I'm pretty sure that was one of the primary reasons their streetview cars were collecting wifi in the first palce.

Hmm, the crux of the story is that it wasn't accidental. Which is what makes it newsworthy. YMMV.

Don't panic!

http://blog.hackensplat.com/2010/05/google-snooping-wifi-don... (Shameless plug.)

From your link: "...your WiFi access point has to broadcast it’s identity to the public in the clear..."

It doesn't. You can hide the SSID.

Hiding the SSID breaks 802.11 specifications and isn't actually hidden anyway. It isn't private, it was never intended to be private.

Extremely easy to get around and doesn't accomplish anything.

Right on. The BBC article should link to this. Better that Google nabs unsecured data without intent that someone else with intent. Too much hype.

What's worse than nabbing private packets is Google sticking a camera on a 10 foot pole and drive down residential back lanes where the camera can see over fences into private backyards and in some cases into living rooms. This happened in my town, to my house, and I felt my privacy was invaded. Google street view can see a lot more than someone walking along the street because nobody but Google is 10 feet tall.

> Google sticking a camera on a 10 foot pole ... Google street view can see a lot more than someone walking along the street because nobody but Google is 10 feet tall.

No one else has 10 foot poles or can attach cameras to them?

There's also satellite view....

Link mentions collecting that private data is illegal. Is this a UK thing? Is collecting that private data illegal in the US also? was under the impression it was not illegal in the US.

It's wire tapping which is illegal in pretty much every country.

Then isn't everybody who ever connects to a public/open wifi "wiretapping?"

No, only if you set your network card to promiscuous mode and crack open a tool like Wireshark.

Google kinda did that, but didn't ever actually access the data apparently:

http://www.engadget.com/2012/04/28/justice-department-clears...

TBH I'm just repeating what's been said here a few times like when that facebook snooping tool came out, I think it's all still a bit of a gray area.

But basically unless you're google I wouldn't get caught snooping on a public wifi, you're liable to serve some jail time. Which kinda reminds me I think my laptop's card is still set to promiscuous atm.

Did you read the BBC article? Your entire blog post tries to explain away the storing of private data as an accidental byproduct of capturing the names of access points. Even Google admitted this was not true.

"Engineer Doe intended to collect, store and review payload data for possible use in other Google projects."

I feel like this sentence is misleading; it implies that the 'payload' Google's interested in is personal user data, as if Google has a team of engineers in its basements looking through the cat photos and credit card numbers it captured in Wi-fi packets.

"Payload data," in this case, is most likely fragmented packets for which it can glean metrics on how to make the process more expedient in the future.

Of course, I can't say this with 100% certainty, as I'm not involved, but the entire story seems geared to make Google's capture of radio-broadcast data packets seem far more sinister than it really is.

I know it's the BBC, but I am always disappointed by the technical calibre of these reports, "The data gathered included contents of some emails and web browsing history". Guess I should read Ars.

well, technically if they got a being-requested URL then that will be web browsing history.

True, just wish they'd put some meat on it! Tell us a bit about how it worked, what they captured. Then again, it is mass media and the comment is probably a reflection of me being too lazy to read the FCC report, etc. :)

Are we really surprised?

Pretty sure there is alot more they know about.

Previous discussion: http://news.ycombinator.com/item?id=3904903

Don't be evil?

Reply on news.ycombinator.com