Hacker News Reader

Comment by recursive | Hacker News Reader

You can probably still be located by wifi access point.

How would that work? Are you suggesting 3+ of the access points within range working together to triangulate me, and saving that information, along with the phone's MAC address or similar?

It is laughable, isn't it? If they're needing wifi to triangulate you chances are they already know where you are anyways.

Hmmm. If I were a "cut-the-corners to the borders of being bent" cop (al la McNulty from Wired), I'd consider dropping cheap access points around places where I'd like to know if my "suspects" frequented, with SSIDs that matched local free wifi sources so that if a target had ever connected to the free wifi at the local McDonalds or Starbucks, their phone might automatically hook up to my "cloned" version of those hotspots. You'd be able to capture mac addresses from connection attempts, or being a little more evil - you could log any resulting traffic (and mitm ssl connections too, I wonder how many smartphone email/IM/socialnetwork apps do strong certificate checking?)

A single access point coupled with a typically lousy phone wifi antenna's range, narrows you down to well under a few hundred feet in my experience.

And Google's Streetview wifi data hoovering means thay've got a pretty good database of wifi access points to geographic co-ordinates. And I bet they're not the only ones building that database. I'd bet pretty good money that there was no ethical oversight or data retention/protection policy in place befre this started: http://www.brisbanetimes.com.au/technology/security/police-t...

How is Google's wifi data relevant here? Unless Google themselves operate the hotspot, they won't know what devices polled it or connected to it.

Near as I can tell, the privacy threat here is very specific. You come within a few hundred feet of a hotspot, and for as long as you are in that location, the hotspot receives polling messages with your MAC address. The hotspot's operator can in theory log information like "device with MAC address 00:11:22:33:44:55 was within a few hundred feet of [hotspot location], Sat Jul 14 from 00:29:05 to 01:13:22".

How big of a threat this is depends on:

1. The difficulty of mapping a phone's MAC address to an individual. Do we know this is easy? Is there a big database with this information? A quick search suggests that it's possible to spoof the MAC address on a rooted phone, so it could be configured to change randomly every few hours. That would seem to defeat this attack on privacy, though doing so may be outside the technical know-how of most people.

2. How common is it for those who operate hotspots to log, aggregate and share this data? I'm confident the locally-owned cafe down the street doesn't log this data. What if it's something corporate-owned, like a Starbucks? Is this kind of logging, sharing and aggregating to track users just a theoretical possibility, or is it actually commonplace? I'd suspect the former.

I don't have answers to the questions I posed above. But barring evidence to the contrary, I strongly suspect that setting a smartphone to wifi only makes location tracking go from trivial to at least moderately difficult.

The hotspot also passes data back to the handset, which can identify it individually. If the hotspot location is previously known that gives you coordinates. In dense areas like New York, you're within range of multiple AP's on a fairly constant basis, allowing for real time triangulation. This is why google maps prompts you to turn on wifi to improve location, even though you are not connecting to the Internet through the AP's.

Yeah, but doesn't that work by polling the APs then sending the poll results to Google over 3G/4G? If data is off how could this work?

For almost all smartphones, almost all of the time, 3g data will be on. Your objection above was that location tracking would require MAC to person mapping and the cooperation of innumerable hotspot operators. This is not the case.

We've got a reading comprehension issue. You're responding to my post about how easily you can disable data on an Android smartphone, which I proposed as a way to avoid tracking.

I yes, I missed your GGP. But it still doesn't work. If you actively use a hotspot then IP GEO tracks you. If you use wireless data then you can be tracked by cell tower triangulation by the network operator, by GPS, and also by passive wifi tracking that we've been discussing.

I suppose that you might be able to try tunneling all of your outbound data through a VPN tunnel, but at that point you might as well go back to using internet cafes and phone booths.

I prefer misdirection. Set up a device that will appear to be 'you' in many places at once. For instance, google and facebook both routinely believe that I commute from New York to London at least 15 times a day.

There's also the problem that if your phone uses the hotspots internet connection, anything it connects to gets the ip address of the hotspot - and Google (and probably Apple, and quite likely several law enforcement agencies) can look up the geographic location of that ip address. I haven't looked to see how chatty my iPhone is when it gets a wifi internet connection, but I strongly suspect iMessage pings Apple with some unique identifier for my phone whenever it can. I'd be surprised if there wasn't some similar "phone home" process for an Android phone with an associated Google account as well. Google and Apple _probably_ won't roll over to a request from some curious local small-town cop, but I'd guess most three-letter-agencies can get pretty quick access to data about my phone if they ask the right way…

Reply on news.ycombinator.com