Hacker News Reader

Comment by jventura | Hacker News Reader

Why should I have to change my AP's name to opt out, since I've never opted in?

Most of the replies to you seem to be focused on the relatively uninteresting individual act of recording the location of your publicly broadcast SSID.

But the issue arises from the fact that this is done in bulk and is comprehensively catalogued centrally. I think that commenting on a person photographing your house misses the point, because the scale is the thing that matters here. It's not the individual act of recording your SSID, but the scale of doing it in bulk that transforms this activity into something that is unlike photographing your neighbor's house.

Street view is pictures of houses taken at scale and comprehensively catalogued centrally. Most people don't seem to have an issue with that.

I notice that you said "most" and so you might be technically correct, but you can accurately make out Germany on a map of google streetview availability, because enough people did have an issue with it when it was first introduced.

I think Street View is a perfect parallel example. In both cases, the scale and centralization are key.

For Street View, you can opt yourself out by telling Google: https://www.forbes.com/sites/zakdoffman/2020/09/27/how-to-hi...

Whereas for the WiFi map, you apparently have to opt yourself out by changing your SSID.

The difference is that the wifi opt out method is perfect since they can trust that the person with control of the router's SSID is actually opting out when it receives that list.

Yes you have in a sense. Your WiFi router is broadcasting its SSID and anyone in range can pick up this signal. If you do not wish to broadcast your SSID, you should disable it in your router.

What you are suggesting is to me no different than asking why a random passer-by can take a photo of your house. Because of course they can. Saying that a person can not take an image of your house unless you have explicitly put up a sign saying your house can be photographed is an absurd proposition and a sad privatization of the public sphere. The color of your house is not within the domain of your privacy, and neither is the location of your WiFi if you choose to broadcast your SSID.

> If you do not wish to broadcast your SSID, you should disable it in your router.

Don't do that, it'll counter-intuitively have the opposite effect: if you disable broadcasting the SSID on your router, then all the clients (phones, laptops, etc) which wish to connect to it have to broadcast that SSID when searching for nearby access points, instead of just asking all nearby access points for their SSID. That is: disabling broadcasting the SSID on the router means requiring broadcasting that same SSID from all the clients, even (and especially) when they're nowhere near that router.

The solution is for all of us to rename our SSIDs the same (e.g., "Starbucks") and then let the WiFi device sort it out during the authentication step.

Except an average person can’t be expected to understand what “broadcasting an SSID” even means, compared to putting some numbers on your house that are required for essential services. It’s even doubly deceptive because then you need to understand the privacy implications of Google’s data capture, how it feeds into their ad business, etc. I understand all of this stuff but I don’t think it’s reasonable for people in general to, and I think people do have a “reasonable expectation of privacy” when it comes to their SSIDs. Nobody installs a router/AP and thinks “okay good, now Google can index my SSID”, they think “now I can securely connect my devices to my private network”.

(Just to be clear this is not a legal argument.)

They don't need to understand the technical details to realize that network names are public information if they have ever connected to a network in an urban setting, where you can always see your neighbors network names in addition to yours.

You realize that in Germany for example, most house are hidden in google street view ?

I know, and I don't think it makes sense. The cityscape should be in the public domain and for everyone to use, don't you agree?

I think we have fundamentally different opinions on what control you should be allowed to have on your privacy.

There is a similar debate about being photographed while in public: the fact that I'm walking in the street shouldn't allow anybody to take pictures of me, just because it has been decided that doing so would remove any "expectation of privacy".

That's my image. That's my house. If I don't want people to take picture of it and put in on the internet, it's my choice. And I don't think it is that unreasonable to want to control it.

I don't care about cityscape where the picture is taken from afar, where you can not discern any details of my house. But I don't want strangers to be able to see for example if I have dogs just by googling my address on internet.

It's not an unreasonable desire to want to control it, but you should also consider what it leads to when applied universally. For example, Street View is now almost completely disabled in Germany. I find it a beneficial public service and would be saddened if it was disabled in my country. Similarly, I could not publish a book in France whose cover is an image of the Louvre pyramid - this part of the public sphere has been rendered someone's intellectual property. Something that is seemingly public, inviting and free to use has been made in part private. Not good.

In a world where free public spaces are becoming increasingly rare, we should strive to retain and protect them rather than make everything private and controlled.

That being said, I do think the privacy of what is clearly and truly in the private sphere should be protected strongly – such as what goes on inside your house outside of what is directly and easily visible to the street. But there need to be just as strong rights to enjoy the virtues of the public sphere to counterbalance the strong protection of the private sphere.

> In a world where free public spaces are becoming increasingly rare, we should strive to retain and protect them rather than make everything private and controlled.

by empowering a private company to profit from what this person considers to be private?

By empowering anyone to make free use of what is clearly public. Private company building a service to show streetscape around world should be no different than me publishing photography I took around the city in my blog.

That sounds like a very different argument.

How come?

Not broadcasting your SSID doesn't offer any real privacy benefit. If you're using the wifi, every packet sent out by the AP or the clients includes the permanent (and usually unchangeable) hardware serial number (BSSID MAC) of the access point.

IP addresses are considered uniquely identifiable information under most (all?) GDPR jurisdictions. Pinpointed locations are also considered PII for obvious reasons.

I'd argue that by the same reasoning, SSID and MAC address are even more identifying, because IP addresses aren't as static as changing your WiFi configuration. Driving around and mapping this type of data should probably be considered a violation of the GDPR in the same way tracking the IP address of users visiting a website is.

I'm fairly certain you could make a claim against Google for processing this data without consent, without an immediate retraction (Google Streetview still lists 8 year old photos here) or opt-in.

Receiving data is fine, but processing it and mapping it out is not. In the same way, gathering IP addresses for logging and diagnostic purposes is okay, but selling "what IP accessed what page" is not. Taking a picture of your house from the street is not illegal, yet if I were to point a camera at your house that takes a picture every second so I can sell accounts for a premium "vesinisa's house stream" online, you'd probably get the police involved in its removal eventually. Intent matters as much as the actions themselves in most cases.

You opted in by broadcasting to anyone that cares to listen.

I feel like I’m missing something when folks complain that someone geotagged the publicly-viewable SSID that their router, by the owner’s choice, shouts to anyone that will listen. And then act like it’s this big privacy invasion when someone does listen.

This is just another instance of the same old discussion. Many things are perfectly okay on an individual basis. E.g. individual citizens can see my license plate, and this is fine. But when it gets correlated into a picture that effectively tracks where I go, now we're talking about something different entirely.

I agree and think it's weird how often I see variations of that general argument here; where someone says, "Normal thing A is fine, therefore it must be fine if we scale it by a factor of 100,000,000". Scale matters!

where someone says, "Normal thing A is fine, therefore it must be fine if we scale it by a factor of 100,000,000"

Why are we to assume that it isn't fine just because there's more of it?

Scale matters!

For all the "scale matters!" in this topic, no one seems to be able to articulate why. Were laws broken? Hell, were unspoken rules broken? What is $BAD_THING that will happen if $X "at scale!"? But instead what I read are broken analogies that don't stand up to scrutiny.

The fallacy isn't that scale is inherently bad or anything but that scale can change the fundamental nature of what a thing is and so they're not always able to be substituted.

* If I kill an Armenian it's murder, if I kill every Armenian it's genocide.

* If I buy some shares of Google it's investing, if I buy every share of Google it's a takeover.

* If I happen to know where you are because a saw you in town it's a coincidence. If I know where you are 24/7 it's surveillance.

* If a friend sends my address to someone it's no big deal. If they post my address publicly it's doxxing.

The logic "if I can X at some scale then I can do X at any scale" doesn't follow because doing X at different scales might be totally different things. I don't think Google slurping up SSIDs is going to make $bad_thing happen but the justification for them doing the sluping is more complicated than "well it's fine if I wrote down one SSID..."

How does recording the approximate location of SSID broadcasts "track where I go"?

It does not. If you will please re-read what I wrote, you will see an analogy.

Reframe the question as why you have a right to shout your access point's name constantly, but you can force other people to not remember.

But I'm not shouting it out, I'm only saying it loud enough to hear in my house unless you're using a really sensitive receiver pointed at my windows.

You are definitely saying it loud enough to reach outside your house. If you aren't, then you don't have to worry about Google because they wouldn't be able to reach it.

I don't intend for it to go outside of my house. I have not placed any access points in locations designed to make the signal reachable outside my own home. I expect that at some points near the perimeter of my property, passerby may detect the existence of my WiFi network. I expect them to politely ignore it and move on, just like I expect them to pay no mind to normal everyday sounds coming from inside my home.

It becomes a different issue when a corporation collects this information for business purposes. They are not random passersby. But I expect them to treat it with the same courtesy -- ignore, move on.

This is a clear case of unintended consequences? https://en.wikipedia.org/wiki/Unintended_consequences

If you care about this, the burden is on you to make sure the signal does not go outside of your house or to make our wifi work in private mode (probably easiest solution). Google is simply taking advantage of what is essentially public information, they are doing it at scale and this should not be problematic at all.

We need to understand that when we live in a technologically advanced civilization (sufficiently advanced as to have Google cars driving around) there are some things we will have to give up as a part of enabling the technologically advanced environment that we chose to live in.

What we would have a problem with is not collecting then, but the way it is being used. A reasonable way to handle this for Google would be: rather than having a SSID opt out, have ad-tech opt-in as in 'we can optimize our ads based on your detected wifi location, would you like that?' Meaning: yes, it's fine that you collect publicly available information at scale, but if you want to use it for me (or against me, depending on your view), you have to ask me. Otherwise it would be violating my right to privacy.

> private mode (probably easiest solution)

There is no such thing. I have no problem finding the SSID for "hidden" networks.

> they are doing it at scale and this should not be problematic at all.

In fact it is my entire point that this is extremely problematic. Technology enables a whole new range of behavior not previously feasible, and society hasn't yet developed a way to deal with it. Just because Google can do something it does not mean they should do it.

> yes, it's fine that you collect publicly available information at scale, but if you want to use it for me (or against me, depending on your view), you have to ask me. Otherwise it would be violating my right to privacy.

I disagree. The existence of the aggregated data on me is itself the risk, itself the violation of privacy, not the moment when they leverage it for a particular purpose. This data aggregation is dangerous and needs to be regulated.

I do not believe in a utopian corporate world where everything Google does is for my benefit.

> There is no such thing. I have no problem finding the SSID for "hidden" networks.

Yes I meant hidden networks, and I didn't know they were discoverable. Really? Why are are they called hidden then?

> The existence of the aggregated data on me is itself the risk, itself the violation of privacy

Yes it is a risk, but it is not in itself a violation of privacy. I think you are conflating secrecy and privacy a bit here.

You parents or close family posses a lot of private information about you and the very act of possession is not violation of privacy (but it does pose a risk that you have to live with, hoping and expecting they will respect your privacy).

Violation of privacy occurs at the moment this information is used in a way you would not approve.

  Anonymity - you do not know about me
  Secrecy - I do not want to share information with you
  Privacy - I am OK to share my information with you and I trust you to not use it in a way that I would not approve of

Do you expect there to be legal recourse when someone does not treat you with the courtesy you prefer?

If it is a business snooping around my house to collect data about me, then yes, absolutely.

Until your friend with the Android phone comes over to hang out, and then boom, Google's got it.

Reply on news.ycombinator.com