How does turning on wifi enable better phone location tracking? - Page 1
Forum section: electronics / general

author: Beamin
author_rank: Super Contributor
timestamp: December 07, 2020, 09:13:34 pm
content: When those google cars drove (I think they are constantly driving around updating) around they had wifi antennas on them. They would take note of the MAC addresses and when there was four they can triangulate, I would also imagine they collect IP's with the MAC and link to peoples google accounts reveling a database of peoples home addresses/names and who your physical friends/family are. Simple algorithms can figure all this out. Scary stuffhttps://youtu.be/VFns39RXPrU

author: Ranayna
author_rank: Super Contributor
timestamp: December 08, 2020, 08:28:32 am
content: I don't think that the Street View cars are the main source for MAC locations. At least not anymore.I remember that they got splapped down somewhat in Germany when it became public that the cars collected MAC adresses, so they were not allowed to uses them in Germany. Obviously there is no way to prove if they complied or not. But the bigger issue is outdated information. Routers changeIf maybe not as often as smartphones.The Streetview car, unless you have an open WiFi, will also *not* be able to gather any IP information about your router or ISP. It would have to connect to be able to do that.But why would they even need the info from the cars anymore nowadays?Once an Android phone has a proper GPS fix for the first time in a certain area, it can now scan for WiFi, and transmit all gathered information about the MACs in that area to the mothership. Very likely, this happens everytime a GPS location is established. The next time it needs a fix it can pre determine the area to about 200 meters, obviously assuming that the WiFi MAC has not changed location.And the phone, when connected to the WiFi, *can* of course gather IP information. Your external IP, and the WiFi IP of the phone will certainly be transmitted as part of the protocol, but i do not know if the phone would actually go ahead and actively scan your network. I somwhat doubt that, because stuff like that tends to get noticed. But since you are logged in to the phone with a Google account, the IP address is not something Google really needs, or rather already has anyway

author: AkiTaiyo
author_rank: Contributor
timestamp: December 08, 2020, 09:14:59 am
content: You can always opt-out (https://support.google.com/maps/answer/1725632) if you think that Google will actually respect this!

author: duckduck
author_rank: Frequent Contributor
timestamp: December 08, 2020, 07:04:00 pm
content: I assume that Apple is also collecting MAC addresses / ESSIDs via WiFi and pairing them with GPS coordinates and then sending them back to the mothership while I've got both the GPS and WiFi chips turned on. Another good reason to disable WiFi while you're out and about is that (up until IOS 13 or so) your phone was trackable by its MAC address. Apple wants to be the only company that can track iPhones, so now iPhones spoof a MAC for each SSID. This complicates things for business that track people by WiFi on their phone, but it doesn't make their job impossible. Anyway, your phone leaks more than your location over WiFi. Some stores use cell phone WiFi location information to see where customers walk and how long they stand in certain areas. If I'm at a store I'm buying something anyway, so they have my credit card, but I'd rather not be part of their marketing data set, even if it is anonymized.

author: Ranayna
author_rank: Super Contributor
timestamp: December 09, 2020, 08:21:27 am
content: Yes, there is no reason to assume that Apple does not do the same. I have at least a smidge more trust in Apple (that is still not much, mind you) that they will not sell the data to just anyone who wants it.And yes, while they have implemented "Private MAC" for connecting to Wifi, they have also made Bluetooth unable to be fully deactivated from the control center. And the location tracking by stores you mention is generally done with Bluetooth instead of WiFi.

author: GlennSprigg
author_rank: Super Contributor
timestamp: December 11, 2020, 01:46:56 pm
content: We should take such 'privacy' with a grain of salt these days!!I'm one of those... "Ain't got nothing to hide!" people, although i know HOW to hide the majority of it.I regularly get an email from 'Google' now, showing me everywhere I have been, and what I've done!!It's almost fun to read where I traveled to, the places I stayed at, rental cars etc etc for say 3 years prior!

author: EmmanuelFaure
author_rank: Regular Contributor
timestamp: December 11, 2020, 10:30:21 pm
content: Quote from: Beamin on December 07, 2020, 09:13:34 pmEven scarier, anyone can query their database via an API. When I say anyone, it's anyone. Not limited to law enforcement, etc... You just have to have a developper account, a pay a very small fee :https://developers.google.com/maps/documentation/geolocation/overview

author: NiHaoMike
author_rank: Super Contributor
timestamp: December 11, 2020, 11:16:27 pm
content: Quote from: Ranayna on December 09, 2020, 08:21:27 amTime to build a gadget that generates a lot of random packets to confuse the tracking? Could even use multiple radios with directional antennas to distort your actual location.

author: I wanted a rude username
author_rank: Frequent Contributor
timestamp: December 12, 2020, 04:43:35 am
content: Quote from: NiHaoMike on December 11, 2020, 11:16:27 pmKind of likethis ESP32-based SSID rickroller? It simply handcrafts beacon packets and vomits them out for all to see.

author: Beamin
author_rank: Super Contributor
timestamp: January 01, 2021, 10:09:35 pm
content: Quote from: EmmanuelFaure on December 11, 2020, 10:30:21 pmHow much technical do you need to know to use that? I read the page but seems pretty advanced. Do you need an SDR like an SDRPlay(Which I have)? I'm not being lazy by not doing research I'm just having trouble seeing today and struggling with that page(Some web pages dont zoom well). Or does that work over the internet "pinging" things? How much does it cost?

author: tszaboo
author_rank: Super Contributor
timestamp: January 01, 2021, 10:19:45 pm
content: Quote from: Beamin on December 07, 2020, 09:13:34 pmNah, probably every Android phone with switched on GPS takes note about the available Wifi networks and MAC addresses. And here is something that you wouldn't like: Even if you opt out, use a ipohne or a windows phone, etc: Your neighbor's phone will still report where you are. Google knows exactly, where you are, who is your friend, and what episode you are watching on your TV, even if you dont use any of their product.

author: amyk
author_rank: Super Contributor
timestamp: January 02, 2021, 01:14:42 am
content: Some of the no-name Chinese Android phones have an interesting feature: the MAC address changes randomly every time you turn WiFi on and off again.The feature was simply accomplished by leaving the EEPROM that usually stores the MAC blank, which causes the firmware to generate a random one by default.

author: NiHaoMike
author_rank: Super Contributor
timestamp: January 02, 2021, 04:04:23 am
content: Quote from: NANDBlog on January 01, 2021, 10:19:45 pmThe most that you can get by sniffing encrypted Wifi traffic is possibly if you're home or not, but even that is not completely reliable. They see MAC address X disappear around time A and reappear around time B most days, so assume it's tied to the user of device X. What if you had another device with MAC address Y automatically turn off around time C and turn back on around time D most days? Would they assume that's the schedule of the (nonexistent) user of device Y? In the absence of other information, how would they tell whether X or Y is "you"?Trying to tell exactly what you're doing on your encrypted network is close to impossible. You could see bursts of activity, but how would you know what content it is? Don't forget all the background activity that would make detecting bitrate signatures unreliable, if that was even viable in the first place thanks to the somewhat unpredictable nature of buffering. Or just download the video and the only activity that's visible is a near constant data stream, so now the only information they have is a rough estimation of file size, with nothing to tell if it's a short 4K video or a longer 1080p video.Finding out which friends visit you is likely the easiest of those examples only because they're probably not as paranoid as you are so their location data tells it all.And on top of that, they would spend resources figuring out what you do but it turns out they can't really use that data for anything because you block ads so ad targeting is worthless. Most likely they'll focus their efforts on easier targets.

author: tszaboo
author_rank: Super Contributor
timestamp: January 02, 2021, 11:58:52 am
content: I'm not talking about someone very paranoid, but here is a mac address lookup table:https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4Also, watch an episode of some well known television series. Or try ding the me on Netflix or Amazon, and search on your android phone "reddit xy series ". The search suggesting that pops up will be exactly the episode that you are watching.It would take a lot of effort to go completely off their grid, and they have a lot of second hand information from you. It's very noticable.

author: janoc
author_rank: Super Contributor
timestamp: January 02, 2021, 01:04:51 pm
content: Quote from: amyk on January 02, 2021, 01:14:42 amThat is a standard Android feature since Android 8:https://source.android.com/devices/tech/connect/wifi-mac-randomizationNothing to do with any EEPROMs left blank, the entire thing is under software control of the Linux kernel in the Android device. Linux has supported this since a long time.

author: NiHaoMike
author_rank: Super Contributor
timestamp: January 02, 2021, 02:34:48 pm
content: Quote from: NANDBlog on January 02, 2021, 11:58:52 amThat has been well known since the days when DD-WRT supported one click MAC address lookups. The fix is simple: spoof your MAC.QuoteUse an alternative like DuckDuckGo for your actual searches and feed Google junk.http://makeinternetnoise.com/index.html

author: cdev
author_rank: Super Contributor
timestamp: January 02, 2021, 02:45:25 pm
content: I read some time ago that mac address anonymization in both Apple and Android (google) phones was broken. (easy to figure out the real mac address)Since mac addresses are supposed to be used for authentication in lots of contexts, Its kind of unsurprising that their anonymization is non functional and easy for them to break.What I am trying to say is, if you have a phone, and use it, you really don't have privacy any more, the way things are going. Corporations have that data, sell it and soon, if they haven't already will probably have legal rights to it written into treaties and so on.And don't expect them to tell people, either.

author: Beamin
author_rank: Super Contributor
timestamp: January 02, 2021, 02:50:19 pm
content: Quote from: NANDBlog on January 02, 2021, 11:58:52 amI found some products my father worked on on that list.You dont have to be paranoid but maybe you just like privacy. I can trace back to the month when my info went public on the internet back in the 2000's. I have been making fake "me's" when ever I can since I have such a unique name.I was in the hospital last month and the hospital registration guy came into the room to do my insurance and they asked do you live at "123 any st anytown USA" and that address was the address of a childhood friends mothers house I stayed at for 2 weeks 13 years ago. How the hell do they know that?Also when it comes to opening bank accounts there's some provision of the patriot act with a list and according to that list I'm dead, so I cant use 90% of major banks because there's no reasonable way to fix it. They dont exactly have a 1800 to call.

author: cdev
author_rank: Super Contributor
timestamp: January 02, 2021, 02:53:09 pm
content: DuckDuckGo is using Google's data.Needless to say, the web is changing and not in a good way.Quote from: NiHaoMike on January 02, 2021, 02:34:48 pmThe idiocy of depending on totally biased multinational corporations for tools like search should be obvious to people.If it isn't. Well..

author: cdev
author_rank: Super Contributor
timestamp: January 02, 2021, 03:02:16 pm
content: Quote from: janoc on January 02, 2021, 01:04:51 pmSecurity research has shown the mac address randomization to be ineffectual.

author: NiHaoMike
author_rank: Super Contributor
timestamp: January 02, 2021, 03:49:01 pm
content: Quote from: cdev on January 02, 2021, 02:45:25 pmPretty sure that has been the case since the first cell phones, the networks have to know where the phone is in order for it to work. What has changed is the increase in other mechanisms for tracking, but those are significantly easier to defeat/spoof (without losing key functionality) since your device doesn't rely on it to work.I would say the first step is to use an adblocker in order to cut off much of the tracking revenue. Using alternatives where practical is also a good idea. Feeding junk data is the final touch, but by this point, it's more about protecting others.

author: cdev
author_rank: Super Contributor
timestamp: January 02, 2021, 04:40:30 pm
content: People have become products, which corporations are getting rights to sell info on.