Re: How to test if your access point BSSID is in the highly insecure Apple WPS database

Dec 28, 2025 Last reply: 9 months ago 2 Replies
Jump to replies (2)
M


> If you have a free unused/old router or access point, you could set it


>> up with a hidden _nomap SSID, and without connecting any of your phones
>> to it, wait to see if the BSSID appears listed after a month or two. It
>> would be interesting to check every day with a script, to see how fast
>> they update.
>
> Ask some friends who use iPhones to come round for a coffee, the more
> devices hoovering up data the better? They may only add BSSIDs to the
> DB if they've seen them via multiple devices.

Hi Andy,



I respect you so I am explaining that I'm taking your suggestion to heart. Yet we don't need any Apple devices to run this test, it's that easy to do.



Jan 1st I'm putting 3 old routers (which you may recognize) in Palo Alto.

formatting link



  1. Normal SSID 2. _nomap SSID 3. _nomap SSID + hidden broadcast frames

I have a friend in Palo Alto who is willing to host these three routers for about a month, starting on January 1st, 2026. Then we will move the three routers to Cupertino on February 1st to simulate moving to a new flat. From: Marian snipped-for-privacy@helpfulpeople.com Newsgroups: alt.comp.os.windows-10,comp.mobile.android,alt.internet.wireless Subject: Help! How do we get Apple to care about privacy for entities who own access points? Date: Tue, 23 Dec 2025 23:42:17 -0700 Organization: BWH Usenet Archive

formatting link
Message-ID: <10ig209$29kr$ snipped-for-privacy@nnrp.usenet.blueworldhosting.com>



I already know EXACTLY what will happen, but this is simply the test results that I will show to Apple when the time comes to show it to them.



Given virtually every router in the world has the HIDDEN broadcast frame feature, we can assume hundreds of millions of people use that feature.



Apple does not intend to honor their own published privacy policy, so the routers with that feature will be included in the public Apple WPS database, which is expressly against the wishes of the people who do that.



What Apple "is doing" is the antithesis of what Apple "says" they will do.



To me, that's morally, ethically & legally reprehensible for Apple to do that, and Apple can't say they're unaware because I know they're aware.


It used to be Apple only told the truth in court, but with Judge Gonzalez' case with Apple execs, it may be Apple doen't even tell the truth in court.
Vote
Twitter Facebook LinkedIn
T

And STILL assuming that a moving router ALWAYS indicates the person moved. MUCH more likely that the router was sold/given away.

Not to mention that since their are "public records where everyone who owns a home lives" then what is this router adding anyway? If you know where I live, why does the router even matter?

The answer to that is obvious. It only matters because Arlen thinks it makes Apple "look bad".

Which is Arlen's lifelong quest.

Vote
Twitter Facebook LinkedIn
M

What Apple does is what "makes Apple look bad", not me.

What's important is that Apple's WPS database implementation is insecure. That's not opinion. That's fact which was described in the research.

Google's WPS database access is nothing like Apple's WPS database access. Anyone in the world can access Apple's entire WPS db without restriction.

All I did was reproduce what the researchers said was easily possible. And it was.

What the researchers didn't note, and which I learned, and I'm likely only one out of millions who knows this, was not only does Apple not respect their own published privacy policy on opting out, but they have no intention of respecting their published privacy opt-out policy.

This is not opinion. This is fact.

Only one out of millions of people know what I just said above. We know it because we're extremely intelligent and well informed.

Bear in mind if Google or Mozilla did what Apple did, I would be on their case too, because what Apple is doing is the antithesis of what Apple "says" it does.

It's legally, morally & ethically reprehensible what Apple is doing. If Google or Mozilla did what Apple does, I'd say the same of them.

But they didn't. Only Apple does this.

I'm here to help others understand the deeper mechanics of WPS that most people never comprehend (& that Apple marketing never explains).
Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required