Re: Apple changed their documentation at my request but it proves they don't care about privacy

On 2026-09-06, Carlos E.R. <[email protected]> wrote:
> On 2026-09-06 02:06, Jon Ribbens wrote:
>> Firstly, I do not like crossposting to so many groups. What group
>> are you actually reading this thread in, so that I can limit the
>> crossposts please?
>
> I understand, but that could be a problem to people that are already 
> reading on a "different" group.
>
> Your comments are easier to understand that Arlen (aka Maria) posts. He 
> is not clearly explaining the issues and wants people to read a lot of 
> documentation, instead of just posting an actual summary of the 
> situation with explanations.
>
> Ie, what was Apple doing, why is that bad, what have they changed, is 
> that enough and why, what are the actual dangers to people.
>
> Complete, and short text.

Ok, well to summarise what I have gathered then, which may or may not
be Maria's opinion but reflects my opinion at this point: there are two
completely separate issues here, which are unrelated except that they
are both to do with WiFi location databases.


1. Apple are storing the location of "hidden" WiFi Access Points.
   (My opinion: low priority.)

Multiple organisations are gathering and storing the physical
co-ordinates of the MAC addresses ("BSSIDs") of WiFi Access Points
around the world, whenever they are seen transmitting by, e.g. mobile
phones. (Any WiFi-enabled device can see this information; it does not
need to be connected to the network in question, nor does it need to
know its password.)

The purpose of these databases of BSSID locations is to assist devices
such as mobile phones in locating themselves. Maybe the device is
indoors and cannot get a GPS signal, but also my understanding is that
GPS can fix an accurate location much faster if it starts already
knowing vaguely where on the planet it is.

There is broad agreement that these databases should not include BSSIDs
which are broadcasting WiFi network names ("SSIDs") which end in the
string "_nomap".

Allegedly: Apple are adhering to this exclusion, but are not also
excluding BSSIDs which are not broadcasting any SSID at all (i.e.
"hidden" networks). Other organisations (e.g. Google) do exclude such
"hidden" networks.

My complete speculation: older Apple software, written before they added
the "_nomap" exclusion, doesn't care at all about the SSID, so just
reports from the phone to the central database the BSSID and location.
The database thus has no way of excluding "hidden" networks, without
excluding all reports from older devices. The "_nomap" exclusion is
achieved by later software versions reporting the SSID if it is seen,
and any BSSIDs associated with "_nomap" SSIDs then being blacklisted,
maybe for 6 months or something like that. The likelihood of any
particular BSSID *only* being seen by old Apple devices and *never* new
ones is very low, and hence the "_nomap" exclusion more-or-less works.

My opinion: this failure to exclude "hidden" networks is unfortunate and
should be fixed, and maybe Apple are indeed fixing it, but it's possible
it may take some years to achieve due to the multitude of devices
running old software.


2. Apple's API is trivial to abuse.
   (My opinion: high priority.)

The Apple API to query their BSSID location database is remarkably
unrestricted. It has little or no rate limiting, doesn't ask for an API
key, and reports not only the location of the BSSID but also potentially
a great many other BSSIDs in the locality. It is not beyond even an
individual person's ability to get a list of most of the Access Points
in the world and all their locations.

This makes it very easy for people to abuse this data in various ways,
from stalkers tracking victims to state actors tracking military
targets.

Google's API by contrast essentially reverses the process, and instead
of the phone asking "Where is BSSID <x>?", it says "I can see BSSIDs
<x>, <y>, and <z>, where am I?".

My opinion: the lack of restrictions on the Apple API is unacceptable,
and if Apple are unwilling to do something about it then governments
should pass laws (or enforce existing laws) to make them to do so.

My opinion: it would be difficult for Apple to rapidly switch completely
to using an API more similar to Google's API, since this would remove
functionality from devices running old software. However they could
certainly aim to do this eventually, and there are steps they could take
immediately to improve the situation (e.g. rate limiting, and not
providing so many additional answers when asked about an individual
BSSID). I cannot see any obvious reason why they couldn't make
significant improvements almost immediately.