Re: Apple changed their documentation at my request but it proves they don't care about privacy

Firstly, I do not like crossposting to so many groups. What group
are you actually reading this thread in, so that I can limit the
crossposts please?

On 2026-09-05, Maria Sophia <[email protected]> wrote:
> Jon Ribbens wrote:
>>> If you don't know what a BSSID is by now then it will take too much work
>>> here to explain it "fully" to you. Suffice to say it's like a vehicle
>>> identification number on a car. It goes everywhere the router goes.
>> 
>> Well, yes, it's the MAC address, like I already said.
>
> Hi Jon,
>
> To your credit, you are the first person who has responded, who has shown
> that he actually *read* the paper before trying to respond intelligently.
>
>  *Surveilling the Masses with Wi-Fi-Based Positioning Systems*
> <https://arxiv.org/abs/2405.14975>
>
> That's good. 
> Nobody else even bothered to click on the link, before responding.
>
> Hence, everyone else simply parroted their stone-age knowledge level.
> You, at least, did *read* the paper, which I congratulate you for doing.
>
> But you did not *understand* what the paper said by the BSSID.
> See below where you completely whooshed on which BSSID is what matters.
>
> I must be careful here not to fault you like I fault the Apple trolls,
> because I think you are sincerely trying to understand the problem set.
>
> So I simply caution you, as I did Lawrence & Andy, all of whom I respect
> for acumen, that you have to follow the trail of the *router* AP BSSID.
>
> You can not "randomize the BSSID" of the router AP (except in the most
> expensive commercial routers, which are not the topic of this thread).
>
> Think very deeply about that simple fact before responding, as the crux of
> the problem is no different than a governmment-issued identification
> number.
>
> You can't easily change your unique government-issued ID number just as you
> can't easily change the router-issued BSSID of your home router AP.

Yes, I do know all of the above.

> Think about that the same way the paper presented the mass surveillance.
>  1. I wrote a Python script that ran on Windows 10 that guessed at a set
>     of random government-issued identification numbers, e.g., 123.45.6789
>  2. Within minutes, I had a hit on a random government ID, which came
>     back with a GPS location and 400 nearby government IDs and locations.
>  3. Then, I ran another Python script on Windows 10 that extended that, 
>     taking the furthest-away governemtn ID/location pair, and did it again.
>  4. Within an hour, I had thousands of government IDs and locations.
>     (the researchers gathered billions, as I recall, but I stopped there.)
>
> Now that I have every government-issued ID and GPS location in the world in
> my 2TB database (which we calculated would be the size it would have been), 
> what is the paper saying about "mass surveillance" possibilities?
>
> HINT: I can track the future location of every one of those billions of
> government ID/GPS location pairs, without any restrictions on my scripts!
>
> Want to prove that?
> What's your home router BSSID?
>
> I will not only tell you exactly where that router is located (I even wrote
> the Python code to give me a dot on an OSM map for your location) but I can
> trivially easily forever track that router's location forever, without any
> restrictions on my part (which is the point of the paper, after all).

Yes, I know that too now, after reading the paper. I downloaded the
code at https://github.com/darkosancanin/apple_bssid_locator (which
was originally uploaded in 2015) and ran it locally with my own AP
MAC address and confirmed it showed my home location very accurately.

It does concern me that there is an attack model here which is that
a mildly technically-inclined stalker can very easily get the BSSID
of their victim and, as you say, find out where they've gone if they
move house to get away from them.

>> It mostly seems to be an attack against people who don't realise
>> they are targets, or are not thinking about the implications - c.f.
>> soldiers who upload their daily runs to public web sites thus
>> revealing if/where they are deployed.
>
> It's not "an attack" so much as explaining, with examples, of why we
> should care that mass surveillance is so easy with the Apple WPS
> implementation.

We should care because it enables attacks.

> Give me your BSSID.
>
> Note: I don't expect you to do it, which alone proves the point.

As above, I already tried it.

>> As I say that's a pretty unusual thing to do (travelling with a router).
>> Google's API does seem more sensible though (give it MAC addresses, it
>> tells you where you probably are, rather than giving you the recorded
>> individual locations of all those MAC addresses).
>
> I think your claim that it's "pretty unusual" for people to take their
> router with them when they move from one apartment to another is skewed.
>
> If I ask 100 people who recently moved, do you really think it would be
> only 1 or 2 people who took their home router with them when they moved?

I could quibble with that inasmuch as ISPs tend to provide the APs when
you order the connection, so a new connection usually implies a new AP
(in the UK, anyway). But I was talking about travelling with an AP,
e.g. on business, not moving house.

>>> You think this tracking isn't happenging asa we speak?
>>> You think Apple is doing something about it?
>>>
>>> That's 1/2 the point of this thread.
>>>  1. Apple is doing NOTHING about it (as described in the paper)
>> 
>> Have you, er, read the paper? It says Apple *is* doing things about it
>> (page 14, section 10 paragraph 3).
>
> See my first response to you in this post, where I want to be careful to
> not chastise you for misunderstanding what that paragraph actually says.
>
> You can NOT randomize the MAC address of the router AP, Jon.

Yes, I wasn't talking about randomizing the MAC addresses of APs,
I was talking about Apple taking steps to mitigate the attacks enabled
by their BSSID-lookup API. Apparently adding the "_nomap" exception was
one of the things Apple changed.

I agree that they shouldn't be storing BSSID data unless they see an
SSID broadcast without "_nomap" on the end (i.e. the SSID is not
hidden). And although I've briefly explored various lines of thought,
I can't immediately see why they would be reluctant to make that change.

But... it makes very little difference to the actual possible attacks.
Almost nobody hides their SSID, and even fewer append "_nomap". Anyone
who actually seriously cares about these things would take the trouble
to ensure that their BSSID does change if their location changes (even
if that means going as far as buying a new AP). The people who are
vulnerable are the people who don't know they're vulnerable.

>>>  2. So anyone in the world can track the movements of billions of routers
>>>  2. Worse, Apple isn't honoring the established meaning of the hidden
>>>     broadcast (which even Google honors, by way of stark contrast).
>> 
>> This is the bit I keep asking about and you keep not responding.
>> Is your actual/main complaint that Apple is storing BSSIDs that
>> correspond to hidden SSIDs? And you're saying only Apple do this,
>> not Google etc?
>
> First off, I don't have a complaint. That's absurd. I have facts.

You certainly don't seem to be happy with the status quo, which means
that by definition you have a complaint. My point is that for some
reason you are being opaque about what change you want to see.

> The absurdity of this thread is nobody has read or understood the links
> which were provided, and yet, they ask me (repeatedly) to explain them.
>
> Why can nobody understand the point that Eric & Dave made in this paper?
>  *Surveilling the Masses with Wi-Fi-Based Positioning Systems*
> <https://arxiv.org/abs/2405.14975>
>
> Why can nobody understand what's different about what Apple documented?
> <https://support.apple.com/en-ie/102515>
>
> Why can nobody undestqand the concept inherent in a hidden-broadcast?
> <https://ichnaea.readthedocs.io/en/stable/api/geosubmit2.html>
>     "The BSSID of the Wifi network. 
>      Hidden Wifi networks must not be collected."
>
> Why is it that I feel it's trivial to understand that 1+1=2 when everyone
> else is trying to claim that I need to explain why 1+2=2 when, if they
> simply read (and understood) what I've explained, they would understand?

I think that many people understand that 1+1=2, but you are then going
on to make some further claim that you are explaining very badly.

Also, the links you are providing do not always back up what you are
saying, or it is not clear what conclusion you are expecting people to
draw from them. For example, that last quote about "Hidden WIFi networks
must be be collected" is simply a policy of the Mozilla Location Service.
It isn't any sort of law or agreed standard.

>>> So much for Apple "cares about your privacy" bullshit, huh?
>>> It's shocking that google cares about privacy more than Apple does.
>> 
>> Apple cares about the privacy of *its customers*.
>
> I realize you're trying to understand these concepts so I have to be
> careful when I point out that this affects every single person in the
> world who owns a router (and company, but let's restrict this to just
> people).
>
> The issues are exactly the same no matter what company made that router.

Yes, I think you missed my point, which is that Apple is not generally
the provider of the routers, so Apple is not primarily concerned with
the privacy of their owners. Apple is primarily concerned with the
privacy of its customers, in respect of them being its customers.
(i.e. does their use of an Apple product threaten their privacy?)

>> I imagine the issue here is that if they change their API then older
>> devices that are no longer receiving updates will stop being able to do
>> wifi-positioning.
>
> The issue is clearly obvious that the Apple WPS design is flawed.
>
> I have dozens of emails from Apple, all of which show that they *know*
> that their design is flawed. 
>
> They're simply trying to protect themselves legally with me by having
> their emails redirected to their lawyers, who are whom I was
> responding with.
>
> They *know* what they're doing is wrong.

I think all of the above is likely true, but there is some reason they
cannot (quickly) change their API, probably related to the millions of
devices out there which either can not or do not receive new software
updates.

>>> Remember the Apple trolls posted to this thread that changing the
>>> SSID would solve the issue, but the main issue is about the BSSID,
>>> not the SSID.
>>>   a. The BSSId is unique (see above for rare exceptions).
>>>   b. The GPS location is also unique
>>>   c. The SSID only plays a role tangentially, and as such is a minor player
>> 
>> The "Apple trolls" are presumably correct inasmuch as if you change the
>> SSID to end in "_nomap" then it solves the issue.
>
> No it does not. Did you read any of the Mozilla references?
> Simply *collecting* the BSSID is the starting point.
>
> The problem exists no matter what the SSID is.

Sorry, I don't get what you mean. If the broadcast SSID ends with
"_nomap" then Apple won't store the BSSID, and won't respond with
its location. Are you saying that isn't true? If it is true, then
what is "the problem"?

> With my congratulations to you and with my appreciation that you are the
> only one who has shown they have read the paper, I must point out that I
> think you misunderstood which BSSID the paper is talking about.
>
> For most home routers, the owner has no way of changing the AP BSSID.

I don't know why you think I misunderstood that.

>>> Do you know what a hidden broadcast SSID is?
>>> What is the purpose of a hidden broadcast in your opinion?
>> 
>> To waste power in client devices, as far as I can see, since it
>> means they have to be constantly pinging for the network rather
>> than just connecting to it when they see the SSID broadcast.
>
> No. Every mobile device has the on/off ability to NOT autoconnect.
>
> Privacy never was something that everyone could understand, but let's
> hope the people on this ng have the capacity to understand the
> complexities.

I think even fewer people are going to be manually connecting their
devices to a hidden-SSID WiFi network every time they come into range
than have hidden-SSID WiFi networks in the first place.

>> I think you are still failing to explain what those two things are,
>> and I'm getting tired of guessing. If you are claiming the paper
>> describes this difference, please say where. If it doesn't, please
>> just say what it is.
>
> Again, I have to first say that I appreciate that you read the paper, and I
> presume you read the Mozilla documentation I presented, and I presume you
> also read the Apple documentation which the Apple lawyers wrote after my
> discussions with them way back in December of last year (public knowledge).

I read the paper (albeit not in complete detail), and I skimmed the
Apple documentation, although I'm not clear on which bit you are saying
they added because of you - I assume the "This opt-out doesn’t work for
hidden networks" bit?

> The paper shows that Apple's WPS implementation is highly flawed.
>
> If you've ever tried Google's WPS implementation, you'll see that it's
> not. Nor is Mozilla's MLS implementation (now deprecated).

The paper discusses the difference between Apple and Google's
implementation, and I agree that Google's looks better.