Hacker News Reader

Interesting point about `_nomap` which I wasn't aware of until now. See this page, under 'How do I opt out?' for details: https://support.google.com/nexus/answer/1725632?hl=en&visit_...

FWIW, Microsoft has a different string and yes, order matters IIRC.

FWIW: *_optout_nomap

=> https://www.reddit.com/r/privacy/comments/3g3xyu/for_wifi_ms...

When you use their service your forfeit your privacy.

You don't even need to use their services, interested crowdsourcers will map your router and help build a SSID:location database just for fun. https://www.wigle.net/

I seriously doubt most people even know whst "broadcast" means, or that "their" wifi is not limited to their own four walls and personal use.

Not knowing how it works doesn't change the fact that broadcasting the SSID is a key part of how wifi works. The only real solution is not to use wifi if you don't want it to be mapped.

"Ignorance is no excuse"? I mean, I don't know what the solution is if that's an allowable excuse. Google has to run PSA's on how WiFi works before they're allowed to scoop up SSIDs?

Additionally, I don't buy that to begin with, at least not as it concerns the majority. Where do folks think those other SSIDs (even if they don't call them that) in their list of networks come from?

Come on. There have to be some minimum standards of knowledge required for the citizens of a technological society, and I'd argue that "how radio works" is one of those things one should be expected to know.

   minimum standards of knowledge required for the citizens

Do you know how the electricity in your wall works? What about the plumbing under your house? Would you be able to fix those things on your own?

His argument was that you can reasonably expect people to know how to handle such technologies safely, not that he expects people to know how to build a WiFi Router from electronic parts themselves.

Using your analogy it would be sufficient for a person to know how to handle electricity coming from your wall or the plumbing under your house safely. And generally people do know how to do that.

Everyone who is regularly using WiFi networks knows that he/she can see the names of other WiFi networks in their vicinity. Therefore people using WiFi generally do know that this information is publicly broadcasted and available to be collected by anyone interested in doing so.

No one believes that he is the only person being able to somehow magically see the name of his neighbours WiFi.

I think the advanced users of HN vastly over-estimate the common sense level of the general public.

http://qz.com/333313/milliions-of-facebook-users-have-no-ide...

In third world countries people historically got to use Internet services much later, with more limited hardware and in also in a very different way. (not on a PC, instead on a feature phone with a very small screen) So it's not surprising that they have a different perception than we do.

Frankly I don't care for the matter at hand about the perception and understanding of the Internet that people from a different culture might have just as I do not care about the Saudi perspective on women's and LGBT rights. We are discussing here what should be the standard in our societies.

I think the 'advanced' users of HN vastly over-estimate the amount of information that the general public requires in order to apply common sense. As a member of the public, I have no real need to know about the protocols the Internet uses, or how Facebook and the Web are related, but it is useful to make a distinction between using Facebook (social interaction, sharing information actively, communicating with friends) and using the Internet (browsing Wikipedia, looking up recipes on Google, accessing Web sites on my laptop or tablet by myself) when communicating with others.

You don't?

Yes. Yes. No.

The level of IMO required knowledge I'm talking about here is to know e.g. that water in your faucet is distributed through the building via water pipes, and electricity comes through cables that are inside walls. Even this basic knowledge allows one to infer quite a lot.

This existed 15 years ago, called WiGLE.

> Fine, it's evil, append "_nomap" to your SSID string. That's fine for stopping Google,

This should be opt-in by default in sane universe, not opt-out.

I'd agree, if you mean broadcasting an SSID should be opt-in by default, but not if you mean having a publicly broadcast SSID be mapped should be opt-in by default separately from broadcasting the SSID.

OTOH, to the extent this is not true, its ISPs and router manufacturers who are at fault.

if broadcasting SSID was not on by default, mom and dad would be screaming at tech support that wifi isn't "working" on their phone because the network isn't in the list of discovered networks.

I've meant sharing the location of the SSID with $company should be opt-in. Who the fuck do they think they are?

> I've meant sharing the location of the SSID with $company should be opt-in.

Broadcasting is, inherently, sharing location with everyone with a receiver.

> Who the fuck do they think they are?

People with receivers (see above.)

Ok, but one thing is broadcasting something that has a limited reach then documenting and storing in various databases around the planet.

Cell towers, FM/AM radio towers, amateur radio repeaters are just a few things off the top of my head that have limited reach but are stored somewhere as key/value pairs with a lay/long with public access.

I don't know what to tell you other than "I don't like the way I feel about this" is not the basis of good policy.

So, then it’d also be legal if I stand near all schools, and photograph every child with a telezoom lens, follow each of them home, and then publish a website with photos of every child and where they live?

If they don’t want to be seen, they can just stop broadcasting their face and wear a burqa, right?

There is a huge difference between "publicly available in every case seperately" and "publicly indexable".

EDIT: Instead of downvoting, please leave a comment instead – do you disagree because you believe there’s a fundamental difference between gigahertz and terahertz light waves? Or is there another reason you disagree?

It is different because this behaviour fits a well know pattern of a certain type of criminal. The child molester.

There is no such established pattern where we can reasonably assume that a company collecting SSIDs will usually do this to act in a criminal way.

By the way I didn't down vote you, but I think this is the "common sense" reason why people reject your position.

Well, but it applies to every other such case, too.

You can't publicly index newspaper articles that are already decades old and irrelevant, you can't publicly index photos of buildings, you can't publicly index the names of people even.

Every of these things requires written approval of everyone listed, be it StreetView, the application of the Right to be Forgotten, or collecting WiFi SSIDs.

So the question is: why does everything require approval, except for SSIDs?

Does it? I didn't give written approval for the Google StreetView car to photography the front of my house. If I was to create a database of photographs of buildings, taken from a public location and indexed by street address, I don't believe I have to get permission, and the product could be released publicly, or even sold to estate agents or similar. I used to have to give the phone company written (or st least explicit) notice to opt out of their public index of numbers and names. So, it seems most things operate the same way as SSIDs, public information requires an opt-out to be available, not an opt-in.

Yes, that probably is a legal activity. However, someone could sue for a restraining order. After that, and possibly further lawsuits, that activity would become illegal for you.

The possibilities of human behavior are infinite. We don't need to and can't enumerate all possible bad behaviors as illegal. Thus the civil court system.

On the second thought, I think there's some law against publishing images of people without their consent in some circumstances. I'm not clear on exactly what is allowed, but I know that TV broadcasters post notices in places that they are filming.

> Yes, that probably is a legal activity. However, someone could sue for a restraining order.

A restraining order is issued for either actually illegal activity, or for activity whose legal status is in dispute, and which would irreparably negatively impact a party in the case in which it that status was in dispute, or for activity which might straddle the line of legality but which is related to a broader pattern of activity which was found to be illegal.

Its not done for specifically legal activity.

> The possibilities of human behavior are infinite. We don't need and can't enumerate all possible bad behaviors as illegal. Thus the civil court system.

The civil court system is for addressing things which are illegal -- violations of the law -- but which are not violation of criminal law. The civil court system applies those things prohibited in civil law, it does not substitute for having laws to determine what is prohibited.

No, a restraining order is issued when someone is performing actions that, taken individually, are legal - recording a link between an SSID and a street address, knocking on an ex-girlfriends door to ask them to talk to you, photographing a child - but when carried out systematically, constitute a pattern of behaviour that is undesirable, and by virtue of the order becomes illegal. Sometimes the pattern itself is also illegal, if it falls under harassment or stalking laws. Generally restraining orders prevent you from doing things that are otherwise legal, such as being within 50m of some person, or within 300m of a particular place or type of place, or sending a message, e-mail or similar to someone.

> No, a restraining order is issued when someone is performing actions that, taken individually, are legal - recording a link between an SSID and a street address, knocking on an ex-girlfriends door to ask them to talk to you, photographing a child - but when carried out systematically, constitute a pattern of behaviour that is undesirable, and by virtue of the order becomes illegal.

The subset of restraining orders (sometimes called "protective" orders) you are thinking of are available when something illegal has been done, and relate to patterns of activity related to that illegal thing. For California, there are several kinds [0] of such orders:

(1) Domestic Violence Restraining Order: available if someone close to you in specific ways defined in law has abused you in specific ways defined in law as acts of domestic violence.

(2) Elder or Dependent Adult Abuse Restraining Order: available if you are elderly or disabled and have been a victim of certain kinds of abuse.

(3) Civil Harassment Restraining Order: available if you are being harassed or stalked, etc., by someone not close enough to be covered by a domestic violence restraining order.

(4) Workplace Violence Restraining Order: available to an employer to protect an employee that has been a victim of stalking, harassment, violence, or serious threats.

Now, yes, they sometimes cover acts which would not otherwise be illegal, but they actual require something illegal to have happened as their basis (a temporary restraining order can be issued on the claim that such a thing has occurred, and a permanent restraining order only after a hearing to determine that.)

[0] http://www.courts.ca.gov/1260.htm

Would obsessive public surveillance not qualify as "stalking"?

In the scenario that kuschku suggested, taking a photo of each child and following them home to record the location (once) would probably not count as stalking IMO but its difficult to say. In the UK it has to happen twice, according to Wikipedia

https://en.wikipedia.org/wiki/Stalking

Others have explained it, but I downvoted without comment because, to paraphrase Jules in Pulp Fiction: "that's not only not in the same ballpark, it's not even the same fuckin' sport." I wouldn't know how to comment beyond that. (That, and your "think of the children" didn't help.)

Then assume I'm talking about photographing every building and putting a list of that online. Also illegal.

Or putting video surveillance up in public spaces. Also illegal, even for the government.

Or whatever.

Collect the router mac and BSSID? Possibly justifiable. That's like making a map where phone numbers are, physically.

But collecting the SSID?

Looking at the wifi list, I see "Meier family WiFi" and "Meier WiFi upper floor: Finn & Jan" (that's their children, having both the room on the upper floor, and family protection filters enabled for that WiFi).

I see WiFi names that are identifiable, somes that have a little poetry in them, others named as the favourite football club of their owners.

That's creative work and PII.

> Then assume I'm talking about photographing every building and putting a list of that online. Also illegal.

How is that illegal? That's called a map.

I down voted and left a comment.

Appealing to child stalking as a way to emotionally charge your argument about radio reception is a disingenuous tactic for this conversation. What's more, people who actually work to promote and secure a safer environment for kids don't need people like you constantly exacerbating parental paranoia with a constant back chatter stranger danger.

Please refrain from emotionally manipulative rhetoric.

Then assume I'm talking about taking a picture of every living room through the window whenever no one is there.

Or anything else that's that personal.

The point isn't about what is collected, but that this type of broad data collection exists in the first place.

Let's recap: not eventhe government can do video surveillance of public places, streetview became opt in, the phone book is opt in.

But Google collects SSIDs?

Collecting only the router mac or BSSID might possibly be justifiable, because it's just a map of technical data, but collecting a string where people but creative works in, or names, or jokes?

I've seen families where the WiFi for the first floor had another name than that for the ground floor — specifically, the names of their two children, whose room was on first floor.

Collecting such PII can be problematic.

> Then assume I'm talking about taking a picture of every living room through the window whenever no one is there.

No. That's not my job to arbitrarily re-interpret what you said to give you a free pass for your disingenuous rhetoric.

> Let's recap: not eventhe government can do video surveillance of public places, streetview became opt in, the phone book is opt in.

The government CAN do video surveillance though. Both our governments do it. What varies is how its deployed and who has access.

> Collecting only the router mac or BSSID might possibly be justifiable, because it's just a map of technical data, but collecting a string where people but creative works in, or names, or jokes?

Look, responsibility has to be exercised in all forms of data collection. But it's also the case that the light that shines out of your house is subject to public interpretation. Standing nude in your window facing a crowded street CAN be illegal in both our countries, as could placing a sign that says threatening things to passerbys. The trigger conditions for this vary between our countries, but they exist in both cases.

> Collecting such PII can be problematic.

COLLECTING PII is seldom the problem. Storing it or promptly and thoroughly deleting it is the challenge. You might argue that you shouldn't have collected it in the first place, and maybe that's true. But given the modern world where we have a rapidly expanding frontier of data analytics, it's actually difficult for real (re: not rhetorical trashbag arguments on HackerNews) people. Often times it's not obvious what PII is until later.

For example, there are people who claim that transactional data can be "anonymized". Do not believe these people; it is nearly impossible to anonymize transactional data. Even mixing users and attempting to delocalize vendor strings will not fix the problems.

> The government CAN do video surveillance though. Both our governments do it. What varies is how its deployed and who has access.

But they literally can not at any point ever do it. Video surveillance of public space is a crime, even for the police, government, or security agencies, and it does not happen.

> COLLECTING PII is seldom the problem. Storing it or promptly and thoroughly deleting it is the challenge. You might argue that you shouldn't have collected it in the first place, and maybe that's true. But given the modern world where we have a rapidly expanding frontier of data analytics, it's actually difficult for real (re: not rhetorical trashbag arguments on HackerNews) people. Often times it's not obvious what PII is until later.

The law literally makes that a crime. You have to stop collection of PII, not just delete it at any later point.

> But they literally can not at any point ever do it. Video surveillance of public space is a crime, even for the police, government, or security agencies, and it does not happen.

Surveillance of public environments via the private security systems is how your government (and ours really) accomplishes this "legally."

> The law literally makes that a crime. You have to stop collection of PII, not just delete it at any later point.

The law's definition of PII in your country is woefully out of date. Same in mine.

What do you think of high-resolution satellite imagery? Do you imagine that a satellite operator needs to get opt-in consent from anyone who happened to be looking up at the sky at the moment of the photograph?

I don't understand the down votes here, this is a sound analogy to me.

I wouldn't be surprised if there were in fact laws against this kind of public surveillance behavior in some jurisdictions in the United States.