Char Jackson <none@none.invalid> wrote:
On Mon, 22 Dec 2025 18:00:14 +0000, Andy Burns <usenet@andyburns.uk>
wrote:
Marian wrote:
I (can) have every access point locationBut which of those 2 billion belong to me?
in the world (over 2 billion) if I felt like getting it (and storing it). >>>
Well, *you* know which it is, and ve haf vays of making you talk, so...
Do *you* know your MAC address if presented with a list? I certainly don't.
As long as that BSSID is not openly linked to you, the person, than there
is no privacy issue present.
Since I have already posted a half dozen security research papers and articles that expressly claim otherwise
you're entitled to your own opinion which isn't backed up by a single security
researcher on earth
The research shows that BSSID + geolocation enables inference attacks, movement tracking,
and household identification even without explicit personal identifiers.
For those lurking and learning, this isn't what people like Rudy think it is, since A-GPS has absolutely nothing directly to do with any of this.
A-GPS is simply a method for a phone to speed up its own location fix
using network assistance.
I'm simply informing you and others on this newsgroup of this problem set.
And I'm asking for solutions (in another thread) for resolving the
problem.
but my point is that being able to easily track it from anywhere in the world means anyone can essentially atrack you.
To prove how easy it is to track anyone's movements from place to place,
I'm setting up these three routers to prove that I can easily be tracked:
The key point is that Apple's WPS endpoint returns hundreds of nearby GPS:BSSIDs pairs for any submitted BSSID, not just the one requested.
Lest you claim "I don't get it", it's important to reiterate that the insecurity of Apple's Wi-Fi Positioning System (WPS) isn't speculative.
I'm all about helping everyone -
Rudolph, let's keep this focused on the technical issue rather than tone.
For you to tell me "I don't get it" a hundreds times, doesn't mean that I don't get it when I simply reproduced what researchers said could be done.
Worse, I, myself, could easily track any BSSID in the world.
That's not random.
These flaws effectively exposes large portions of Apple's WPS database
to anyone who knows how to query it, which is what the researchers said.
I have no intention of tracking people, but I proved it's trivial to do. Just like the security researchers said it was.
Marian wrote:
Anyone can do this for any home in the United States.
Which is why this is so dangerous to privacy.
Apologies for the unit 2-a on every name and address in the previous list. Only the first line was that unit.
I used gVIM to munge the record, slightly, for privacy, since the exact
unit didn't matter for our purposes, but I made an editing redaction error.
The point is anyone in the world can track these people by their GPS:BSSID. Jeffrey Devin ......................... 4306 Josey Circle
Ronda and Alfred Beel ................ 4310 Josey Circle
James and Dollie Henson Smythe ....... 4314 Josey Circle
Rosemary Ellerbee Jones .............. 4317 Josey Circle
Benjamin and Eric Choyica ............ 4318 Josey Circle
Lonzie D. Groniger .................... 4321 Josey Circle
Terrince Steedman ..................... 4326 Josey Circle
Lutrisher Walton Hill ................ 4329 Josey Circle
Shane Jameson Sr. ..................... 4330 Josey Circle
Flora Ann Jackson Gellion ............ 4338 Josey Circle
Mary E. Gebbs Hendy ................... 4816 Josey Circle
Sherryn Marie Smythe .................. 4820 Josey Circle
Melvin Hawthorn, Jr. ................. 4823 Josey Circle
Charles Nesh .......................... 4824 Josey Circle
Trivia Yashica Watken ................ 4827 Josey Circle
Pamela Tomas .......................... 4828 Josey Circle
etc.
The papers explained how anyone in the world could track every owner of
every home in the United States by their GPS:BSSID using the highly
insecure Apple WPS database like could for the above people (which I have
no plans on doing but which is why I understand how badly designed Apple's WPS implementation is - which Google's WPS & Mozilla's WPS isn't).
That's not random.
Yes, it is. Tell me, what is *the name of the person* behind the BSSID's >> you have been tracking ?
Ofcourse, you have no idea.
Ah, but I do.
Apologies for the unit 2-a on every name and address in the previous list. Only the first line was that unit....
The point is anyone in the world can track these people by their[snip rest of list]
GPS:BSSID.
Jeffrey Devin ......................... 4306 Josey Circle
Ronda and Alfred Beel ................ 4310 Josey Circle
James and Dollie Henson Smythe ....... 4314 Josey Circle
...And lets not forget, I asked you a simple Yes/No question about it which
you still have not answered :
f. This derived linkage is not present in Apple's data itself.
2. How the location association works
a. Apples WPS database stores BSSID-to-location pairs.
b. In practice, these coordinates almost always correspond to a specific building.
c. That building is associated with an owner through public
property records (in the USA anyway)
And yet I proved it's trivial to obtain the named owner of every building
in the United States
Essentially... 1. Every home in the USA is tied to an owner in a public database
2. Every BSSID in every home in the USA is in the Apple public database
BSSID <-> GPS <-> Address <-> Owner
Only an extremely unimaginative person wouldn't be able to connect the
dots
I've got a name for you :John Smith. Now tell me, where does he live and >> whats his BSSID ?
Do I have to explain the above to you or are you smart enough to figure
it out for yourself ?
BSSID <-> GPS <=> Address <-> Owner
Every person who knows anything understands that every owner of every
home in the United States is in a public database
Arlen,
Apologies for the unit 2-a on every name and address in the previous...
list.
Only the first line was that unit.
The point is anyone in the world can track these people by their[snip rest of list]
GPS:BSSID.
Jeffrey Devin ......................... 4306 Josey Circle
Ronda and Alfred Beel ................ 4310 Josey Circle
James and Dollie Henson Smythe ....... 4314 Josey Circle
So, you have a list of person names and, I assume, street adresses - but
no (GPS.)BSSIDs. iow, nothing to track any of those persons with.
And, you understand that if they move, they take their router with them.
Are you disputing any of that?
I know the owner of every home on Josey Circle in Shreveport, LA, right?
And, in another post, I showed the BSSID nearest to each of those
buildings, right? (I'm not going to put it together here for reasons that I'm not trying to dox people.)
a. Are you disputing I have the named owner of every home in the USA?
b. Or are you disputing I have the BSSID of every home in the USA?
Note that by tracking the BSSID and knowing the owner of every home in the USA (since that's a public record), I could tie it to you "if" you're the owner.
But in the USA, overwhelmingly, people own the home they live in.
So it's tied to the owner.
Who, in this case, would be you.
Would it not?
Arlen,
And, you understand that if they move, they take their router with them.
Are you disputing any of that?
Wishfull thinking much ? If he doesn't I will.
I know the owner of every home on Josey Circle in Shreveport, LA, right?
Which is pretty useless.
And, in another post, I showed the BSSID nearest to each of those
buildings, right? (I'm not going to put it together here for reasons that >> I'm not trying to dox people.)
:-) You're just telling us exactly what you've done, so we can repeat it >ourselves. In my country thats called "aiding and abedding" - which can >easily land you into jail.
a. Are you disputing I have the named owner of every home in the USA?
You already asked that.
b. Or are you disputing I have the BSSID of every home in the USA?
If he doesn't I will. Also, *the* BSSID ? Just a single one ? What are >you ? Poor ?
Note that by tracking the BSSID and knowing the owner of every home in the >> USA (since that's a public record), I could tie it to you "if" you're the >> owner.
Thats a rather big "if", don't you think ? It certainly trashes your
initial claim that you could track *everyone* (all over the world).
But in the USA, overwhelmingly, people own the home they live in.
Tell that to all the poor city-dwellers who predominanty rent they places.
Who are, by the way, in close proximity and often stacked several layers >ontop of each other. Which ofcourse makes a mockery of any claim that a >certain location will al;ways point to a single home.
So it's tied to the owner.
:-) You're "cooking the books" there.
Who, in this case, would be you.
Would it not?
Chances are - for multiple reasons as indicated in the above - he's not.
You're playing the "no true Scotsman" falacy there* : when you do not like a >certain result you just discard it - leaving you with a meaningless, small >subset, but all confirming what you wish to claim. Duh. Also, blergh.
* https://en.wikipedia.org/wiki/No_true_Scotsman
Bottom line : you *might* be able to track someone when you are given a >persons name. - if the stars align just right.
It helps greatly if a MAC address is unique within its local
network segment,
but a duplicate MAC appearing somewhere else shouldn't cause
any problems.
*Many years ago,...
it didn't cause any problems. It simply moved certain
tasks farther up the network stack
Tell that to all the poor city-dwellers who predominanty rent they places.
Who are, by the way, in close proximity and often stacked several
layers ontop of each other.
Char,
It helps greatly if a MAC address is unique within its local
network segment,
I would say that!
Examples of 'puters who could not communicate over the LAN because either >their ethernet-cards MAC was already present, or they had a hard-set IP that >clashed are aplenty.
but a duplicate MAC appearing somewhere else shouldn't cause
any problems.
As long as it would not be a duplicate there, you would be correct. :-)
There are a few problems with your suggestion though : it only works for >devices that do not move around, which would make Arlens statement that he >can track anyone a bit of a joke.
If they hoever *do* move around (hello smartphones!) there is a rather good >chance that they will, sometimes, enter a network segment where their BSSID >is alread present - which could lead to a denial of service for one, or even >all of the devices being copies of each other.
*Many years ago,...
it didn't cause any problems. It simply moved certain
tasks farther up the network stack
I think it did a bit more. Like negotiating which server would handle the >request, and how to mark it that a certain ethernet packet was part of an >ongoing conversation with a specific server.
iow, all those servers would need to /activily work together/ so they would >not yell over each other and try to hijack each others conversations.
You know, it does sound odd : that sofware (that was bought) would need to >add markers to make sure ongoing conversations would go to the server which >first serviced it, in effect duplicating what the ethernet MAC and the >puters IP are for ...
but I remember the servers having dual NICs, with one dedicated
as sort of a mesh, where they disambiguated and de-duped everything,
Arlen says the whole idea that I tossed out above is a non-starter,
Happy New Year!
but a duplicate MAC appearing somewhere else shouldn't
cause any problems.
As long as it would not be a duplicate there, you would be
correct. :-)
I was thinking that the chance of that kind of collision would
be exceedingly low, but statistics were never my strength.
Arlen,
[quote=me]
Tell that to all the poor city-dwellers who predominanty rent they places. >>
Who are, by the way, in close proximity and often stacked several
layers ontop of each other.
As my thoughts went over to the "well off" city-dwellers who own the >appartments they live in, I realized that they too often live stacked that >way, sometimes in high-rises of 20 stories or more, with penthouses ontop.
Your Apple-database location data in such cases ? Useless.
Regards,
Rudy Wieser
Adding location information to DNS, DHCP, SNMP etc have been proposed....
An early scheme is RFC 1712
proposed in 1994. Its now more than 36 years later
Char Jackson <none@none.invalid> wrote:
On Mon, 22 Dec 2025 18:00:14 +0000, Andy Burns <usenet@andyburns.uk>
wrote:
Marian wrote:
I (can) have every access point location
in the world (over 2 billion) if I felt like getting it (and storing it).
But which of those 2 billion belong to me?
Well, *you* know which it is, and ve haf vays of making you talk, so...
Do *you* know your MAC address if presented with a list? I certainly don't.
It would be easier just to ask me for my physical address.
https://en.wiktionary.org/wiki/ve_haf_vays_of_making_you_talk
Am surprised there isn't a reference to the 80's comedy show 'Allo 'Allo!
Jeff,
Adding location information to DNS, DHCP, SNMP etc have been proposed....
An early scheme is RFC 1712
proposed in 1994. Its now more than 36 years later (which is, for >technology, a loooong time), and nothing like it has been implemented.
Maybe that is because there is no automated way to determine the "floor >number". Especially for devices which task it is to do DNS, DHCP and so
on - those do not even contain hardware to determine their own X/Y location.
I must say that that RFC does have a joke smell to it. You know, like the >"I'm a teapot" HTTP status, the "evil bit" for ethernet packets and lets not >forget "IP over avian carriers" (which, by the way /does/ work).
And although most/all smartphones do have a GPS, those are notoriously bad >at determing elevation (which is not really a surprise, if you look at where >the GPS satelites are located in relation to the GPS receiver).
Regards,
Rudy Wieser
And happy year to you - and everyone else here. :-)
Maybe that is because there is no automated way to determine the
"floor number". Especially for devices which task it is to do
DNS, DHCP and so on - those do not even contain hardware to
determine their own X/Y location.
Quoting myself: "Note that the data does not need to be derived
from GPS data. Since it doesn't change (often), it could be
entered into the database when the DNS record was created."
I suggest you not pass judgment on technology that you
might consider old and instead concentrate on whether
they might actually work.
That's true which is why sports GPS receivers often include a
barometric altimeter:
| Sysop: | Tetrazocine |
|---|---|
| Location: | Melbourne, VIC, Australia |
| Users: | 15 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 173:03:46 |
| Calls: | 188 |
| Files: | 21,502 |
| Messages: | 80,021 |