Re: Apple changed their documentation at my request but it proves they don't care about privacy

On 2026-09-05, Maria Sophia <[email protected]> wrote:
> Jon Ribbens wrote:
>>> Lil' ole' me can easily track a BSSID anywhere in the world, down to a
>>> meter or so accuracy, if I want to under the common circumstances which
>>> I've outlined in this thread (and in others).
>> 
>> Ok. I think BSSID means "MAC address of the WiFi access point".
>> I don't know what circumstances you can track them, and you don't
>> seem to have said in this thread.
>
> Hi Jon,
>
> Thanks for your questions as it shows you're trying to understand this.
>
> Your questions are all good questions, from someone who is encountering
> this issue for the first time in their lives, but let's be clear that an
> entire course in networking for privacy is beyond my personal skill sets.
>
> If you don't know what a BSSID is by now then it will take too much work
> here to explain it "fully" to you. Suffice to say it's like a vehicle
> identification number on a car. It goes everywhere the router goes.

Well, yes, it's the MAC address, like I already said.

>> I suppose if someone had reason to target me specifically, and they had
>> a real-time way of tracking BSSIDs, and for some reason I can't imagine
>> I was taking a WiFi access point with me, I... oh, wait. In that
>> circumstance I would not take a WiFi access point with me, for the
>> same reason I wouldn't have my mobile phone radio enabled, or would not
>> have a mobile phone with me at all, depending on the threat model.
>
> Read the paper which we referenced multiple times in this thread so that I
> don't have to re-hash over and over again how mass surveillance is possible
> with the Apple WPS database design. 

You hadn't referenced it at the time I wrote my post, or at least
by the time you wrote the post I was responding to.

It mostly seems to be an attack against people who don't realise
they are targets, or are not thinking about the implications - c.f.
soldiers who upload their daily runs to public web sites thus
revealing if/where they are deployed.

>  *Surveilling the Masses with Wi-Fi-Based Positioning Systems*
> <https://arxiv.org/abs/2405.14975>
>
> Anyone who can run a python script (which I will provide to them upon
> request) can track anyone in the world who moves from one place to another
> (and who happens to take their router with them to their new location).
>
> Nobody disputes that fact, which is what the paper itself explained.
> I simply reproduced their "billions of BSSID/GPS pairs" with thousands.
>
> It doesn't bother you that I can track the movements of billions of people
> if they happen to move from one locale to another using the same router?

As I say that's a pretty unusual thing to do (travelling with a router).
Google's API does seem more sensible though (give it MAC addresses, it
tells you where you probably are, rather than giving you the recorded
individual locations of all those MAC addresses).

> You think this tracking isn't happenging asa we speak?
> You think Apple is doing something about it?
>
> That's 1/2 the point of this thread.
>  1. Apple is doing NOTHING about it (as described in the paper)

Have you, er, read the paper? It says Apple *is* doing things about it
(page 14, section 10 paragraph 3).

>  2. So anyone in the world can track the movements of billions of routers
>  2. Worse, Apple isn't honoring the established meaning of the hidden
>     broadcast (which even Google honors, by way of stark contrast).

This is the bit I keep asking about and you keep not responding.
Is your actual/main complaint that Apple is storing BSSIDs that
correspond to hidden SSIDs? And you're saying only Apple do this,
not Google etc?

> So much for Apple "cares about your privacy" bullshit, huh?
> It's shocking that google cares about privacy more than Apple does.

Apple cares about the privacy of *its customers*.

> There are two fundamental issues, only one of which is in this paper.
>  *Surveilling the Masses with Wi-Fi-Based Positioning Systems*
> <https://arxiv.org/abs/2405.14975>
>
> I've summarized what's in that paper likely a half dozen times in this
> thread, and I've added a second issue that is not discussed in that paper.
>
> I've talked that second issue over with security professionals like Brain
> Krebs and Daniel Veditz, so there is no doubt of the veracity of my claims.
>
> To summarize complex issues in a few simple sentences, they might be:
>  1. Apple allows anyone on the world to track the movements of everyone
>     in the world (if they take their router with them when they move).
>  2. Apple puts zero controls on that tracking by anyone, of everyone.

I imagine the issue here is that if they change their API then older
devices that are no longer receiving updates will stop being able to do
wifi-positioning.

>  3. In addition, Apple does not respect the known meaning of a hidden
>     broadcast, and worse, Apple *refuses* to honor what even Google does.
>  4. Anyone can prove these statements are true on a Windows PC running
>     Python using the scripts I have provided for that express purpose.
>
>> I'm not sure what I think about that, and I don't know what any of the
>> other companies that map SSIDs do in the same situation. I'm not sure
>> why Apple would store location data of BSSIDs with no visible SSID -
>> it doesn't seem like it would help the geolocation feature much, since
>> hiding the SSID is pretty rare.
>
> Remember the Apple trolls posted to this thread that changing the SSID
> would solve the issue, but the main issue is about the BSSID, not the SSID.
>   a. The BSSId is unique (see above for rare exceptions).
>   b. The GPS location is also unique
>   c. The SSID only plays a role tangentially, and as such is a minor player

The "Apple trolls" are presumably correct inasmuch as if you change the
SSID to end in "_nomap" then it solves the issue.

>>> I explained it in gory detail, and even provided a link to the research.
>>> I provided some of the python scripts too (although they're not the
>>> point).
>> 
>> You haven't done any of that in this thread so far as I can see.
>
> Did you read the paper?
> What does that paper say?

You hadn't linked the paper at the time I wrote my post.
The paper doesn't quite say what you're claiming, I think,
although I see your general point (or at least, the paper's
authors' general point).

> Do you know what a hidden broadcast SSID is?
> What is the purpose of a hidden broadcast in your opinion?

To waste power in client devices, as far as I can see, since it
means they have to be constantly pinging for the network rather
than just connecting to it when they see the SSID broadcast.

So in some senses it makes the user tracking problem *much worse*,
since it means the attacker can hang around public places watching
for client devices (which, unlike access points, tend to move around
with the user) that are pinging for the attack target's hidden SSID.

Hang around a diner near Langley, Virginia, watching for people
carrying devices pinging the hidden SSID "CIA UNCLASSIFIED"...

> I've explained both perhaps a half dozen times in this thread.
> Explaining another half dozen times won't help until you do the above.

I'm starting to think that by "this thread" you don't mean "the set
of Usenet articles referenced in the References headers" and are
including other historic threads...

> Google does one thing (which, surprisingly, is the right thing to do).
> Apple does the opposite (and, not surprisingly, refuses to change it).

I think you are still failing to explain what those two things are,
and I'm getting tired of guessing. If you are claiming the paper
describes this difference, please say where. If it doesn't, please
just say what it is.