Comment by joecool1029 | Hacker News Reader

Comment by joecool1029 | Hacker News Reader

As others have pointed out, mac randomization mostly greatly reduces privacy risk. I'm not sure wifi scanning emits your mac address unless you connect to hidden ssid's. Bluetooth devices always bark out some kind of beacons when turned on.

This is basically a door people counter made for areas where you couldn't have a door. Malls used that tech 30+ years ago, little LED sensor that counted up every time the beam was broken. Small LCD screen usually at the bottom of the gates you pass through going in. If not a gate, then usually a beam with a reflector on the other side and the screen was on back of the beam/sensor unit.

For this use case, easier to count active mac addresses to figure out how busy each area is, doesn't have to be precise but it lets the town and advertiser know whether it makes sense to install a sign somewhere. Gives a general idea of ad impressions and is way cheaper and less intrusive than using cameras.

With that out of the way, I'd be more concerned if these were like other kiosks that also broadcast wifi and that connection was collecting unique information. This should be the main concern, this is where the good easy to correlate personal information is. That and cameras on advertising devices that do face/attention recognition.

MAC randomization partially reduces privacy risk. But there is a separate issue where your phone broadcasts a list of its known SSIDs (so that it can autojoin known networks and switch between multiple routers on the most recent network - I believe Lockdown mode disables this). So if your home WiFi router has a unique name, your phone is constantly shouting it, asking if this SSID is nearby.

The MAC randomization means that it will be a different MAC shouting this SSID every time. But the billboard vendor can see there is someone walking past it each day at 10am looking for a wifi network with SSID "PrettyFlyForAWifi."

And they can search that SSID in a public wifi map like Wigle.net to find the location of your house.

To mitigate this, find the most common router name in your country and use that for your home network.

I guess it's `xfinitywifi` https://wigle.net/stats#ssidstats

But....... if I do that, and my neighbors all definitely have it, how does my phone know which one to connect to? Am I leaking my password to my neighbor's APs, or does it use a hash somehow?

How do I tell my friends "My Wi-Fi is xfinitywifi... not that one... not that one... uh just put in the BSSID"

You don't leak your password. There is some kind of hashing involved, but I can't remember the details and don't want to comment with incorrect information.

Hopefully someone who knows the answer will reply... :)

Update: The answer [0] is basically that if the probe request is for an SSID of an open network, then a malicious access point can say "that's me" and the client will connect. (Also, note the "that's me" is not a response per se, but a separate advertisement for a network with that name.) But if it's for a WEP or WPA/2 network, the client won't connect unless the malicious router also knows the password for that network, because the handshake used to generate encryption keys requires that the client and access point agree on a shared secret.

A malicious router doesn't know ahead of time whether the SSID in a probe request refers to an open network, so it could try to establish it and see if the client connects. (Even for closed networks, it's also possible there is a bug in some client software that would ignore errors caused by the server supplying the wrong key?)

[0] https://security.stackexchange.com/a/210798/76104

> Bluetooth devices always bark out some kind of beacons when turned on.

They don't, as far as I know.

Bluetooth EDR ("classic Bluetooth") doesn't broadcast anything at all as far as I know, and only listens for connection requests (that need to know your MAC address to be able to ping you).

Bluetooth LE devices are a bit more noisy in terms of broadcasting but support privacy addresses for service announcements.

There was a Soofa sign near my house across the river in Somerville that (now that I think about it) I haven't seen for a while now. The branding wasn't quite as prominent as the Brookline Bank sponsored one in the photo. As I recall it displayed a vaguely useful calendar of local and city events, plus a question you could reply to on Twitter so they could show "engagement".

I'm not surprised nor especially troubled that the sign gathers pseudonymized MAC addresses in hourly buckets. In the last several years there's a mini-trend of startups attempting to provide more or less anonymized smartphone traffic data to cities and towns for urban planning purposes.

In theory this is good! Ideally it helps city hall be more data driven and see things that might not filter up to city hall, in a "pave the cowpaths" way (E.g,. do we need a new circulator shuttle stop? What's happening that one weekend in May that drives so much foot traffic and that we're not aware of at city hall, and should send a police detail to control that intersection? Oh, that brewpub has an annual event we didn't know about that blew up on Instagram.)

In practice I think the problem is the wins tend to be minimal compared to the effort involved.

All that said, I don't love the conspiratorial, low-trust assumptions you're encouraged to make by the bare statement "They’re collecting data from your cell phone."

But without privacy regulations I suppose that's where things will inevitably go -- people will assume a priori that "data collection" is itself threatening. (I certainly foresee a lot of rich retirees agitating to cancel the contract at the next Brookline town meeting.) So I wonder if the main benefit of better privacy regulation in the US would be preventing further deterioration of the basic trust that allows the "collective intelligence" vision of the 00's to come to fruition.

American here - it is foolish to trust so much; history has shown again and again that a few determined actors, often wearing a uniform, can and do "fleece the sheep" for fines, tracking or whatever else.. With that said, there are plenty of benign or even constructive uses for traffic data. This is not traffic data alone. The worst offenders of privacy violation and aggressive monetization with or without consent, can do a lot of damage.

Reply on news.ycombinator.com