What are the privacy implications of 802.11az Wi-Fi Ranging?

Yes new to me too, do any phones support it yet? I see 802.11az gets a mention in some of the recent Qualcomm vulnerabilities.

The 5G chipsets we get over here don't support mmWave frequencies, just sub-6GHz, and therefore no mmWave aerial, so probably USA devices with mmWave will be able to share a mmWave aerial between 5G and WiFi aerials to support 802.11az?

This may be a silly question but why would a phone be sending anything to APs that it doesn't know and therefore cannot use?

Similar to the privacy implication of Satellite GPS (Garmin and others), and the current cellphone with the tracking app that allows you to locate the exact position of another phone, and similar systems.

knuttle wrote on Mon, 11 Nov 2024 17:27:36 -0500 :

Remember when Microsoft "_optout_" & Google/Mozilla "_nomap" came out? We had to recover from them scooping up our BSSIDs for public databases.

Billions of people opt-in out of ignorance. We don't want to be like those morons.

We are knowledgeable in computers & routers & phones unlike the hoi polloi. So we're private. They're not.

The reason is we understood the implications of Wi-Fi AP public databases. Therefore, by virtue of our excellent technical knowledge we're not in them.

Only the unwashed ignorant ill-educated masses are in the public AP databases. But not us.

When Google vacuumed up the unique BSSID/GPS location of the hoi polloi... Google did NOT get our home router access point in that database.

Because we're not stupid. We learned the privacy implications and we put countermeasures in place.

Only the ignorant are in Google's public Wi-Fi access point database. Apple's too. Mozilla too. And Microsoft. Who knows how many others (WiGle).

But we intelligentsia are NOT in those public privacy-invading databases. Why not?

Because we put measures in place to prevent being uploaded to them. That's why.

Same situation here. We will need to better understand 802.11az in order to protect our privacy.

Much like we must hide our home router broadcast packets for privacy, there may very well be something we need to do for privacy against Wi-Fi Ranging.

Because of bluetooth trackers in department stores, I habitually turn off my bluetooth, near field & location radios as I get out of the parked car.

In that case, the privacy implication is nearly zero. All you have to do is turn off your bluetooth radio to remain private.

Right?

Actually, I put the phone on airplane mode, but that's the same thing with respect to bluetooth radios - which why I ask about 802.11az Wi-Fi Ranging.

Q: What should we do on our phones & routers to avoid 802.11az tracking? A: ?

Roger wrote on Mon, 11 Nov 2024 22:17:24 +0000 :

Good question.

I do not know the answer to that specific question, which is a valid question, but I can't answer it directly - but - I can respond with the knowledge that most people's phones *do* send access point data to the unique-access-point-BSSID/GPS and very public databases - that the phone itself, "doesn't know and therefore cannot use".

Mine doesn't do that because I'm not stupid. But most people are stupid.

Their phones dutifully hoover up every access point in range & sends the AP unique BSSID & unique GPS location to Google's public online databases.

These phones "don't know the AP and therefore can't use them". But Google can.

Which is why intelligent people protect their access point from hoovering. And polite people set up their phone to *not* hoover that AP information.

But it takes care & knowledge to know what to do in order not to be rude to every person whose house you drive by that is openly broadcasting an SSID.

That technical knowledge is what this question is trying to discover.

Q: What do we need to do to protect ourselves from 802.11az Wi-Fi Ranging? A: ?

Introduction: Which is the best indoor positioning technology for mobile apps?

Indoor positioning technology for smartphones is developing rapidly, driven by the demand for indoor mapping, indoor tracking, and real-time location analytics. So we regularly publish tech updates to help you keep up to speed with the latest changes. For each technology, the costs need to be balanced against the delivered accuracy. For all the talk about sub-meter accuracy, it's seldom required. For indoor navigation systems, an accuracy of a few meters is needed. There are lots of exciting technologies on the horizon. But for 2021 we recommend sticking with a Bluetooth beacon infrastructure, combined with inertial data. This technology provides mobile apps with a location accuracy of 2 to 5m. It's quick and cheap to install and configure.

The great promise of Wi-Fi positioning is that it leverages existing infrastructure. However, iOS doesn't give access to WiFi signal strengths. So positioning has to take place on the infrastructure, not the phone. And this means there's no access to inertial information. This greatly limits the accuracy that WiFi signal strength positioning can achieve. If

Currently the best balance between cost and performance. Installation is needed. But the beacons are low-cost and battery-powered,with battery life measured in months or even years. So both installation and ongoing maintenance are minimal. Bluetooth beacons alone don't provide great accuracy. But when combined with inertial data, the accuracy is good enough for almost every use case.

Specialist technologies like Angle of Arrival Bluetooth, UWB or ultrasound may achieve 1m accuracy. This is impossible using Bluetooth or WiFi. But it comes at a cost. The hardware makes deployment much more expensive and more complex. And it's not yet supported on enough phones.

Much more accurate indoor positioning can be achieved if the distance between anchors and mobile devices is measured with precision. Technology options are increasing, and are starting to become available on smartphones. For instance, WiFi RTT times the signal rather than using signal strength,and is capable of sub-meter accuracy. It's available now on Android phones.

The phone tracking app doesn't allow you to track my phone unless I permit you to ...

To rephrase the above, any device that emits a signal can be tracked and located with the proper equipment.

This has been going on since the first electromagnetic signals were sent into the air.

The only what that you can avoid tracking to find your location, is to turn off, or get rid of all devices that emit a signal, cell phone, pace makers, etc.

knuttle wrote on Tue, 12 Nov 2024 07:26:25 -0500 :

We have successfully eliminated being tracked in the Wi-Fi AP databases, so why can't we just as successfully avoid 802.11az Wi-Fi Ranging tracking?

You need to keep the question in perspective since we're NOT talking about being tracked when you're out in the open, sleeping, driving, or hiking.

We're talking about being tracked to the half-meter level *indoors*. Specifically inside of business establishments (who have a motive).

All the morons on earth exclaim "We're doomed to be tracked" simply because a cell phone, by its very nature, gives out emissions which can be tracked.

We are not those morons. We are intelligent. We understand technology.

Which is why this question was being asked *specifically* to better understand the privacy implications of the specific 802.11az Wi-Fi Ranging.

This is *new* technology - never before seen in cellphones.

We are not morons. We're intelligent people.

I'm not sure yet what the privacy implications are of this new technology. But I am sure that giving up and surrendering to it is not my intent.

Yours shouldn't be either. We're not slaves. Slaves give up and accept everything done to them.

We are not slaves to technology. We control it. Not the other way around.

This question is the first step in controlling this new technology, particularly when used by businesses for half-meter tracking of us.

There are two location directions.

The police could use tower triangulation, to determine your lat:long.

The cellphone, for whatever reason, could develop a local coordinate (via GPS or GPS+creepy_method), which is now, say, showing on your screen.

Those are the two measurements. Remote measurement, or local measurement.

Then you have sharing/leaking of the determination, to another party, with or without your permission. And that is part of what complicates the matter. Maybe the tower will send you your lat:long, if you ask nicely. I don't know if this is a practice, or not.

As a general security principle, you should not gather and store unique information, unless it has an immediate purpose. If the information store is ever compromised and read by the wrong party, that could have consequences. So while protocols could be defacto-enabled to do stupid things (share with the tower, exactly where you are), there is also the possibility a nation state can access that information without any local persons approval.

You can stop one of the creepy_methods, by not having "that chip" inside your phone. That would be a start. when I see these dry technical descriptions of "how we will measure you to within a micron", there seems to be no next sentence "why we feel we should be doing this". That never seems to enter into the cellphone chipset argument. When a cellphone has an accelerometer, or it is measuring the electrostatic charge in the air, hardly anybody seems to be interested in "why did they put this crap in my phone?".

Some laptop disk drives have an accelerometer, which is for the purpose of retracting the heads, before the drive strikes the ground. This gives a measure of protection (the retracted head has a higher shock rating than if it rests on the platter surface). In the case of that laptop drive then, we declare "this is worth it". If the reading never leaves the disk drive housing, then there would not be any privacy implications.

Paul

Paul wrote on Tue, 12 Nov 2024 08:32:57 -0500 :

Hi Paul,

Most people give up because technology is too hard for them to understand. But on this newsgroup, we're savvy enough to control that technology.

Being technically savvy is a wholly different mindset from being a slave.

As an example, if I take your sentence above to simply change "reading" to 'BSSID' and "disk drive housing" to "home router", there is a lesson to be learned from that sentence with respect to 802.11az Wi-Fi Ranging privacy.

Instead of: "If the 'reading' never leaves the 'disk drive housing', then there would not be any privacy implications."

Change it to: "If the 'BSSID' never leaves the 'home router', then there would not be any privacy implications."

That latter sentence only holds true if you "hide" the BSSID broadcast. Luckily, hiding the broadcast is trivial to do on our home routers.

Notice we eliminate the privacy implications by doing two simple things: a. We understand the technology first and foremost, and then b. We implement an avoidance mechanism (instead of just giving up)

Put into simpler terms A. We learn that rude phones upload to Google our BSSID if it's NOT hidden B. So we hide our BSSID from those rude phones which do that for Google

It's really that simple.

It's the same simple thing I'm seeking the answer to for this thread. Q: What can we do to not be tracked indoors by 02.11az Wi-Fi Ranging? A: I suspect the answer is as easy as turning off Precise Location (but I'm not sure as I don't know much about 02.11az Wi-Fi Ranging).

Paul snipped-for-privacy@needed.invalid wrote: [...]

The accelerometer clearly has its uses ('Auto rotate', fitness/ sleeping apps, theft protection, etc., etc.).

You've "succeeded" only because the companies that maintain those databases LET YOU succeed.

And you don't even know WHETHER 802.11az WiFi Range Tracking involves collecting any information FROM your device.

Ummmmm...not necessarily so.

By analogy, GPS doesn't track YOU. GPS signals allow your GPS-enabled device to determine its location. The GPS system doesn't get any information about you or your location.

That is certainly not being demonstrated here.

There aren't any.

...in combination with the known location of the access points...

...to triangulate your position.

The access points have to expose their locations,

"The 802.11az standard [1], commonly referred to as next generation positioning (NGP), enables a STA to identify its position relative to multiple access points (APs)"