Apple changed their documentation at my request but it proves they don't care about privacy

Hi Jon,

Thanks for your questions as it shows you're trying to understand this.

Your questions are all good questions, from someone who is encountering this issue for the first time in their lives, but let's be clear that an entire course in networking for privacy is beyond my personal skill sets.

If you don't know what a BSSID is by now then it will take too much work here to explain it "fully" to you. Suffice to say it's like a vehicle identification number on a car. It goes everywhere the router goes.

Every access point has a unique BSSID that stays with the router forever.

(Yes, I know in extremely expensive routers, not home routers, that the BSSID can be changed, and yes, I know, in those extremely rare situations, the BSSID may actually not be unique, but only one out of a million people know those facts, so suffice to say for this thread the BSSID is unique).

The Apple trolls absurdly claimed that changing the SSID changes the BSSID, but the fact remains the BSSID remains the same no matter what the SSID is.

Read the paper which we referenced multiple times in this thread so that I don't have to re-hash over and over again how mass surveillance is possible with the Apple WPS database design.

Anyone who can run a python script (which I will provide to them upon request) can track anyone in the world who moves from one place to another (and who happens to take their router with them to their new location).

Nobody disputes that fact, which is what the paper itself explained. I simply reproduced their "billions of BSSID/GPS pairs" with thousands.

It doesn't bother you that I can track the movements of billions of people if they happen to move from one locale to another using the same router?

You think this tracking isn't happenging asa we speak? You think Apple is doing something about it?

That's 1/2 the point of this thread. 1. Apple is doing NOTHING about it (as described in the paper) 2. So anyone in the world can track the movements of billions of routers 2. Worse, Apple isn't honoring the established meaning of the hidden broadcast (which even Google honors, by way of stark contrast).

So much for Apple "cares about your privacy" bullshit, huh? It's shocking that google cares about privacy more than Apple does.

There are two fundamental issues, only one of which is in this paper. *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

I've summarized what's in that paper likely a half dozen times in this thread, and I've added a second issue that is not discussed in that paper.

I've talked that second issue over with security professionals like Brain Krebs and Daniel Veditz, so there is no doubt of the veracity of my claims.

To summarize complex issues in a few simple sentences, they might be: 1. Apple allows anyone on the world to track the movements of everyone in the world (if they take their router with them when they move). 2. Apple puts zero controls on that tracking by anyone, of everyone. 3. In addition, Apple does not respect the known meaning of a hidden broadcast, and worse, Apple *refuses* to honor what even Google does. 4. Anyone can prove these statements are true on a Windows PC running Python using the scripts I have provided for that express purpose.

Remember the Apple trolls posted to this thread that changing the SSID would solve the issue, but the main issue is about the BSSID, not the SSID. a. The BSSId is unique (see above for rare exceptions). b. The GPS location is also unique c. The SSID only plays a role tangentially, and as such is a minor player

Assume, for an analogous purpose that a flock camera allowed anyone in the world to track everyone in the world, not only by the license plate (which can be changed) but by the VIN number, which cannot be changed.

Then assume Flock knows this, but refuses to add any security whatsoever. a. Worse, assume all the other camera outfits DO add security. b. Not only that, the other camera outfits add lookup protection.

That's a decent analogy of what's going on that is more easily understood.

Did you read the paper? What does that paper say?

Do you know what a hidden broadcast SSID is? What is the purpose of a hidden broadcast in your opinion?

I've explained both perhaps a half dozen times in this thread. Explaining another half dozen times won't help until you do the above.

It's unfair of you to claim I haven't provided you an entire courese in basic networking, when you didn't even click on the links we provided.

Wrong WPS. Read the paper. *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

What you need to think about is what the paper explains about the SSID. *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

Then, you need to consider what happens when that SSID broadcast is hidden.

Only one out of a million people (or so) has thought about those two things (but it goes further since now you need to consider what Google/Apple do).

Google does one thing (which, surprisingly, is the right thing to do). Apple does the opposite (and, not surprisingly, refuses to change it).

If you don't follow the trail from your router to some guy in Russia who is tracking the movements of everyone in the world, you can't understand it.

Read the paper (which explains half the issues brought up here). *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

The code supplied for you to run is Python which ran on Windows 10. I know this because I got help in the code from Windows/Python ngs.

So, together, the Windows & Python newsgroup honed the working code. Do you need me to supply the code for you again so you can run it?

One script will arbitrarily choose a BSSID, and then scrape the Apple WPS database for that BSSID, and change it until it gets a hit (takes seconds).

Once we have a BSSID in the Apple WPS database, another python script runs periodically to ring a bell when that BSSID moves more than 100 meters.

We proved that earlier this year by moving the three old Linksys routers from one section of town to another to simulate people moving from one apartment to another (where it could track them anywhere in the world).

In addition, another python script run from Windows 10 exactly reproduced the findings of the research paper, only for thousands of BSSID's, not billions (which I simply do not have the time or patience to gather). *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

The fact every BSSID/GPS pair can be obtained by anyone at any time with zero restrictions can be proven by anyone who runs that python code.

If that doesn't bother you, then start thinking about what we proved by running the same Python code on Windows 10 to show the hidden broadcast BSSIDs not only show up in the unprotected Apple WPS database, but Apple refuses to solve that privacy problem (which even Google will honor).

When I discussed this with the Apple Maps' executive, the answer came back, literally from Apple lawyers, was that they'll change the documentation.

And they did.

There is a *huge* difference, Lawrence.

For half of that huge difference, all you need to do is read this paper.

For the other half of that huge difference, all you need to read is this.

"The BSSID of the Wifi network. Hidden Wifi networks must not be collected."

Then, read how much Apple "cares about your privacy" by reading this!

For contrast, read this:

HINT: Mozilla/MLS would not collect data from Wi-Fi networks with hidden SSIDs.

Daniel Veditz confirmed that Mozilla MLS, like Google WPS, does not even

Notice the difference between 'collect', 'save on device" and 'upload' to servers, because collecting means it can't be uploaded and hence not saved into a global database for everyone in the world to easily track the router movements from anywhere in the world to anywhere else in the world, in almost real time with meter-like accuracy with no restrictions at all.

Most people don't understand a word I'm saying above, so I need to be clear that "collecting" is different from "uploading" which itself is different from "saving" which itself is different from "allowing anyone in the entire world to access the unique BSSID/SSID pair" sans restrictions.

If you think through the fate of the two situations I keep presenting to you, you'll see where they diverge in such a way as to be shockingly scary.

With the Python scripts we worked on in December of last year, even I can track any router's movements in the world, with zero restrictions.

Want to test it? Give me your router AP BSSID in your own home.

I'll tell you where you live.

Chris,

I realize your only goal is to defend Apple's honor to the death, no matter what, but I only needed to prove two things, both of which are now obvious.

1. Apple's WPS database can be used by anyone in the world to track the location of a router AP (by BSSID/GPS) without any restrictions.

1. Apple's refuses to honor the documented intent of a hidden-broadcast.

The fact you're desperate to dispute those facts in order to protect the honor of your religious God is evident in the fact that the researchers proved the first point, and Apple's *new* documentation proves the second.

Three simple questions for you, Chris:

Q1: What do you dispute about point #1 above, after reading this paper? *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

Q2: What do you dispute about point #2 above, after reading this new link?

Only a religious zealot could possibly deny the veracity of those 2 facts.

Want to know what my third question asked of you is, Chris:

Q3: Would you kindly give me the BSSID of your home router AP please?

When/if you do so, not only will I provide the exact location of that router (to the resolution of GPS) but I can track its movement, forever.

With no restrictions on that tracking (see point #1 above, for proof).

Well, yes, it's the MAC address, like I already said.

You hadn't referenced it at the time I wrote my post, or at least by the time you wrote the post I was responding to.

It mostly seems to be an attack against people who don't realise they are targets, or are not thinking about the implications - c.f. soldiers who upload their daily runs to public web sites thus revealing if/where they are deployed.

As I say that's a pretty unusual thing to do (travelling with a router). Google's API does seem more sensible though (give it MAC addresses, it tells you where you probably are, rather than giving you the recorded individual locations of all those MAC addresses).

Have you, er, read the paper? It says Apple *is* doing things about it (page 14, section 10 paragraph 3).

This is the bit I keep asking about and you keep not responding. Is your actual/main complaint that Apple is storing BSSIDs that correspond to hidden SSIDs? And you're saying only Apple do this, not Google etc?

Apple cares about the privacy of *its customers*.

I imagine the issue here is that if they change their API then older devices that are no longer receiving updates will stop being able to do wifi-positioning.

The "Apple trolls" are presumably correct inasmuch as if you change the SSID to end in "_nomap" then it solves the issue.

You hadn't linked the paper at the time I wrote my post. The paper doesn't quite say what you're claiming, I think, although I see your general point (or at least, the paper's authors' general point).

To waste power in client devices, as far as I can see, since it means they have to be constantly pinging for the network rather than just connecting to it when they see the SSID broadcast.

So in some senses it makes the user tracking problem *much worse*, since it means the attacker can hang around public places watching for client devices (which, unlike access points, tend to move around with the user) that are pinging for the attack target's hidden SSID.

Hang around a diner near Langley, Virginia, watching for people carrying devices pinging the hidden SSID "CIA UNCLASSIFIED"...

I'm starting to think that by "this thread" you don't mean "the set of Usenet articles referenced in the References headers" and are including other historic threads...

I think you are still failing to explain what those two things are, and I'm getting tired of guessing. If you are claiming the paper describes this difference, please say where. If it doesn't, please just say what it is.

This is the same as:

I felt that since everyone was throwing analogies out there I'd try my hand too.

There's only so far analogies can take you when you actually believe they are the same without a shred of proof.

Hi Andy and Chris,

I'm going to give you an example of how absurd your attempt at ridiculing the documented situation is, using your own analogies, by way of impact.

Your questions are good ones, but it's getting tiresome to answer them over and over and over and over and over and over again, so please think first.

The question is the wrong question, as it's kind of like asking what's so dangerous about everyone in the world having your social security number.

You're essentially ridiculing privacy because, to you, a social security number issued to you by the gov'ment, well, it's "just a number" after all.

One third of your argument ridiculing privacy is that you argue your government-issued ID unique to you should be available to everyone.

To you, it's just a number. It's not you.

It's just a number: 123.45.6789 How dangerous can a simple number be to your privacy, you argue.

That's the 1st third of your argument, attempting to ridicule privacy in your desperate attempt to absolve your religious God of any responsibility.

By ridiculing the fact that a social security number is "just a number", you also forget that in this case, that number is associated with your exact GPS location (within the accuracy known for GPS, which is meters).

Even that doesn't change your opinion that a social security number, tied to an exact GPS location, is "just a number" and "just a location on a map".

So that's the 2nd third of your argument, which is that your location is "just a map" and everyone in the world should be able to easily locate you.

You go further to ridicule that having a social security number and a GPS location of where the person who owns that social security number is "just a number and a map", you then try to ridicule the fact that anyone in the world can access your social security number and where you are, from anywhere else in the world.

That's the 3rd third of your argument attempting to absolve Apple of all responsibility for the design of the Apple WPS system as described here. *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

Did you read that paper? Of course not.

Otherwise, you couldn't make your absurd accusations that a unique government id tied to you, along with your exact location, is "just a number" and "just a map".

To further show the absurdity of your attempt at ridiculing this issue, not only can anyone in the world track your movements by social security number and by location, but they can track EVERYONE in the world by their social security number (or whatever unique government ID) by running a python script on Windows 10 (assuming, I think we calculated, 2GB of storage).

That's the reason the paper says "mass surveillance". You missed that point.

Why did you miss that point? Because you didn't even click on the link.

You ridiculed that paper. Without even reading it.

Wait, there's more.

In your attempt to ridicule the fact that anyone in the world can track everyone in the world using a simple Windows 10 PC and a Python script which we worked on together late last year, but now you're trying to ridicule the fact that there are absolutely no restrictions on that lookup. *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

But wait. There's more.

Not only are there no restrictions on the lookup of your government ID number to your GPS location, but it collects the governemtn ID number and the GPS locations of the closes 400 people to your location at any given time.

Yes. Not one. Not two. Not ten. Not 100. But 400 of the closest people.

Now anyone in the world can track your exact location by your government ID without any restrictions, and, they can track the next 400 closest government IDs and locations, forever, again, with no restrictions.

Oh, there's more. Much more.

What if you do NOT want someone to even collect your government ID and location and that of the next 400 closest governmetn Id's and locations?

What then?

What if, oh, say, you put black tape over your government ID. What if you do that?

"Hidden Wifi networks must not be collected."

Will Google honor that black tape? Yes. Will Mozilla location services honor that black tape? Yes.

Will Apple?

When I started this Windows10/Python testing in December, we did not know the answer to that question, officially (as I knew the answer instantly).

Why did I know the answer instantly? Because I ran the Python code on Windows 10.

I was shocked by what I found. But I didn't know the "official" answer from Apple until I presented my next door neighbor with the results, and he filed the RARAR bug report.

The answer came back, so now we know the official answer.

In summary, until people show an understanding of the problem set, they should hold off in their attempted ridicule that your unique government identification number is "just a number" and your unique GPS location at any given time is "just a map".

While I get your attempt to ridicule all that you can't comprehend, and I can tell you haven't clicked on a single reference provided in this thread, all I want to ask you, to prove the absurdity of your ignorance, is this:

I will return, to you, in seconds, not only the location of your router, but I will give you the next 400 nearest router AP locations to you.

Then, after that, I can track not only everywhere you take that router, forever, sans any restrictions, but those of your next 400 neighbors.

Take me up on that before you try to ridicule what you don't comprehend.

Q: What is your home router AP BSSID please? A: ?

I'm homeless and don't have a home router, so there's something further for you to laugh at me about.

Hi Jon,

To your credit, you are the first person who has responded, who has shown that he actually *read* the paper before trying to respond intelligently.

That's good. Nobody else even bothered to click on the link, before responding.

Hence, everyone else simply parroted their stone-age knowledge level. You, at least, did *read* the paper, which I congratulate you for doing.

But you did not *understand* what the paper said by the BSSID. See below where you completely whooshed on which BSSID is what matters.

I must be careful here not to fault you like I fault the Apple trolls, because I think you are sincerely trying to understand the problem set.

So I simply caution you, as I did Lawrence & Andy, all of whom I respect for acumen, that you have to follow the trail of the *router* AP BSSID.

You can not "randomize the BSSID" of the router AP (except in the most expensive commercial routers, which are not the topic of this thread).

Think very deeply about that simple fact before responding, as the crux of the problem is no different than a governmment-issued identification number.

You can't easily change your unique government-issued ID number just as you can't easily change the router-issued BSSID of your home router AP.

Think about that the same way the paper presented the mass surveillance. 1. I wrote a Python script that ran on Windows 10 that guessed at a set of random government-issued identification numbers, e.g., 123.45.6789 2. Within minutes, I had a hit on a random government ID, which came back with a GPS location and 400 nearby government IDs and locations. 3. Then, I ran another Python script on Windows 10 that extended that, taking the furthest-away governemtn ID/location pair, and did it again. 4. Within an hour, I had thousands of government IDs and locations. (the researchers gathered billions, as I recall, but I stopped there.)

Now that I have every government-issued ID and GPS location in the world in my 2TB database (which we calculated would be the size it would have been), what is the paper saying about "mass surveillance" possibilities?

HINT: I can track the future location of every one of those billions of government ID/GPS location pairs, without any restrictions on my scripts!

Want to prove that? What's your home router BSSID?

I will not only tell you exactly where that router is located (I even wrote the Python code to give me a dot on an OSM map for your location) but I can trivially easily forever track that router's location forever, without any restrictions on my part (which is the point of the paper, after all).

That's what the paper says. I went further (i.e., to hidden broadcast issues).

But that alone is what the paper says you can do, and I proved it, and I supplied the python scripts (and will supply them to anyone who asks me).

It's not "an attack" so much as explaining, with examples, of why we should care that mass surveillance is so easy with the Apple WPS implementation.

The soldier part is just an example. I have a more potent example.

Give me your MAC address of your home router AP.

Not only can I instantly tell you where that reouter is, but I can tell you the location and BSSID of the nearest 400 routers to your location.

We proved that in the Python scripts I had provided and had run on WIn10. Test me.

Give me your BSSID.

Note: I don't expect you to do it, which alone proves the point.

I think your claim that it's "pretty unusual" for people to take their router with them when they move from one apartment to another is skewed.

If I ask 100 people who recently moved, do you really think it would be only 1 or 2 people who took their home router with them when they moved?

See my first response to you in this post, where I want to be careful to not chastise you for misunderstanding what that paragraph actually says.

You can NOT randomize the MAC address of the router AP, Jon.

Sure, for expensive commercial routers, with thousands of access points, they can randomize their MAC addresses, but it's not on most home routers.

To be clear, it is on some (expensive) home routers. I am well aware of that.

But we're talking about surveilling the masses, not the people who actually know how networking works (which nobody on this thread so far has shown).

First off, I don't have a complaint. That's absurd. I have facts. This entire thread is people disputing those facts, without ever even bothering to read the links which were provided for them to read.

The absurdity of this thread is nobody has read or understood the links which were provided, and yet, they ask me (repeatedly) to explain them.

Why can nobody understand the point that Eric & Dave made in this paper? *Surveilling the Masses with Wi-Fi-Based Positioning Systems*

Why can nobody understand what's different about what Apple documented?

Why can nobody undestqand the concept inherent in a hidden-broadcast?

"The BSSID of the Wifi network. Hidden Wifi networks must not be collected."

Why is it that I feel it's trivial to understand that 1+1=2 when everyone else is trying to claim that I need to explain why 1+2=2 when, if they simply read (and understood) what I've explained, they would understand?

Can *nobody* actually read those references except me, and understand them?

I realize you're trying to understand these concepts so I have to be careful when I point out that this affects every single person in the world who owns a router (and company, but let's restrict this to just people).

The issues are exactly the same no matter what company made that router.

The issue is clearly obvious that the Apple WPS design is flawed.

I have dozens of emails from Apple, all of which show that they *know* that their design is flawed.

They're simply trying to protect themselves legally with me by having their emails redirected to their lawyers, who are whom I was responding with.

They *know* what they're doing is wrong.

No it does not. Did you read any of the Mozilla references? Simply *collecting* the BSSID is the starting point.

The problem exists no matter what the SSID is.

I appreciate that you're the only person in this thread who has ever shown any indication that you actually clicked on the link, so I must be careful to let you know that I understand that you went to that trouble to "try" to understand what the paper actually said.

Remember, I go further than what the paper said, because the paper didn't discuss hidden broadcast implications, but do keep in mind I wrote the scripts so I can track any router AP anywhere in the world myself, just as the paper claimed I could.

With my congratulations to you and with my appreciation that you are the only one who has shown they have read the paper, I must point out that I think you misunderstood which BSSID the paper is talking about.

For most home routers, the owner has no way of changing the AP BSSID.

No. Every mobile device has the on/off ability to NOT autoconnect.

Privacy never was something that everyone could understand, but let's hope the people on this ng have the capacity to understand the complexities.

That's why you set the mobile device to NOT autoconnect after all.

Remember, privacy doesn't mean you don't have to understand networking.

I'm very happy you understand networking at that level, Jon.

This is an extremely well known phenomenon, which has been the topic of discussion in numerous hackers' conferences, where the presenter puts on the projector screen the names and locations of all such requests.

Anyone who doesn't understand what we're conversing about, can't really add value to the conversation, so I'm glad you know it at that level.

All the python scripts I wrote I put into the public domain so you're welcome to ask for any of those scripts, which I posted to these ngs.

Again, I have to first say that I appreciate that you read the paper, and I presume you read the Mozilla documentation I presented, and I presume you also read the Apple documentation which the Apple lawyers wrote after my discussions with them way back in December of last year (public knowledge).

The paper shows that Apple's WPS implementation is highly flawed.

If you've ever tried Google's WPS implementation, you'll see that it's not. Nor is Mozilla's MLS implementation (now deprecated).

This is known public information that I have to assume you already know, as it would take me a while to write the Python scripts to query Google's implementation, which also requires a key which is well known data.

SO, while I do appreciate that you're 'trying' to understand, to have me document what Google has already documented, would be a waste of energy.

It's absurd for anyone to dispute what I say without actually looking up the extremely well known fact that the Google lookup requires not only a key from Google but also it's limited in what it outputs, and also it's limited in how many lookups you can do in a certain time period.

Apple's WPS lookup is not. That's why they wrote that paper, after all... :)

I asked for your home router BSSID to prove a point that you won't give it to me, where if you did, I'd instantly know its location at any given time.

The fact anyone can do that with simply python scripts running on Windows, shows how flawed Apple's WPS implementation is compared to that of Google.

You can't do it with Google's WPS implementation. Nor that of Mozilla location services (now deprecated).

Just Apple's.

Which is why the Apple engineers had the Apple lawyers contacting me. Apple *knows* what they're doing is wrong.

There is no Python code in this thread or in the article you cited on arxiv.org. I have seen no discussion of the Python language. Your first article that started this thread included a Windows batch file. That batch file does invoke "python.exe apple_bssid_locator.py" (something I didn't even notice at first) but that Python script has not been posted here. You did offer to provide a Python script (presumably that one) upon request. That doesn't make this a discussion of Python.

The comp.lang.python newsgroup is for discussion of the Python language. A vague reference to some Python script about which you've said nothing beyond its name does not qualify.

This thread constitutes most of the recent traffic in comp.lang.python.

Please stop.

You haven't supplied it once. If you did, I personally would not be interested in running it, but it might at least be topical in comp.lang.python *if* anyone actually discusses the code.

Yes, I do know all of the above.

Yes, I know that too now, after reading the paper. I downloaded the code at

It does concern me that there is an attack model here which is that a mildly technically-inclined stalker can very easily get the BSSID of their victim and, as you say, find out where they've gone if they move house to get away from them.

We should care because it enables attacks.

As above, I already tried it.

I could quibble with that inasmuch as ISPs tend to provide the APs when you order the connection, so a new connection usually implies a new AP (in the UK, anyway). But I was talking about travelling with an AP, e.g. on business, not moving house.

Yes, I wasn't talking about randomizing the MAC addresses of APs, I was talking about Apple taking steps to mitigate the attacks enabled by their BSSID-lookup API. Apparently adding the "_nomap" exception was one of the things Apple changed.

I agree that they shouldn't be storing BSSID data unless they see an SSID broadcast without "_nomap" on the end (i.e. the SSID is not hidden). And although I've briefly explored various lines of thought, I can't immediately see why they would be reluctant to make that change.

But... it makes very little difference to the actual possible attacks. Almost nobody hides their SSID, and even fewer append "_nomap". Anyone who actually seriously cares about these things would take the trouble to ensure that their BSSID does change if their location changes (even if that means going as far as buying a new AP). The people who are vulnerable are the people who don't know they're vulnerable.

You certainly don't seem to be happy with the status quo, which means that by definition you have a complaint. My point is that for some reason you are being opaque about what change you want to see.

I think that many people understand that 1+1=2, but you are then going on to make some further claim that you are explaining very badly.

Also, the links you are providing do not always back up what you are saying, or it is not clear what conclusion you are expecting people to draw from them. For example, that last quote about "Hidden WIFi networks must be be collected" is simply a policy of the Mozilla Location Service. It isn't any sort of law or agreed standard.

Yes, I think you missed my point, which is that Apple is not generally the provider of the routers, so Apple is not primarily concerned with the privacy of their owners. Apple is primarily concerned with the privacy of its customers, in respect of them being its customers. (i.e. does their use of an Apple product threaten their privacy?)

I think all of the above is likely true, but there is some reason they cannot (quickly) change their API, probably related to the millions of devices out there which either can not or do not receive new software updates.

Sorry, I don't get what you mean. If the broadcast SSID ends with "_nomap" then Apple won't store the BSSID, and won't respond with its location. Are you saying that isn't true? If it is true, then what is "the problem"?

I don't know why you think I misunderstood that.

I think even fewer people are going to be manually connecting their devices to a hidden-SSID WiFi network every time they come into range than have hidden-SSID WiFi networks in the first place.

I read the paper (albeit not in complete detail), and I skimmed the Apple documentation, although I'm not clear on which bit you are saying they added because of you - I assume the "This opt-out doesn’t work for hidden networks" bit?

The paper discusses the difference between Apple and Google's implementation, and I agree that Google's looks better.

Unfortunately you're being your disingenuous self and refusing to respond to genuine questions. I suspect your experiment at your friends' houses never happened. Which is a shame as it would have been interesting.

You already have it. Should be easy to find in your database.

It would be simpler just to ask for my address...

Won't be difficult as it never moves. I suspect the only time it'll move is when I throw it out.

I understand, but that could be a problem to people that are already reading on a "different" group.

Your comments are easier to understand that Arlen (aka Maria) posts. He is not clearly explaining the issues and wants people to read a lot of documentation, instead of just posting an actual summary of the situation with explanations.

Ie, what was Apple doing, why is that bad, what have they changed, is that enough and why, what are the actual dangers to people.

Complete, and short text.

Most people here get a free (rented, not purchased) router with AP from their ISP. When they move house, the old router has to be returned to the ISP (nominally), and they get a new router automatically when contracting a connection at the new location. So they don't have a problem.

Some of those might have a secondary AP of their own.

Only people that buy a router or AP have a problem. And most do not care. I don't. Only those that are using _nomap or perhaps those that hide the SSID.

...

I'm sorry, but no can do: Usenet/NetNews doesn't allow an empty 'Newsgroups:' header.

Ok, well to summarise what I have gathered then, which may or may not be Maria's opinion but reflects my opinion at this point: there are two completely separate issues here, which are unrelated except that they are both to do with WiFi location databases.

1. Apple are storing the location of "hidden" WiFi Access Points. (My opinion: low priority.)

Multiple organisations are gathering and storing the physical co-ordinates of the MAC addresses ("BSSIDs") of WiFi Access Points around the world, whenever they are seen transmitting by, e.g. mobile phones. (Any WiFi-enabled device can see this information; it does not need to be connected to the network in question, nor does it need to know its password.)

The purpose of these databases of BSSID locations is to assist devices such as mobile phones in locating themselves. Maybe the device is indoors and cannot get a GPS signal, but also my understanding is that GPS can fix an accurate location much faster if it starts already knowing vaguely where on the planet it is.

There is broad agreement that these databases should not include BSSIDs which are broadcasting WiFi network names ("SSIDs") which end in the string "_nomap".

Allegedly: Apple are adhering to this exclusion, but are not also excluding BSSIDs which are not broadcasting any SSID at all (i.e. "hidden" networks). Other organisations (e.g. Google) do exclude such "hidden" networks.

My complete speculation: older Apple software, written before they added the "_nomap" exclusion, doesn't care at all about the SSID, so just reports from the phone to the central database the BSSID and location. The database thus has no way of excluding "hidden" networks, without excluding all reports from older devices. The "_nomap" exclusion is achieved by later software versions reporting the SSID if it is seen, and any BSSIDs associated with "_nomap" SSIDs then being blacklisted, maybe for 6 months or something like that. The likelihood of any particular BSSID *only* being seen by old Apple devices and *never* new ones is very low, and hence the "_nomap" exclusion more-or-less works.

My opinion: this failure to exclude "hidden" networks is unfortunate and should be fixed, and maybe Apple are indeed fixing it, but it's possible it may take some years to achieve due to the multitude of devices running old software.

1. Apple's API is trivial to abuse. (My opinion: high priority.)

The Apple API to query their BSSID location database is remarkably unrestricted. It has little or no rate limiting, doesn't ask for an API key, and reports not only the location of the BSSID but also potentially a great many other BSSIDs in the locality. It is not beyond even an individual person's ability to get a list of most of the Access Points in the world and all their locations.

This makes it very easy for people to abuse this data in various ways, from stalkers tracking victims to state actors tracking military targets.

Google's API by contrast essentially reverses the process, and instead of the phone asking "Where is BSSID <x>?", it says "I can see BSSIDs <x>, <y>, and <z>, where am I?".

My opinion: the lack of restrictions on the Apple API is unacceptable, and if Apple are unwilling to do something about it then governments should pass laws (or enforce existing laws) to make them to do so.

My opinion: it would be difficult for Apple to rapidly switch completely to using an API more similar to Google's API, since this would remove functionality from devices running old software. However they could certainly aim to do this eventually, and there are steps they could take immediately to improve the situation (e.g. rate limiting, and not providing so many additional answers when asked about an individual BSSID). I cannot see any obvious reason why they couldn't make significant improvements almost immediately.

Thanks.

Only Apple?

Yes.

Yes. And they can give an approximate location without using the GPS chip.

Right.

And if it is hidden they would not see if the SSID ends in _nomap.

But is there a consensus that hidden SSIDs should not be listed? In writing? Maybe there is such a consensus now.

Right.

Related: What did Arlen (aka Maria) achieve? That Apple agreed to remove all hidden and _nomap entries, or that they removed only his entry?

Aha.

Well, only of the limited subset of people that carry their AP when they move.

Ah. Yes, I can see this is better.

Ok.

Ok, yes.

Thank you for the explanation. Easy to understand, and I agree with your conclusions.

Andy,

You forget that you're talking to Arlen here. He ignores everything that does not further his narrative, and than goes full-out on the crumbs that remain.

What you mention there has been explained to him in the thread here

Regards, Rudy Wieser