Hacker News Reader

Comment by TavsiE9s | Hacker News Reader

Great. Can you share how exactly someone's location is being derived?

> ...what building they're in...

Given that not every device has built in GPS, it sounds like the Network Team is going to have to provide the locations of APs for that to work.

Curious how Teams will resolve that. If you're on your phone using a VPN back to your home network will it know or show you as at home? What happens if you have multiple APs at home?

There are public databases of APs. Google reportedly used their Android users to sniff APs (?), and used StreetView vehicles to wardrive. MS can surely pin many APs to user's PII and locations just on the data they already have?

> Google reportedly used their Android users to sniff APs

Pretty sure that's how it works across all phones. I know that's how Apple gets their location services database at least.

https://github.com/acheong08/apple-corelocation-experiments

Perhaps it can be derived indirectly, if you have all global positions in the area and can calculate back, with some uncertainty, who is where and when and how.

It's like in Minority Report. Though with not perfect accuracy yet.

Yeah, you need to add the BSSID of all APs. VPN does not matter the OS will have to provide access to this info.

Or you set up a local router with an SSID that matches one from the corporate internal network.

That actually sounds like fun. The result, I mean; not the whole setting-up-a-router bit.

You'd probably want to clone the BSSID of one of the APs, the SSID is unlikely to be used as it gives zero context to which office it's at most of the time.

Assuming this is how it functions, the network team would export the list of BSSIDs (I.e. AP+SSID+Band specific wireless MAC used) by location and then there's really nothing about being VPNed in or even having a remote work device which advertises the work Wi-Fi that would create some problem needing to be resolved.

The tenant admin configures that mapping. They can also configure whether the data can be exposed to users outside of the organization. There’s no magic here.

Reply on news.ycombinator.com