OT? Can my neiighbor, whose wifi I'm using, see what I'm doing?

I'm surprised nobody but me mentioned the solution to the OP's problem set.

Only the router owner can disable SSID broadcast to make it invisible to all devices. However, what the OP can do is put an "X" on the SSID icon by blocking connections.

You can't hide your neighbors' AP SSID from showing up, but you can block the chance of accidental connection by running the "block" netsh command. netsh wlan add filter permission=block ssid="NeighborSSID" networktype=infrastructure

I'm surprised I'm the only one on this newsgroup who seems to be aware of this feature since it's the best solution possible to the OP's problem set. @echo off netsh wlan show filters echo Blocking unwanted Wi-Fi networks... REM Replace these with the SSIDs you want to hide netsh wlan add filter permission=block ssid="NeighborSSID1" networktype=infrastructure netsh wlan add filter permission=block ssid="NeighborSSID2" networktype=infrastructure netsh wlan add filter permission=block ssid="NeighborSSID3" networktype=infrastructure echo Done! The specified SSIDs are now blocked. netsh wlan show filters pause

I wish there was a way to hide from view your neighbors' AP's altogether.

What I do, for privacy (not for security), is I hide the broadcast of my home SSIDs. That way, they're not uploaded to public servers by every mobile device passing by.

In addition, by hiding my SSID broadcast, my neighbors won't passively see them.

REFERENCES:

I agree with both Carlos & Frank since I agree with anyone, no matter who they are, if they post a reasonably sensibly logically stated view.

However... I just looked up US case law on this topic for the first time, and while case law may well differ in Frank's & Carlos' location across the pond, I'm assuming the OP is in the United States whose law I looked up.

Below is a copied-and-pasted response from the references...

In the United States, using a neighbor's open Wi-Fi without permission is generally considered unauthorized access under federal and state law. Even if the network is unsecured, courts have treated this as potentially illegal. Case law and statutes (like the Computer Fraud and Abuse Act) support that "piggybacking" on someone else's Wi-Fi can be prosecuted, though enforcement is rare unless other crimes are involved.

Federal Law - Computer Fraud and Abuse Act (CFAA): The CFAA (18 U.S.C. Sec.

Many states have their own computer crime statutes that prohibit unauthorized access to networks. For example, Florida and Michigan have prosecuted individuals for unauthorized Wi-Fi use under state computer crime laws.

Michigan (2007 - Compuware Building case): A man was arrested for repeatedly using an open cafe Wi-Fi from his car. He was charged under Michigan's "Fraudulent Access to Computers, Computer Systems, and Computer Networks" law. The network had no password or permission screen, but prosecutors argued that "authorization" still requires the owner's consent.

Florida (2005 - Lakeland case): A man was fined for accessing a private home's open Wi-Fi without permission. He was prosecuted under Florida's computer crime statute. Again, the network was unsecured - no password or login screen - but the court treated it as unauthorized use.

Illinois (2006 - Aurora case): A man was charged with "unauthorized use of a computer network" for connecting to a resident's open Wi-Fi. The SSID was broadcast and unprotected, but the court found that lack of technical barriers did not equal consent.

In California, using a neighbor's open Wi-Fi without permission is illegal under California Penal Code Sec. 502 (Unauthorized Computer Access and Fraud). Even if the network is unsecured and has no permission screen, courts treat this as "unauthorized access." Convictions can carry fines and up to three years in prison.

California Penal Code Sec. 502 PC: Makes it a crime to "knowingly access and without permission use, alter, or damage any computer, computer system, or computer network." This statute explicitly covers Wi-Fi networks. Courts in California have clarified that the absence of a password or permission screen does not imply authorization. Unauthorized use of an open Wi-Fi is still considered "stealing" internet service.

People v. Hawkins (California, 2009): A man was charged under Penal Code Sec. 502 for accessing a neighbor's open Wi-Fi without permission. The court held that "open" does not equal "public," and unauthorized use still counts as unlawful access.

San Jose Police Reports (2005-2007): Several arrests were made for individuals "piggybacking" on open residential Wi-Fi. These were prosecuted under Sec. 502 PC, even though the networks had no passwords or permission screens.

If you own the router, then the best way to prevent this (and gain some privacy from mobile device uploads to public databases at the same time) is simply to hide AP broadcasts.

If you're the next-door neighbor, the best way on Windows to prevent connections to the neighbors' open access points is to "block them.

@echo off netsh wlan show filters echo Blocking unwanted Wi-Fi networks... REM Replace these with the SSIDs you want to hide netsh wlan add filter permission=block ssid="NeighborSSID1" networktype=infrastructure netsh wlan add filter permission=block ssid="NeighborSSID2" networktype=infrastructure netsh wlan add filter permission=block ssid="NeighborSSID3" networktype=infrastructure echo Done! The specified SSIDs are now blocked. netsh wlan show filters pause

REFERENCES:

To add further technical value to this sub topic...

For those wishing to know more about this topic, most people have their router Wi-Fi AP set to broadcast the SSID, which means it's uploaded to world-wide publicly accessible databases whether they like it or not. a. The (unique) GPS location (of the phone uploading it) is uploaded b. The signal strength (of the signal to the phone) is uploaded c. The (unique) BSSID (MAC address) is uploaded - which is essentially you d. The (normally non-unique) SSID is uploaded (with or without _nomap)

Every mobile device owned by ignorant/rude people is uploading that privacy to the world-wide publicly accessible databases (which have been abused).

That means my mobile devices don't ever upload your privacy. But your mobile device almost certainly tries to upload mine.

What I do to prevent the upload is I set my SSID to not broadcast. a. This prevents a passive upload by rude/ignorant people. I also opt out by adding _optout_ & _nomap to the SSID. b. This (supposedly) removes my privacy information from the servers In addition, I set the mobile device to not connect automatically. c. This stops the mobile device from shouting out "are you there?"

In addition, due to the ubiquitous existence of WPA2 SSID-salted rainbow hash tables (& reusable butterfly WPA2-handshake hashcat tables), I use a (hopefully) unique SSID (since it's the WPA2 encryption salt) in addition to a (hopefully) non-dictionary passphrase (both of which are required to stay out of those pre-computed and re-used cryptographic hash tables). 1. Rainbow tables: Precomputed WPA2 hash databases based on SSID 2. Butterfly hash tables: Optimization structures used in WPA2 cracking

Furthermore, iOS mobile devices can be set to randomize the MAC per SSID, while Android mobile devices can be set to randomize the MAC per instance.

If you own a new'ish router, you can upgrade to WPA3, which replaces WPA2's vulnerable handshake with SAE (so it's resistant to dictionary attacks).

Of course, you should always disable Wi-Fi Protected Setup (WPS). Duh. And, keep your firmware updated (duh), & isolate the guest network (duh). Disable remote adminstration to your router (duh) & use HTTPS for login.

You "can" restrict connections by MAC, but if you're randomizing the MAC address, it's going to be impossible (as is static IP addresses set at the router level - they now have to be set at the mobile device level instead).

Also enable and check the router log (duh) for intrusions, but if you've ever done that, you'll know already you're being attacked constantly.

Disable UPnP (duh), and firewall inbound traffic (duh) and enable DNS encryption (DoH/DoT), which seems easy, but I've found it to be a PITA. A. DoH (DNS over HTTPS) wraps DNS queries inside HTTPS traffic B. DoT (DNS over TLS) sends DNS queries over a TLS-encrypted channel You enable iOS 14 & up DoH using Settings > Wi-Fi > DNS & you enable Android 9+ DoT with Settings > Network & Internet > Advanced > Private DNS.

You enable DoH on Windows in Settings > Network & Internet > Change adapter options > DNS settings where Windows 11 is still DoH but the GUI is better.

On Android devices, you can add a system-wide firewall such as NetGuard. It can block Wi-Fi/CellularData access per app. Not available on iOS.

I don't have much experience with RethinkDNS, but it's a FOSS Android app that combines encrypted DNS (DoH/DoT/DNSCrypt) with a system-wide firewall. i. RethinkDNS = firewall + encrypted DNS (DoH/DoT/DNSCrypt) + blocklists ii. NetGuard = firewall + per-app blocking + ad/tracker blocklists

You'll never have any privacy/security on iOS, which sucks at both (and anyone thinking it doesn't suck, clearly doesn't know anything about iOS).

While we're at it, it's probably a good idea to put smart TVs, cameras, and IoT gadgets on a separate VLAN or guest SSID, and it goes without saying further that you should change the rude/ignorant default iOS/Android setup.

What did I miss?

But how do you know it is not authorized?

By default, a phone will connect to an open WiFi without asking. At least, it was so several years ago, I don't know currently because the configuration is cloned from one phone to the next.

And Windows I think does the same, which is, I understand, what happened to the OP.

I take that "looking" inside the network is not legal. But using a WiFi that is open? I know some people that intentionally left their WiFi open to any one that wanted. That was the view.

But then, USA people are quite paranoid about private property, and can shoot an intruder without asking.

(several examples trimmed)

Here, some people were taken to court for "illegally downloading movies". In their defence, they said that it was not them, but somebody else using their WiFi, and the reverse could not be proven. They kept their WiFi open. They won. :-D

In regard to the original subject ("Can my neiighbor, whose wifi I'm using, see what I'm doing?"), I can't speak to what your particular neighbor could or is doing, but from a theoretical standpoint, the answer is Yes: some routers have the ability to do selective packet tracing, allowing forwarding to somewhere else a copy of all packets to and/or from a particular host, and they can then be recorded.

The packet headers (containing the IP addresses of the hosts you connect to) will certainly be readable.

If the data portion is encrypted, then, to first order, it won't be readable (which is why https, TLS, and other encryption is generally encouraged).

If you're using a VPN, and if your DNS queries use the VPN, so that the only connections your host makes are to the VPN, the IP addresses in the packet headers will only be that of the VPN, not the hosts you're ultimately connecting to, making those IP addresses less informative.

It'll be interesting to see if/how that means Amazon Sidewalk design and devices constitute widespread unauthorized access.

Sidewalk devices use Ring doorbell and Amazon Echo devices as routers and are allowed to use up to 500MB worth of data from each such router. The owners of these devices are not allowed to see who their devices connect to (either direction). Furthermore, Sidewalk device connections are enabled and allowed by default ("opt out", not "opt in"), so this will, in many cases, happen without the Ring/Echo owner's knowledge, understanding, or explicit consent.

-WBE

Hi Winston, I was unaware of this. I'm on Amazon Vine so I get all sorts of cameras for free but I noticed all of the cameras on Vine went to the Internet instead of ONLY to your router or only to the sd card on the camera itself.

While I'm using them, I put them in places that don't show me personally (e.g., I put them in the driveway instead of pointing at the house), but it always dismayed me that the signal for these inexpensive cameras went to the Internet BEFORE it went back to your router and then to your phone.

But I was completely unaware that "some" of these brands allow others to share up to 500 MB/month of its internet connection with nearby Sidewalk-enabled devices.

Looking it up, you're 100% correct. Sidewalk is enabled by default on compatible devices. Owners must manually opt out in settings. Worse, device owners cannot see which devices are connecting through their Sidewalk bridge, nor the traffic details.

With Sidewalk, Amazon has pre-authorized this access by design, and the device owner agreed to Amazon's terms of service when setting up the device.

The catch is many users may not realize they consented, since it's opt-out.

I think the situation is similar to the Wi-Fi router access point unique BSSID & GPS location of your home uploading which is also opt out.

People can't opt out until/unless they know that they can opt out.

Luckily, for Wi-Fi access points, opting out is as easy as not broadcasting your SSID (which prevents casual upload to the public datbases) or adding "_nomap" to the end of the SSID (which doesn't prevent upload but well-behaved database owners "say" they'll scrub those from the database).

I'm still unsure of the status of the Microsoft _optout_ mechanism though.

Well, it is the only way to do it (commercially), meaning watching the camera while not at home.

You could use safe cameras that do not connect to internet on their own, but instead need a local server inside the same LAN. And to connect from outside you would have to create a setup that includes either an external server, or a dyndns address pointing to your home.

Possibly these cameras are more expensive. They do exist, it is what any entity in Europe would have to create for security cameras within the privacy laws. I don't know how to find them on Amazon, what search text. Maybe USB cameras.

And by the way, it would be possibly to do this commercially if IPv6 is deployed, without using their external server.

Only to the SD card might be possible if you do not hire their external storage and disable mobile phone use. But many cameras do their initial configuration via an Android App. If there is registration, bad.

...