Are we all handing to Google the SSID of our home routers?

Using a common SSID is risky, in that it makes the well-known time-space tradeoffs for WPA-PSK passphrase cracking worthwhile.

But how strong is ?as needed?? (Assuming a unique SSID...)

WPA derives PMK from PSK using PBKDF2 with 4096 rounds of HMAC-SHA1. HMAC invokes the hash function twice, and the input each time is 2 blocks. 256 bits of output are required so there?ll be 2 output blocks.

That gives 4096*2*2*2=32768 invocations of the SHA1 compression function (plus a trivial amount more for the PTK derivation and MIC calculation).

If you can estimate your adversary?s equipment budget (and power/cooling budget!) and how long they?re willing to spend attacking your network, you now have enough information to work out a lower bound on passphrase complexity.

Check my workings before relying on any of this!

Welcome to two factor authentication. Actually, Google calls it a "recovery phone" number. Allegedly, they will contact you on the stored phone number if they detect "unusual activity". I use email for password recovery, not SMS.

You're correct that it's a plot for Google to collect your cell phone number. My Google account was created before 2009 when Google implemented this nonsense, so Google does NOT have my cell phone number and does NOT ask for two factor authentication. This might help: What I did when Google demanded my cell phone number was to give it to them, do their authentication dance, and then remove the phone number from my account using the dashboard or account details. Click the pencil icon under "Add recovery phone".

Google only had my cell phone number for about 5 minutes, but that was enough for me to get about 10 SMS spam messages and 2 voice spam messages. Google claimed that was impossible, but I think otherwise. The spam died down after about 2 weeks.

However, your situation is probably a special case. Changing the Google account name so many times on a single Android device probably triggered some security alarms at Google. I would certainly call that "unusual activity". I don't know what might happen, but Google is probably interested in determining your identity and possibly contacting you.

Only if they know my location. They know it *approximately* from the phone being on but that's all they *have* to know.

This depends entirely on your particular threat model. I you live in an area where the houses are 400 ft apart then "Do not crack this pass-phrase." might be enough as you would spot someone parked in your driveway while trying to log in.

If you store data that is worth much to anyone who can get it then something like "`

Sorry. I wasn't specific enough. Google knows the location of your wireless router by SSID and MAC addresses. They might also be sniffing for smartphones, client radios, range extenders, repeaters, WISPs, laptops, tablets, PDAs, game machines, wireless media players, RC controlled airplanes, drones, or anything that might benefit from an overdose of advertising. However, these are uncertain and part of a different discussion. We're currently discussing a home wireless router.

Jeff, I (almost) debate that sentence.

I think we *can* log out of almost all of the Google accounts. I know I have tried (see details below).

Any advice for what I've missed would be excellent!

Here are all the Google Apps that I can think of on my phone:

1. Google Play Store* Hamburger > {Settings, My account} There does not seem to be any way to sign OUT of Google Play!
   formatting link
2. Google Search HardMenu > Settings > Privacy & accounts > Google Account = I seem to be signed out permanently.
   formatting link
3. Google Maps HardMenu > Settings > Sign in I seem to be signed out permanently.
   formatting link
4. Google Gmail Hamburger > Sign in I seem to be signed out permanently.
   formatting link
5. Google YouTube Hamburger > Sign in I seem to be signed out permanently.
   formatting link
6. Google Chrome HardMenu > Settings I seem to be signed out permanently.
   formatting link
7. Google Hangouts* Automatically logs you in when you start the app! Signing out kills the app! HardMenu > Settings > Sign out
   formatting link
8. Google My Tracks HardMenu > Settings Does not seem to have any log in capability
   formatting link

Every single one of those, I have long ago expressly logged OUT of and I have never logged back in, and my phone seems to work just fine.

• The only ones I can't seem to log out of are Google Play, and Hangouts, although I don't have to actually *use* either one of those in day to day activities.

Not on this planet. We have locally administered MAC addresses" in addition to the usual counterfeit and bogus MAC addresses.

I am very experienced in avoiding giving Google any phone number or ancillary email.

It has been getting harder than ever in the past year.

I use VPN and Google really hates when you come in from multiple IP addresses. I also change my user agent string a lot (it's random, to avoid fingerprinting).

So, at this point, in the last few months, it has been almost impossible to start a Gmail account without giving them a phone number. Sigh.

That's fine. 99.99% of the people out there don't even *know* what you know, for example.

But, for those who both know and care, then we (those people) can work together.

Besides, I'm just asking as a thought experiment, would it work?

Would it work if we all did these three things?

1. Set our SSID to the same ssid (e.g., DEFAULT_nomap).
2. Set our MAC to the same MAC (e.g., DE:AD:BE:EF:CA:FE).
3. Set a very strong passphrase ('cuz we'd need it!).

Would that work?

AFAIK, it would only work for Google who "says" they'll honor it.

See: Google Announces ?_nomap? WiFi Opt-out Option, Wants Other Location Providers To Go Along

I think you're wrong, Mike. It's rare that I know more than you do, but, at the level of the router, which is behind the cable or dsl modem or wisp tranceiver, it wouldn't matter at all, I think, if we all had the same DE:AD:BE:EF:CA:FE MAC address.

Am I right?

(Someone here must know the answer to that question.)

I guess whether the modem is set up as a "bridge" or "router" might matter. Jeff might know more about that.

I fully understood that the salt for wpa2 encryption is the ssid, which is why our passphrases would have to be as strong as we can make them.

It would have to NOT be in the rainbow tables at the very least. I see what you're saying is that it exposes us to brute-force attacks.

Except that your MAC gives you away.

So it is writ by Alice J. , so mote it be.

You should look at this tool supplied by EFF (THE ELECTRONIC FRONTIER FOUNDATION).

Mike "don't know if anyone takes it to this level" Yetto

Jeff, Wouldn't DE:AD:BE:EF:CA:FE work on almost all routers?

The router is behind the modem (or transceiver in the case of WISP).

I guess it depends on whether the modem (or transceiver) is set up as a bridge or router, but, wouldn't it work in most cases?

DRAT.

Can you further clarify WHICH mac address Google is getting?

I know a typical SOHO router has a bunch of mac addresses, one for each NIC. MAC0 = WAN Ethernet port

:)

I've been battling my browser fingerpints for a few years now.

That's why I'm happy to see the very latest tor browser bundle finally bundled the fonts inside the browser.

My browser comes up unique because of the darn fonts and the darn oddball screen size. Drives me crazy.

So I have to futz with other things that are otherwise fine, just to be *differently* unique each time.

Drives me crazy.

Nevermind.

I saw your post that said Google gets the LAN SSID/MAC and not the WAN MAC, which is what "cloning" changes.

Sigh.

I think Jeff explained that the MAC address that we can clone is not the same MAC address that google saves.

We clone the WAN MAC address, which is always behind a modem or transceiver so everyone could have the same WAN MAC address I think.

But, Jeff explained that Google doesn't save your WAN MAC address. Google saves the LAN MAC address.

That LAN MAC address can't be cloned, and, it's an important part of keeping the neighbors out of your WiFi, so, it wouldn't work if everyone had the same LAN MAC address.

Sigh.