Hacker News Reader

Comment by Kurts | Hacker News Reader

You can turn it off if you like: Settings > Privacy > Backup my data, backup application data, Wi-fi passwords, and other settings to Google servers.

Every few months someone rediscovers that Google also syncs Wifi credentials between devices (perhaps when logging into a new device and finding it tethers itself nicely to the network on its own).

It's a matter of convenience, Wifi passwords are only applicable at a certain range, and other restrictions could be applied even then (like hardware whitelisting etc) it's not your bank credentials.

Here's a reddit discussion (from 2 years ago!) http://www.reddit.com/r/Android/comments/g6ctt/just_upgraded...

View on HN

Hmm. That path doesn't seem to work on my Nexus 4 running Android 4.2.2. The closest I could find is Settings > Backup & reset > Backup my data (Backup app data, Wi-Fi passwords, and other settings to Google services). Tapping this, it says "Stop backing up your Wi-Fi passwords, bookmarks, other settings, and app data, plus erase all copies on Google servers?". So, it sounds like it's all or nothing.

Thanks, that path you posted applies to my phone too. It looks like the Backup setting was already off for me. It might be one of those settings that you are prompted about while setting up the phone.

Phew! It appears that my instincts were correct when I first turned on this device.

I keep wifi passphrases in a location that is just as secure as the ethernet network to which the wifi is tied: on a piece of tape on the bottom of the WAP. Looking at this again, in the unlikely event I forget the passphrase, seems not to be a burden.

> like hardware address whitelisting

I wouldn't recommend that in any circumstance, it's completely false security really.

MAC filtering is incredibly easy to bypass, all Malory has to do is wait for another device to connect and clone their hardware's address.

Yeah but he doesn't have the password, unless somehow he hacked Google's servers for that specific one. It's the combination of both that makes it unlikely, there are far easier/better/more practical/likely ways of penetrating wifi networks.

My point was, it's more an illusion of security than anything. Best not to bother at all.

Wait until somebody else connects to have his MAC, then wait until he disconnects. Otherwise, you'll see a ton of RST flying, making your connection quite useless. That's a good enough deterrent for the typical "attacker", who just happens to need a connection here and now and saw a network using WEP.

It's also a diagnosis nightmare. The ISPs in my country used to use WEP with MAC filtering with their wifi-routers. The password was mildly complex (16 characters) and on a label on the box. Most users never changed the password. So Joe Blow connects his laptop using the password on the sticker, and it doesn't work. Imagine the same problem for a few million users.

It's false security because (especially for wifi) MAC filtering is like a verbal password that's been written down on a billboard. Everyone can read it so its not a secret.

Heh, even the longest possibly WEP key can be broken in a few minutes with consumer hardware. At least ISPs in Australia use WPA as standard.

They use WPA2 now and from a few years ago. The cheap wifi-routers they sent out years ago didn't have the muscle to do WPA encryption.

Our have for a while too. Sure the password is the hash of the the routers MAC and the manufacture date, but they did try.

Convenience isn't an excuse to not encrypt security data, it does not matter if it is a limited to a few areas where it could be exploited. If Google (any companies, including Apple) can not be trusted to protect such information, they should not be offering it in the first place.

If it can be exploited, it should be protected as much as it can be.

We all saw what happened with Google's StreetView cars capturing the local Wi-Fi traffic. The same thing could be used by somebody hacking into Google's servers, downloading the Wi-Fi passwords and any possible maps data if possible and workaround getting into people's Wi-Fi networks. If it is not likely but it is not impossible.

It's more than "unlikely", it's ridiculous. It's the longest way around and possibly the stupidest route to get onto someone's Wifi network.

Really? Google has the knowledge of where the network is, who has access to it, and what the password is. Remember also that WiFi networks are a shared resource and often provide access to internal corporate data.

From a governmental law enforcement perspective, that's an incredibly valuable trove of data. Instant network backdoors, likely with no physical entry required.

Even if you're not using the data to sniff networks, you can use it to build detailed relationship graphs between people and places.

It's a stupid way to get into a specific network, but it's a pretty convenient way to get access to everybody's networks. Sure, it would be hard to hack Google, but the prize for doing so would be pretty nice. And if the systems are impregnable, there are always ways in that relies on the human factor. Humans can be bribed and/or threatened.

Or if you're law enforcement, the knowledge of the existence of the resource is enough.

But where is the problem that google encrypt them? To restore, i have to use my account and my password. And why can i not change the option, to backup the application data without WLAN passwords? For a billion dollar company, this should not be so complicated, or ?

Reply on news.ycombinator.com