Apple changed their documentation at my request but it proves they don't care about privacy

I don’t understand what you’re complaining about, exactly. Your wi-fi network broadcasts its existence to all and sundry, and yet you feel upset when somebody collects that information and passes it on.

And hiding SSIDs is a complete waste of time, which gains you nothing in security or privacy. Don’t do it.

Hi Lawrence,

I respect you, but I have to teach you so that you learn what you do not know, as you don't even know that you don't know what you said is wrong.

Rest assured, I know what I'm talking about. :)

I've discussed this issue with Brian Krebs and Daniel Veditz (of the Mozilla Security Team) so it's quite well understood by professionals.

The problem is most people who are NOT Wi-Fi pros, are stuck in the stone age when it comes to thinking about what a hidden broadcast actually does.

Worse, I've had to have this discussion a billion times because almost nobody else in the world outside of tech people knows anything about it.

The facts is you're thinking about security. Not about privacy. They're not even close to the same thing.

This is about privacy. Not security.

Apple literally manually removed my SSIDs from their database, as a result of my RADAR bug report and Apple literally changed their documentation.

That's new. That's solely because of me.

As I had reported months ago, Apple at first pulled the stalling legal trick of saying it's "not reproducible" but the person I had submit that RADAR bug report is an executive in the Apple Maps division who happens to be my next-door neighbor, and he knows full well I know my stuff.

They eventually told me "don't use a hidden SSID", which is the wrong answer, and they KNOW it's the wrong answer because they literally manually removed my hidden SSID (but only mine!) from their public WPS database.

The entire reason for a hidden SSID is privacy. If the SSID is hidden, it tells everyone you want to be private a. Google respects that b. Mozilla respects that c. Everyone respects that d. Except Apple

There's a HUGE difference in what happens to privacy between these events: A. You set the SSID to null B. You append _nomap to your SSID

That’s their problem, though. Trying to offer some kind of sop to their ignorance is not actually making them safer.

This is about the *perception* of privacy. Like telling people they don’t have to worry about closing their curtains, they just need to close their eyes -- if they can’t see the people outside looking in, then those looking in can’t see them!

Your car broadcasts its license plate number to anyone in sight of it, yet people are rightfully ticked off at Flock cameras everywhere recording them.

Paul Rubi:

Because machine data acquirement is more powerful.

I guess it is because the SSID is terminated in _nomap, which is documented as a flag to Apple and others to not store this SSID in their maps. But Apple is/was mapping them all the same.

Yep.

I got the impression they were claiming that their SSID was hidden, which makes it irrelevant as to whether it has "_nomap" at the end of it, but that Apple had somehow discovered and logged it nonetheless. It seems highly implausible.

I was wondering how you got on with your "experiment" only the other day.

You said you had installed two routers in friends' houses downtown, move them around and then track the movement in the database.

I'd like to see the results. How often did you move them, how far, and were the details tracked in the "apple database"?

Hi Lawrence,

I say with all respect that your statement is too wrong to accept as is. What you just said, I've heard a thousand times before, from many people.

And yet, it's no different than what I've heard by asking the guy next to me at the gas pump since the 1960's why he puts premium in a Honda Civic.

For over five decades, people have been parroting what someone told them. None of them actually understand a word that they're obviously parroting.

Same here...

Again, I respect you for your technical acumen which is greater'n mine. But I can't tell if you know privacy differences between these situations: a. iPhone owner happens to walk by my house b. Android owner happens to walk by my house

Do you know the difference in terms of what happens, or not, with respect to my unique AP BSSID & GPS location (both of which are exactly my house)?

I do. A. So does Apple. B. So does Mozilla. And Google.

Mozilla respects a hidden access point broadcast (i.e., it's set to null). So does Google (surprisingly). i. But not Apple. ii. And yet, Apple loudly & vociferously proclaims to care about privacy.

That's the part that is the most hurtful. Apple brazenly lies, with a huge "what me?" seemingly innocent smile.

Yet, Apple immediately removed my BSSID/GPS from their WPS database. Because they know what I know about the lack of privacy in that regard.

It may well be I'm the only one in the world who is honored so by Apple. But that's not my point as I care about everyone's privacy. Not just mine.

Another question for you, Lawrence, again, because I respect your acumen.

Do you know the difference between these two situations: a. iPhone owner happens to walk by my house & it uploads my BSSID/GPS? b. Android owner happens to walk by my house & it uploads my BSSID/GPS?

What happens then? Do you know?

I do. Anyone who can't answer those queries, can't possibly understand the issue.

Do you have any intention of letting anyone else know what the issue is?

Hi Jon,

Lil' ole' me can easily track a BSSID anywhere in the world, down to a meter or so accuracy, if I want to under the common circumstances which I've outlined in this thread (and in others).

I move my router around a lot, and I don't want just anyone being able to track all my movements down to a meter accuracy when I do that. Do you?

You were correct in your prior post to Carlos, when you said (verbatim): "I got the impression they were claiming that their SSID was hidden, which makes it irrelevant as to whether it has "_nomap" at the end of it, but that Apple had somehow discovered and logged it nonetheless. It seems highly implausible."

But, of course, there's more detail (which I provided in my responses).

I explained it in gory detail, and even provided a link to the research. I provided some of the python scripts too (although they're not the point).

We've discussed this ad infinitum on the Apple & Android & Windows ngs in the past, although I don't remember how much we brought in Python folks.

What's *new* is Apple told me in my email that there was no way to have WPS privacy from Google/Mozilla if I wished to have WPS privacy from Apple.

It's a catch-22 situation. Which would you pick?

HINT: If we read the research paper, it's a no brainer which one to pick.

Hi Chris,

Thanks for remembering that I ran a 3-router experiment early in the year.

That experiment was run in the first month of the year, which was before Apple changed their documentation saying that they will track us forever.

Those BSSIDs are now in Apple's WPS database, so the experiment worked. Now, anywhere in the world I move those routers, anyone can track them.

Instantly. Down to a meter or so resolution. With no controls whatsoever.

Think about that. What if I were hiding from an ex-wife or disgruntled Apple poster?

Anyone on the planet can track my router location from anywhere in the world down to meter-like accuracy, and I simply cannot stop them.

The only thing I can do, once my BSSID is in Apple's WPS database, is throw that router over the next bridge because I can't change the BSSID on it.

I can be tracked forever, if my location is associated with that router.

Just like the research paper said it would be. I simply reproduced exactly what the research paper said was possible.

Worse, I proved hiding the BSSID broadcast was a catch-22 situation. a. It kept the BSSID out of Google/Mozilla hands (they're well behaved) b. Yet, it's permanently in the Apple WPS database

Which do you pick to be in, given you can't solve both issues at once?

HINT: Apple's WPS database has no protection whatsoever, as proved by: *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

My research *started* with that paper, and took it to the next level.

Heh heh heh...

While I realize Apple religious zealots will attack people personally because they defend the mothership to the death, no matter what, without ever even understand the issue at hand, what matters for this thread, is we discussed this at length on Apple ngs using the *old* Apple documentation.

We reproduced the work of researchers from Levin & Rye in this paper *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

We posted the python scripts. And we chose a location in Louisiana to track router movements by BSSID. And we listed the results, by BSSID, GPS and home address. We quite easily found the registered owners of each of those residences.

Do you remember that? I do.

We proved that everything said in the paper above was correct, down to the very fact that Apple let lil'ole'me collect tens of thousands of identifying pairs of BSSID's and GPS locations (which map to addresses).

We proved, even at that time, months ago, that anyone could track the movements of that BSSID forever, from anywhere in the world, to anywhere else in the world, without any protection whatsoever by Apple.

This is what the paper said would be the case. And it was.

What's *different* is the paper did not cover hidden broadcast BSSIDs. I did.

That's the test which Chris is talking about, and which Apple knows about. a. Apple _removed_ my BSSIDs _after_ I told them about this. b. And Apple _changed_ the documentation, _after_ I told them about this.

That's pretty good for someone whom the Apple trolls claims "knows NOTHING about Apple", especially since I proved every single claim that I had made.

The flock camera analogy only works if anyone in the world can access it. *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

While I understand the analogies being presented, and certainly I understand the purpose is to claim "no big deal" as a result, I must beg to differ because the analogies, while reasonable, fall flat on some regards.

What if, for example, the government allowed you to put a black cloth over your license plate, and that is a clear indication that you don't want it to be recorded by Flock cameras (& by extension, your movements recorded).

What if Google cameras respected that black cloth as did Mozilla cameras. But what if Apple cameras refused to respect that common leave-me-alone black cloth?

Think about that. What if *only* Apple cameras lifted up that black cloth, on purpose. So that they could get your unique vehicle VIN that tracks you everywhere.

Pretty bad, huh? But wait... it gets worse.

What if the Google camera, if it happens to get your license plate, which is tied to your unique VIN, but the Google camera sees *another* indicator that you do not want them to put that license plate into their database.

Let's say that's a sticker, on the plate, that says, oh, let's say _nomap.

What does Apple do? Versus what Google and Mozilla do?

But wait, if that's not bad enough, there's still more. A lot more in fact.

What if anyone in the world could look up that license plate & related VIN from anywhere in the world, and there are absolutely no controls on that?

What?

Do you see the difference?

Allow me to provide an example: a. Let's say my ex-wife is in Germany, back in the home country b. But, she wants to track my vehicle everywhere I go c. As described in the aforementioned research paper, she can.

It's no different than you choosing the license plate of your ex-wife (or whomever) and tracking them anywhere in the world, with no controls on that.

Do you see why understanding the problem set makes the flock camera issue only superficially an analogy.

The flock camera could only be an analogy if anyone in the world could track your movements down to a meter resolution, with no controls on that.

Ok. I think BSSID means "MAC address of the WiFi access point". I don't know what circumstances you can track them, and you don't seem to have said in this thread.

I suppose if someone had reason to target me specifically, and they had a real-time way of tracking BSSIDs, and for some reason I can't imagine I was taking a WiFi access point with me, I... oh, wait. In that circumstance I would not take a WiFi access point with me, for the same reason I wouldn't have my mobile phone radio enabled, or would not have a mobile phone with me at all, depending on the threat model.

I saw no response from you to that post. But from what you're saying in the post I'm replying to now, I wasn't correct - I now think you're saying that Apple store the BSSIDs of access points of WiFi networks with hidden SSIDs, because they *don't* know the SSID and therefore can't tell if it has "_nomap" appended, and so don't exclude it.

I'm not sure what I think about that, and I don't know what any of the other companies that map SSIDs do in the same situation. I'm not sure why Apple would store location data of BSSIDs with no visible SSID - it doesn't seem like it would help the geolocation feature much, since hiding the SSID is pretty rare.

You haven't done any of that in this thread so far as I can see.

Sorry, what does WPS have to do with it? And why is it a binary option? A non-hidden SSID with "_nomap" would presumably provide privacy from all those companies? Or do some of them not support that? Or is having a non-hidden SSID not acceptable to you? If so, what are the options for privacy you are referring to?

I mean I literally do pick a non-hidden SSID without "_nomap" on it, that I've kept constant for decades. I've never even seen a SSID with "_nomap" on it. There is no-one I regard as a threat, let alone someone who would be a threat and who would know my SSID let alone my BSSIDs.

What research paper?

Maria Sophia snipped-for-privacy@comprehension.com writes: [...]

Can you please restrict this to newsgroups where it's relevant?

In particularly, there's in this thread nothing about Python or Windows 10.

If there is any difference, it would not be wise to rely on it.

That wasn't the experiment.

That's not answering my question. Did you move them and what did you see? Remember your claim was that you could track people from California to Florida using only their router.

Evidence?

What did you test?

Just get a different router.

No-one knows which, of the billions of entries in the databases, is *your* router. No big deal.

I don't remember whether you addressed this ... how does someone who hasn't visited your address (i.e they already know where you live) discover what the BSSID of your router is?