Hacker News Reader

Comment by anonymouse008 | Hacker News Reader

You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola!

I wouldn't throw the elder person under the bus on this one, the tactics are sophisticated, and honestly, just a precursor to what will happen with AR.

To give a bit more of how it's implemented (at least how I would propose it in iOS), Insta/FB/Whats queries available wifi SSIDs as a background process (or whatever they have for notifications/networking etc), and does the same to your therapist since you both have insta / fb / whats ... and based on the signal strength, can say with confidence you two were in the same room because XYZ Wifi strength is -Xdb just like yours (walls are strong signal augmenters), and you are both there for some time based on the background thread timestamp.

View on HN

haha, that's a good point, but in this case I think it's more trivial than that: she probably shared her contact book with FB or Insta (still, not her fault imho).

But, at the same time I've worked with FB SDK which was just one big shit show. It's hard even to describe it without turning a comment into an essay, so I'll pick the two I found somewhat amusing: sending data to FB before the developer could pass user consent (or thereof), sending hashes of the (non-FB) libraries installed on your phone to FB servers.

Minor tangent: The best thing about the web is that user agents are still pretty good at fighting some of the tracking practices (ETP/ITP, cross origin security, etc...). It's actually quite impressive. Then, native is just one big black hole. This is why the current browser changes, although positive overall (less $$ from 3p tracking), are a double edged sword (pushing people towards walled gardens).

It’s almost certainly just the phone number. Recently Instagram told me that a former business partner of mine had joined and I was surprised to learn that his account was an hair braiding service in Atlanta for women with African lineage (we’re both Canadian men with European ancestors). We figured out that years ago we had taken a business trip there and picked up temporary SIM cards back when Canadian cell phone plans charged injurious roaming fees. I still had that phone number in my contacts for him when I joined Instagram, and it had finally been recycled and used to create an account.

It’s a cool thought experiment for nerds and paranoiacs to imagine how you might use relative wi-fi strengths, bluetooth beacons and complex interaction patterns, but it’s less sophisticated than that.

Yeah, my first thought reading the parent comment was two words: "Occam's razor". But, I still find it amusing that companies like FB want to project the image of "informed consent" whereas we have a bunch of developers here trying to figure out what the hell happened and coming up with plausible solutions.

What's interesting thought (and I know that from my professional experience in ad tech) is that the "cookiegeddon" did push companies towards non-deterministic, more fuzzy ways of cross-device targeting (and we're talking about people who already think that fingerprinting is ethical).

The upside is that metrics are mostly bullshit anyway.

> It’s a cool thought experiment for nerds and paranoiacs to imagine how you might use relative wi-fi strengths

I'm honored to be called a nerd on HN... I'll ignore the latter ;)

Though while I agree the phone number is absolutely used, I don't think it's the only. Trying to get out ahead of the public's changing privacy tastes is a must for any advertiser that collects social-graph-like data. So strategically, if FB is not doing this, I would pull any FB investments because they aren't trying to do their job.

> It's almost certainly this one thing, and not the other thing.

No, they dragnet every possible identifier and dump everything into a pattern recognizer.

is it even legal for a therapist to share their clients contact details with a third party?

certainly I would expect that a person who works as a therapist would be aware that the concept of client confidentiality exists and that they should not share their clients details

It's not like Facebook is being transparent with what data they collect and how it's going to be used. Furthermore they don't understand the concept of "no" and will keep asking, hoping to catch you off-guard as you press the wrong button and give them access.

>You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola!

The problem is that someone decided to correlate them, not to mention without asking.

It is possible to opt-out of Google's Wi-Fi network location mapping by appending "_nomap" to SSID[1], I'm not sure if it works with other providers. Although I think this should have been opt-in instead of opt-out, the least we deserve is a standard, guaranteed way to universally opt-out.

[1] https://www.tomshardware.com/news/Google-Maps-Wi-Fi-Location...

Why it's always us who have to do the work to avoid being harassed by google? If I don't want to have my site harvested for snippets I have to add a no-snippet tag. If I don't want my WiFi data harvested I have to append an ugly nomap to my SSID. What about being it opt-in, as you said? I'm tired of doing Google's dirty work...

By the way, quoting from the article:

> "Specifically, this approach helps protect against others opting out your access point without your permission."

Oh, thank you for your kindness, Google. Yes, the idea of another person denying me the joy of having my WiFi data harvested by you is terrifying. Thanks, Google. You really know how to be helpful...

Especially because Google mapping your WiFi comes with real downsides for you. Two years ago a random stranger rung my doorbell and told me their Android phone got stolen and according to Find My Device, the device was inside my house and even showed it to me live. I told them to wait on the street and checked the roof and yard, but didn't find the device. I simply told them I can't help further and they luckily took it well, thanked me and left. Imagine how easily such a situation can get ugly though. A day or so later i realized that my Wifi router happens to be at an oddly open corner of my house, facing the backyard, and visible for much further than you'd expect since there are also no other structures for quite a distance. I bet his phone was somewhere there but saw my WiFi and so it erroneously located itself in my house. Thanks Google!

That's ridiculous, IMO. This is also confirmed by Google's support document on this feature: https://support.google.com/maps/answer/1725632?hl=en#zippy=%...

Changing one's SSID after the fact can be extremely annoying depending on the number of devices that need to be updated.

There has to be a better way.

This isn't relevant - we're not talking about building a map of SSID to location, we're talking about using SSIDs to infer relationships between people; the SSIDs don't even have to be in any kind of location DB for that, what allowed Facebook to infer this relationship is that both the author's and their therapist's device regularly saw the same SSIDs.

> You do know how this happened right? Wifi SSIDs with similar strengths reveal if people are in the same area, then just correlate timestamps and viola!

I mean yeah, they _could_ do that, but thats a pain in the arse to do. Its far easier to do it on contact lists, interests and implied location from business page follows.

I don't think iOS allows you to track SSIDs, which explains the lack of wifi scanning utilities in the app store.

WiFi SSIDs have one very nice attribute - they tend not to move around much.

So every time you see a Google maps car ( or a Nuro car or a ...), your SSID is getting geomapped.

Now, your IP, SSID, geolocation, and who knows what else is now sitting in a lookup table somewhere.

So if they get all the other stuff that you just mentioned, they now know more about you than you do!

> and viola

I love this typo.

> Then they query the adjacent SSIDs and their signal strength in a background thread, and bam, Viola is your aunt, all your privacy is violated!

I could play Hot Cross Buns on this typo.

Phone GPS already uses Wifi for improved accuracy. So if fb has location access permissions it already does this for them implicitly.

Are apps allowed to do that on iOS? I can’t think of any good reason besides for a wifi diagnostic app.

Not sure why you're suggesting shenanigans like wifi SSID tricks (and others jumping the bandwagon), when the actual thing that happened here is obvious:

GP visited their therapist's website, the website had FB/IG advertising tracker installed, the therapist had a campaign running that targeted all visitors from their site.

I appreciate that idea, however, I've been testing my own 'friend suggestions' and keep a strong track of my antics... also, it's become a hobby of mine to debunk each time someone says 'they're listening to my microphone!!!'

Most of the time the 'listening to me' conversations are based on origin IP to insta/fb/whatsapp servers. One person talks about idea X, another person looks it up (either in the room or later at home by themselves), and now everyone who was at that IP together will get ads for X.

What's more, Google maps uses Wifi SSIDs to get better location data when GPS gets a bit spotty... so, I'd venture to say it's a small step to associate accounts and make friends.

Reply on news.ycombinator.com