Hacker News Reader

Comment by notriddle | Hacker News Reader

It doesn't seem hard to understand. They figured that SSIDs aren't private information, so having any method of opting-out at all is just a courtesy.

View on HN

SSIDs aren't private information, but it does seem like the natural privacy of scale should apply. I'm ok with people who are nearby being aware of my SSID... does that mean it should be ok for Google to collect millions of SSIDs to use in a profit-generating positioning database?

It seems like it should fall under a regulation similar to photographs. You can take photos of me in a public place and do whatever you want with them until you're using my likeness in a commercial capacity... then you need to ask me first. Opt-out isn't enough, it needs to be opt-in. If that doesn't work for your business then too bad.

Your "SSID privacy" is at risk regardless of whether Google collects information or not: https://wigle.net/

In the end, asking people to please not snoop on you never has and never will be a security measure that works. You need something tangible to protect your privacy, so as to make it virtually impossible.

We already have this. Every modern mobile OS gates the SSID API behind location permissions.

Given such protections, practically speaking, there isn't any problem with SSID being bound to location information.

I'm not asking people to stop snooping. I'm asking for corporations to be barred from profiting off of publicly accessible information that can personally identify me without asking for permission first.

Education, journalism, research and the like fall into a different category... this also applies in the "photographs of people in public spaces" example. WiGLE would still exist in that niche.

How can a SSID:GPS database personally identify you? Give an example, please?

By that definition, IP addresses are also public information. It’s not about the SSID or IP itself, it’s about it being connected to an individual.

Its one of those cases where data becomes dangerous when there's enough of it.

Google knows practically every SSID location in the developed world. Now your Android phone browsing and mapping every SSID it sees as you move about is a reliable "Location mapping" of the user even though they may have no GPS or have it disabled.

You can map a person's movement through cities/towns just based on the SSIDs their device(s) saw as they moved about.

You say that like it’s always a bad thing, but sometimes we actually do want to use our phones to find out our location, and GPS is often slow or doesn’t always work.

The issue here is having control over when your phone looks up your location, not the existence of a database that makes it work.

The existence of that database under the control of a surveillance company is the problem. If Google published the dataset so that many others could use it freely, then they would have an argument that they're just promulgating public data. However, by keeping it to themselves and forcing queries to go through Google (with a bunch of fine print attached), they're agglomerating personal data for their own private purpose.

There are open, crowd-driven databases like Wigle with over 10 billion SSID observations.

I just don't see why this is a problem when apps can't even access your SSID without a location permission.

Isn't that just what companies are all about? Anyone can do it if they want, (it's not like Google has a State defined monopoly), it's just that it isn't worth it to others.

If you want everyone to have that data publicly then have your government do it...

The point is to weigh whether the mass collection of personal data is justified. The reason why it is being done matters - if the data is easy to collect and is merely being format shifted by a curious person, then there clearly isn't much of a barrier to anyone doing the same. Meanwhile a company investing a significant amount to create a proprietary database for their own purposes has much different incentives - cf Google's sorry excuse for an opt out. Furthermore, a published dataset is transparent in that it allows individuals to see exactly what data has been collected about them, act to remove themselves, complain politically, etc, whereas most people will never become aware of the proprietary database.

They're adding value to the public data by organizing into that location search.

I'd think it similar to a journalist reporting on a story. Its public, butthe value they add is private

But in this case (wifi based positioning) it is not at all about tying the SSID to an individual. It's the equivalence of some of us walking around noting SSIDs, and their locations, and some of us saying "can you tell me where I am? I'm currently seeing wifi1, wifi3 and wifi11". Basically mapping part of the global frequency spectrum.

"If you haven't done anything wrong you have nothing to worry about."

It really isn't a privacy risk when the SSID isn't accessible to apps and services without a location permission. (Unless you are putting PII in your SSID itself, of course, in which case, yeah, no one can help.)

SSID are PII, for sure. Its easy to geolocate the AP to a few meters. The fact the information is publicly available (when within physical vicinity) does not make it less so.

Wigle also has opt-out.

At one point they went way farther than that, cracking WEP, etc.:

https://www.theatlantic.com/technology/archive/2012/05/googl...

Reply on news.ycombinator.com