Re: Apple changed their documentation at my request but it proves they don't care about privacy

Maria Sophia <[email protected]> wrote:
> Chris wrote:
>> Maria Sophia <[email protected]> wrote:
>>> This is an update to the WPS scripts that I posted a few months ago.
>> 
>> I was wondering how you got on with your "experiment" only the other day. 
>> 
>> You said you had installed two routers in friends' houses downtown, move
>> them around and then track the movement in the database. 
>> 
>> I'd like to see the results. How often did you move them, how far, and were
>> the details tracked in the "apple database"?
> 
> Hi Chris,
> 
> Thanks for remembering that I ran a 3-router experiment early in the year.
> 
> That experiment was run in the first month of the year, which was before
> Apple changed their documentation saying that they will track us forever.
>  <https://support.apple.com/en-ie/102515>
> 
> Those BSSIDs are now in Apple's WPS database, so the experiment worked.

That wasn't the experiment. 

> Now, anywhere in the world I move those routers, anyone can track them.

That's not answering my question. Did you move them and what did you see?
Remember your claim was that you could track people from California to
Florida using only their router. 

> Instantly.

Evidence?

> Down to a meter or so resolution.
> With no controls whatsoever.

What did you test?

> Think about that.
> What if I were hiding from an ex-wife or disgruntled Apple poster?

Just get a different router. 

> Anyone on the planet can track my router location from anywhere in the
> world down to meter-like accuracy, and I simply cannot stop them.

No-one knows which, of the billions of entries in the databases, is *your*
router. No big deal. 

> The only thing I can do, once my BSSID is in Apple's WPS database, is throw
> that router over the next bridge because I can't change the BSSID on it.
> 
> I can be tracked forever, if my location is associated with that router.
> 
> Just like the research paper said it would be.
> I simply reproduced exactly what the research paper said was possible.
> 
> Worse, I proved hiding the BSSID broadcast was a catch-22 situation. 
>  a. It kept the BSSID out of Google/Mozilla hands (they're well behaved)
>  b. Yet, it's permanently in the Apple WPS database
> 
> Which do you pick to be in, given you can't solve both issues at once?
> 
> HINT: Apple's WPS database has no protection whatsoever, as proved by:
>  *Surveilling the Masses with Wi-Fi-Based Positioning Systems*
>  <https://arxiv.org/abs/2405.14975>
> 
> My research *started* with that paper, and took it to the next level.