Help! How do we get Apple to care about privacy for entities who own access points?
Dec 24, 2025 Last reply: 6 months ago 5 Replies
M
Marian
Help! How do we get Apple to care about privacy for entities who own APs? i. People ii. Companies iii. Governments Basically, everyone in the world is affected by Apple's WPS privacy policy not being respected by Apple and by Apple's highly insecure WPS structure.
Here are the facts as documented by independent researchers:
Apple's WPS implementation has been described as highly insecure. It behaves differently from standard WPS implementations. Researchers have shown that anyone can collect Apple's entire WPS database.
formatting link
Because of those claims, I tested the situation myself:
a. I modified publicly available open-source code and confirmed the researchers' findings.
formatting link
b. I located my own BSSID-despite using the _nomap suffix-in Apple's WPS database.
formatting link
c. Mozilla, for example, says they'll honor the hidden SSID or the _nomap.
formatting link
"Mozilla's client applications do not collect information about WiFi access points whose SSID is hidden or ends with the string '_nomap' (e.g. 'Simpson-family-wifi_nomap')."
But not Apple.
A. Apple has stated in writing to me that they do not intend to respect the opt-out flag even as it is clearly Apple's published privacy policy:
formatting link
"The owner of a Wi-Fi access point can opt it out of Apple's Location Services ¡X which prevents its location from being sent to Apple to include in Apple's crowd-sourced location database ¡X by changing the access point's SSID (name) to end with '_nomap.' For example, 'Access_Point' would be changed to 'Access_Point_nomap.'" B. Google also documents the use of "_nomap" suffix to opt out:
formatting link
"To opt out, change the SSID (name) of your Wi-Fi access point (your wireless network name) so that it ends with '_nomap.' For example, if your SSID is '12345,' you would change it to '12345_nomap.'"
C. What's different is Google's WPS doesn't make the entire database available to everyone (including me!) in the with no oversight!
*Surveilling the Masses with Wi-Fi-Based Positioning Systems*
formatting link
Those points are factual and easily verifiable.
My view is that keeping millions of access points in an insecure, globally accessible database, especially when the owners have opted out following Apple's own privacy policy, is legally, morally & ethically dead wrong.
Apple's recent written response to me only reinforces that privacy concern.
I need help though, from the users, in how to make Apple change the policy to be privacy friendly since this action by Apple (of not respecting users' opt out wishes and making the database available to everyone in the world with no restrictions) is the antithesis of what Apple "says" they stand for.
Any ideas to get Apple to do what they say they do when it comes to supporting consumer, corporate and government privacy?
Didn't find your answer? Ask the community — no account required.
M
Marian
I need to build isolated Wi-Fi environments whose only purpose is to broadcast (or hide) SSIDs by following Apple's own published legally binding privacy rules so we can observe how Apple's WPS system behaves.
I have a friend at Google in the Silicon Valley who is willing to help prove what Apple is doing using a simple test using 3 old spare routers.
How does this look for a checklist to set up those routers for the test?
APPLE WPS / SSID PRIVACY TEST ASCII CONFIGURATION CHECKLIST
GENERAL SETTINGS FOR ALL THREE ROUTERS [ ] Set to "AP" mode (not router, not gateway) [ ] Disable WAN connection [ ] Disable DHCP server [ ] Disable DNSMasq [ ] Disable DHCP-Authoritative [ ] Disable Local DNS [ ] Set Gateway to 192.168.1.1 [ ] Set Local DNS to 192.168.1.1 [ ] WPA2-Personal, AES/CCMP only [ ] Channel width: 20 MHz [ ] Save (not Apply) after each section [ ] Apply once at the end
POST-CONFIGURATION TEST STEPS [ ] Verify all 3 APs appear in a Wi-Fi scan (hidden one as "hidden") [ ] Verify channels 1, 6, 11 are correct [ ] Verify no router is issuing DHCP leases [ ] Verify each AP responds to ping at its static IP [ ] Move APs to a new location [ ] Wait for Apple devices in the area to upload Wi-Fi scans [ ] Query Apple's location database (via any Apple device) [ ] Observe that all three APs appear at the new location [ ] Observe that _nomap did not prevent tracking [ ] Document timestamps and movement history
---------------------------------------------------------------------- When I leave the routers in one location, and then move to the next location, I expect the following based on my prior tests of Apple's WPS.
EXPECTED OUTCOME Apple's WPS will not track: - broadcast.private_nomap But Apple's WPS will forever track: - broadcast.public - hidden.private_nomap
Even though Apple claims: "_nomap prevents inclusion in Apple's crowd-sourced location database."
---------------------------------------------------------------------- How does this look for a checklist to set up the 3 old spare routers to prove how Apple's WPS is poorly designed as per what independent security researchers have explained in the recently cited references?
Each AP will be set up to test proper opt-out directives Apple publishes:
formatting link
"The owner of a Wi-Fi access point can opt it out of Apple's Location Services -- which prevents its location from being sent to Apple to include in Apple's crowd-sourced location database -- by changing the access point's SSID (name) to end with '_nomap.' For example, 'Access_Point' would be changed to 'Access_Point_nomap.'"
Goal: Demonstrate that anyone in the world can see when and where these APs move, even when opted out, and that Apple does not follow its own published privacy policy.
Broadcast / Public (baseline consumer router) Router name: broadcast-public IP: 192.168.1.128 SSID: AppleWPS.broadcast.public Mode: plain AP Test: Broadcast SSID, no _nomap, no DHCP Hardware: WRT54G v5 (Linksys) Firmware: Stock Linksys v1.02.8 Wireless Network Mode: Mixed Channel: 1 - 2.412GHz (20MHz) Security Mode: WPA2 Personal WPA Algorithms: CCMP-128 (AES) WAN Connection Type: Disabled Local IP Address: 192.168.1.128/24 Subnet Mask: 255.255.255.0 Gateway: 192.168.1.1 Local DNS: 192.168.1.1 DHCP Server: Disable DNSMasq: Disable DHCP-Authoritative: Disable Local DNS: Disable Backup: 20251226_192.168.1.128_wpstest_wrt54gv5_broadcast-public.cfg
Broadcast / Private / nomap (public, opted out) Router name: broadcast-private-nomap IP: 192.168.1.129 SSID: AppleWPS.broadcast.private_nomap Mode: plain AP Test: Broadcast SSID, _nomap, no DHCP Hardware: WRT54G v8.1 (Linksys) Firmware: DD-WRT v24 RC-7 (03/19/08) micro Wireless Network Mode: Mixed Channel: 6 - 2.437GHz (20MHz) Security Mode: WPA2 Personal WPA Algorithms: CCMP-128 (AES) WAN Connection Type: Disabled Local IP Address: 192.168.1.129/24 Subnet Mask: 255.255.255.0 Gateway: 192.168.1.1 Local DNS: 192.168.1.1 DHCP Server: Disable DNSMasq: Disable DHCP-Authoritative: Disable Local DNS: Disable Backup: 20251226_192.168.1.129_wpstest_wrt54gv81_broadcast-private-nomap.bin
Hidden / Private / nomap (hidden, opted out) Router name: hidden-private-nomap IP: 192.168.1.130 SSID: AppleWPS.hidden.private_nomap Mode: plain AP Test: Hidden SSID, _nomap, no DHCP Hardware: WNR834B v2 (Netgear) Firmware: DD-WRT v3.0-r51937 mini (03/05/23) Wireless Network Mode: Mixed Channel: 11 - 2.462GHz (20MHz) Security Mode: WPA2 Personal WPA Algorithms: CCMP-128 (AES) WAN Connection Type: Disabled Local IP Address: 192.168.1.130/24 Subnet Mask: 255.255.255.0 Gateway: 192.168.1.1 Local DNS: 192.168.1.1 DHCP Server: Disable DNSMasq: Disable DHCP-Authoritative: Disable Local DNS: Disable Backup: 20251226_192.168.1.130_wpstest_wnr834b2_hidden-private-nomap.bin
I'm moving forward with the setup as the Google employee will only be home later today so I'm setting up all 3 routers as we type.
M
Marian
On this stock Linksys v1.02.8 firmware, there is no DHCP "Disabled" option So, "Automatic Configuration - DHCP" is the default If nothing is plugged into the WAN port, the router simply does nothing It does not broadcast WAN DHCP It does not affect SSID broadcasting It does not affect your Apple WPS / _nomap test It does not interfere with LAN DHCP (which is disabled)
So I only need to change the test setup from: WAN Connection Type: Disabled To: WAN Connection Type: Automatic Configuration - DHCP
And, apparently Linksys also saves a bin file (and not a cfg file).
Broadcast / Public (baseline consumer router) Router name: broadcast-public IP: 192.168.1.128 SSID: AppleWPS.broadcast.public Mode: plain AP Test: Broadcast SSID, no _nomap, no DHCP Hardware: WRT54G v5 (Linksys) Firmware: Stock Linksys v1.02.8 Wireless Network Mode: Mixed Channel: 1 - 2.412GHz (20MHz) Security Mode: WPA2 Personal WPA Algorithms: CCMP-128 (AES) WAN Connection Type: Automatic Configuration - DHCP Local IP Address: 192.168.1.128/24 Subnet Mask: 255.255.255.0 Gateway: 192.168.1.1 Local DNS: 192.168.1.1 DHCP Server: Disable DNSMasq: Disable DHCP-Authoritative: Disable Local DNS: Disable Backup: 20251226_192.168.1.128_wpstest_wrt54gv5_broadcast-public.bin
Now I'll set up the middle router test.
M
Marian
Drat. I found another inconsistency we need to overcome by design.
Router 1 (broadcast-public) was intentionally left in Mixed mode because it is meant to behave like a normal consumer router. Mixed mode reflects typical real-world defaults and ensures Apple's WPS treats it as an ordinary, indexable access point.
But router 2 is set to G-only. This avoids DD-WRT's 802.11n elements (eliminating mixed-mode quirks). And it provides for more predictable beacon frames. Plus, it reduces RF noise by minimizing the RF signature. And, it ensures consistent behavior for the privacy test. This distinction is intentional and part of the experimental design.
Router 3 is a much newer router (relatively speaking), so it's set to mixed mode like router one was set. So, in summary, the mode settings will be: Router 1 (broadcast-public) = Mixed Router 2 (broadcast-private-nomap) = G-Only Router 3 (hidden-private-nomap) = Mixed
This combination is intentional and based on the hardware but the settings also take into account our test goals.
Router 1 stays in Mixed mode It is the "normal consumer router" baseline. Mixed mode matches real-world defaults. Apple WPS should treat it as a standard, indexable AP. This gives you a clean reference point for comparison.
Router 2 is set to G-Only It is a WRT54G v8.1, which is 802.11g hardware anyway. DD-WRT micro behaves more predictably in G-Only mode. Mixed mode on this old hardware can introduce quirks. G-Only produces cleaner, simpler beacon frames. It reduces RF variability and noise. It ensures consistent behavior for the "broadcast + _nomap" test case.
Router 3 stays in Mixed mode It is an 802.11n-capable router (WNR834B v2). Setting it to G-Only would disable 802.11n features entirely. That would distort the hidden SSID test. Apple WPS fingerprints N-capable APs differently. We want Router 3 to behave like a normal hidden SSID AP, not a crippled or downgraded one. Mixed mode preserves the correct beacon structure for this hardware.
Summary: Router 1 = baseline, normal consumer behavior. Router 2 = controlled, simplified G-only for the _nomap broadcast test. Router 3 = normal mixed-mode behavior for the hidden SSID test.
This setup gives us three distinct, meaningful test cases without introducing artificial distortions from forcing the wrong wireless mode on the wrong hardware.
Broadcast / Public (baseline consumer router) Router name: broadcast-public IP: 192.168.1.128 SSID: AppleWPS.broadcast.public Mode: plain AP Test: Broadcast SSID, no _nomap, no DHCP Hardware: WRT54G v5 (Linksys) Firmware: Stock Linksys v1.02.8 Wireless Network Mode: Mixed Channel: 1 - 2.412GHz (20MHz) Security Mode: WPA2 Personal WPA Algorithms: CCMP-128 (AES) WAN Connection Type: Automatic Configuration - DHCP Local IP Address: 192.168.1.128/24 Subnet Mask: 255.255.255.0 Gateway: 192.168.1.1 Local DNS: 192.168.1.1 DHCP Server: Disable DNSMasq: Disable DHCP-Authoritative: Disable Local DNS: Disable Backup: 20251226_192.168.1.128_wpstest_wrt54gv5_broadcast-public.bin
Broadcast / Private / nomap (public, opted out) Router name: broadcast-private-nomap IP: 192.168.1.129 SSID: AppleWPS.broadcast.private_nomap Mode: plain AP Test: Broadcast SSID, _nomap, no DHCP Hardware: WRT54G v8.1 (Linksys) Firmware: DD-WRT v24 RC-7 (03/19/08) micro Wireless Network Mode: G-Only Channel: 6 - 2.437GHz (20MHz) Security Mode: WPA2 Personal WPA Algorithms: CCMP-128 (AES) WAN Connection Type: Disabled Local IP Address: 192.168.1.129/24 Subnet Mask: 255.255.255.0 Gateway: 192.168.1.1 Local DNS: 192.168.1.1 DHCP Server: Disable DNSMasq: Disable DHCP-Authoritative: Disable Local DNS: Disable Backup:
Hidden / Private / nomap (hidden, opted out) Router name: hidden-private-nomap IP: 192.168.1.130 SSID: AppleWPS.hidden.private_nomap Mode: plain AP Test: Hidden SSID, _nomap, no DHCP Hardware: WNR834B v2 (Netgear) Firmware: DD-WRT v3.0-r51937 mini (03/05/23) Wireless Network Mode: Mixed Channel: 11 - 2.462GHz (20MHz) Security Mode: WPA2 Personal WPA Algorithms: CCMP-128 (AES) WAN Connection Type: Disabled Local IP Address: 192.168.1.130/24 Subnet Mask: 255.255.255.0 Gateway: 192.168.1.1 Local DNS: 192.168.1.1 DHCP Server: Disable DNSMasq: Disable DHCP-Authoritative: Disable Local DNS: Disable Backup: 20251226_192.168.1.130_wpstest_wnr834b2_hidden-private-nomap.bin
M
Marian
Proposed (WIP) APPLE WPS TEST PLAN
----------------------------------
GOAL: Determine how Apple's WPS database treats: 1. A normal broadcast SSID (Router 1) 2. A broadcast SSID with _nomap (Router 2) 3. A hidden SSID with _nomap (Router 3)
Specifically: Does Apple index them? How long does it take Apple to index them? Does Apple retain them after relocation? Does Apple treat _nomap consistently?
TEST LOCATIONS: Location A = Friend's house in Palo Alto Location B = A second test site in Cupertino
TEST SEQUENCE OVERVIEW: Phase 1: Deploy all routers at Location A Phase 2: Leave them running for a fixed time window Phase 3: Query Apple WPS database daily Phase 4: Move all routers to Location B Phase 5: Leave them running again Phase 6: Query Apple WPS database daily Phase 7: Compare entries from both locations
----------------------------------------------- PHASE 1: DEPLOY AT LOCATION A
-----------------------------------------------
Power on all three routers.
Verify: AP 1 visible as broadcast-public AP 2 visible as broadcast-private_nomap AP 3 hidden (SSID not broadcast)
Confirm all three respond to ping: 192.168.1.128 192.168.1.129 192.168.1.130
Record the exact start time.
----------------------------------------------- PHASE 2: WAITING PERIOD AT LOCATION A
-----------------------------------------------
Leave routers running for (I don't know how long yet) days. Recommended minimum: 3 days Ideal: 5 to 7 days
I will not reboot or reconfigure routers.
I will not move them or change orientation.
----------------------------------------------- PHASE 3: DAILY APPLE WPS QUERIES (LOCATION A)
----------------------------------------------- Each day, record: A. Does AP 1 appear in WPS? B. Does AP 2 appear in WPS? C. Does AP 3 appear in WPS? D. What coordinates does Apple report? E. What confidence or accuracy radius? F. Does Apple drop any entries?
----------------------------------------------- PHASE 4: MOVE TO LOCATION B
-----------------------------------------------
Power off all three routers.
Transport them to Location B.
Power them on in the same order: Router 1 first Router 2 second Router 3 third
Verify: AP 1 visible AP 2 visible AP 3 hidden
Confirm channels again: 1 / 6 / 11
Record the exact relocation time.
----------------------------------------------- PHASE 5: WAITING PERIOD AT LOCATION B
-----------------------------------------------
Leave routers running for ? days. Recommended minimum: 3 days Ideal: 5 to 7 days
I will not reboot or reconfigure routers.
----------------------------------------------- PHASE 6: DAILY APPLE WPS QUERIES (LOCATION B)
----------------------------------------------- Each day, record: A. Does Apple create new entries? B. Does Apple update the old entries? C. Does Apple merge Location A and B? D. Does Apple drop Location A? E. Does Apple treat _nomap differently? F. Does Apple treat hidden SSID differently?
----------------------------------------------- PHASE 7: FINAL ANALYSIS
----------------------------------------------- Compare: 1. Router 1 behavior across both locations 2. Router 2 behavior across both locations 3. Router 3 behavior across both locations 4. Whether _nomap suppressed indexing 5. Whether hidden SSID suppressed indexing 6. Whether Apple retained stale coordinates 7. Whether Apple merged or split entries 8. Whether Apple respected relocation timing
EXPECTED OUTCOMES (HYPOTHESES): Router 1: Should appear at both locations. Should update location after relocation.
Router 2: May appear at Location A. May or may not update at Location B. Apple may treat _nomap inconsistently.
Router 3: May not appear at all. If it appears, it may be unstable or delayed. Hidden SSID behavior is the key unknown.
DATA TO RECORD: Date Time Router ID SSID (if visible) Apple WPS coordinates Accuracy radius Confidence Whether entry is new or updated Notes
END OF (proposed, WIP) TEST PLAN
Join the Discussion
Have something to add? Share your thoughts — no account required.
Didn't find your answer?
Ask the community — no account required
Report Content
You are reporting this content to the moderators. They will look at it
ASAP.