I hadn't realised that the wifi->address mapping was so publicly available. That means a list of wifi addresses that you've connected your phone to is also a location history. :(
(I'm still using a perfectly workable phone that is forever stuck on Android 5)
Installation
Download, install and activate the Xposed framework
Download, install and activate the XPrivacyLua moduleSo anyone in wireless range of you can 1) track you and recognize you again, and 2) possibly figure out where you work and live (although of course they may see your friends' wifi networks too and not be able to tell which is your network.)
There are retail analytics startups who literally use this exact type of data to allow brick and mortar stores to gain insights into their passive customer behavior. Source: I used to work for one of them and designed and built a bunch of the hardware / software stack.
I show this live when I do general security presentations. Live on stage with nothing more then a Raspi and a Wifi USB dongle.
It freaks people out to see there home, holiday, local bar, family in law and other historic SSIDs scroll by.
https://robertheaton.com/2019/01/15/a-brief-history-of-wi-fi...
Looks like more recent phones are better about this, but there are still a lot of older phones out there! And there are still leakages that allow tracking.
Note that with "real computers", just keeping the software up to date is enough to get you the latest in MAC randomization and whatnot; with phones, you may or may not be able to upgrade your software. -.-
It's real limited in what it does, but it can turn wifi / bluetooth / other stuff on depending on time, location, the usual stuff.
I would love to have a real "Tasker" type app for iOS, but I doubt that will happen anytime soon.
https://www.theguardian.com/technology/2010/may/15/google-ad...
There are no wifi hotspots around me so when I set up my old wifi (same ssid as before and same hardware (bssid)) and checked my phone on google maps it was saying that I still am at the old place because it had not GPS at the moment and then google maps checked the SSIDs around me and looked up where those are located
Was a very weird thing
I tried to check numbers on WiGLE but it's being painfully slow for me.
macchanger (I use a custom script that works better for me. Also does magic in places with limited interned, e.g. free 100MB limit)
But it won't help much if there are any other wifi networks or devices around.
For enhanced sneakiness, deploy three or more Wi-Fi base stations at the same location with the radios tx power turned right down and directional antennas - and try to make the geometry lookalike it's just a lucky long range shot to a real public/free wifi behind the antennas...
I just realized people can track my relocation across cities and countries if they can see "Ah this SSID was there last month, and here this month!".
SSID unique data is hashed into the password. If you use a very common name there will be a precomputed rainbow table that will make cracking much faster.
https://www.renderlab.net/projects/WPA-tables/
Ideally you would rotate your SSID regularly, but of couse that is a massive pain.
(Besides, it can be useful to treat your LAN as hostile, anyway, with rampant IOT and friends etc.)
It definitely seems like a good idea to put IOT things on a different subnet. I've not met a home router yet that allows me to put proper filters on devices. DD-WRT I guess. But there are so many patches which should be applied, I'm sceptical of old firmware for routers.
At the moment I have an embedded linux device with a wifi dongle and giant antennas. The modem box can probably still be hacked remotely (from the ISP), but at least I'm able to prevent any device on the network from talking to it and using some simple rebinding or XSS attack. (E.g.: https://www.gironsec.com/blog/2015/01/owning_modems_and_rout... http://www.routerpwn.com/ )
How quickly, really? I remember a while ago I had a discussion on here where someone told me a hash method was insecure, as you could crack it with a GPU. I downloaded hashcat, put in the hash of a 6 character string, and left it running overnight on a GTX1070 and it was still going.
A good GPU cracker rig will get 500k hashes/second per GPU. That is still very slow compared to the search space of a 12 character [a-z][A-Z][0-9][@#$_&-+*"':;!?~|{}%] password.
For a 6 character string, it still depends on what mask you are providing, or what the search space is, i.e are there requirements like one or more upper, 1 or more digits, or is it purely random from a RNG?
Still, if it isn't breaking it within a day I'd say you are in CPU mode, where a multicore box is still only 5k hashes/second.
(only honored by google, other OSs need different approaches)
https://krebsonsecurity.com/2015/07/windows-10-shares-your-w...
Our home SSID isn't there, but a neighbour's network is visible on the street outside and is listed.
1) It allows building alternative location providers that make it possible to have an Android device that doesn't rely on Google maps.
2) Publicizing the existences of these databases might make the general public more conscious of privacy and data protection issues involved.
2) That is like saying you go around kicking people in the crotch to make them more conscious about the benefits of learning self-defence.
Update:
> Google and other entities already have that data.
How is this an argument FOR gathering sensitive information about the people around you? Should you also look to their trash and digitise any documents they throw away and make a website that allows you to search through these documents? You could argue that Google or some other entity already has that information anyway.
You could also argue that this would increase consciousness with regards to the privacy concerns of your trash.
Of course, the likely outcome is that only big multinational corporations with a legal team are allowed to kick you in the crotch.
It's pretty much like leaving the front door unlocked -- it would be unethical to use it to go inside and steal your stuff but we still need to lock the door if we want to reduce the chance of someone stealing your stuff.
Tips for avoiding this:
- Change SSID at least once per year.
- If your router support multiple SSID's, turn the current one off and use the next one in the settings instead -- it will usually result in the MAC address being changed as well.
- Do the above whenever you move the router from one location to another.
Geocaching and trying to gather as much privacy sensitive information about the people around you are two different things. With geocaching there aren't any parties involved that are unaware of the activity who are still negatively impacted by it.