Hacker News Reader

Comment by vesinisa | Hacker News Reader

Yes you have in a sense. Your WiFi router is broadcasting its SSID and anyone in range can pick up this signal. If you do not wish to broadcast your SSID, you should disable it in your router.

What you are suggesting is to me no different than asking why a random passer-by can take a photo of your house. Because of course they can. Saying that a person can not take an image of your house unless you have explicitly put up a sign saying your house can be photographed is an absurd proposition and a sad privatization of the public sphere. The color of your house is not within the domain of your privacy, and neither is the location of your WiFi if you choose to broadcast your SSID.

View on HN

> If you do not wish to broadcast your SSID, you should disable it in your router.

Don't do that, it'll counter-intuitively have the opposite effect: if you disable broadcasting the SSID on your router, then all the clients (phones, laptops, etc) which wish to connect to it have to broadcast that SSID when searching for nearby access points, instead of just asking all nearby access points for their SSID. That is: disabling broadcasting the SSID on the router means requiring broadcasting that same SSID from all the clients, even (and especially) when they're nowhere near that router.

The solution is for all of us to rename our SSIDs the same (e.g., "Starbucks") and then let the WiFi device sort it out during the authentication step.

Except an average person can’t be expected to understand what “broadcasting an SSID” even means, compared to putting some numbers on your house that are required for essential services. It’s even doubly deceptive because then you need to understand the privacy implications of Google’s data capture, how it feeds into their ad business, etc. I understand all of this stuff but I don’t think it’s reasonable for people in general to, and I think people do have a “reasonable expectation of privacy” when it comes to their SSIDs. Nobody installs a router/AP and thinks “okay good, now Google can index my SSID”, they think “now I can securely connect my devices to my private network”.

(Just to be clear this is not a legal argument.)

They don't need to understand the technical details to realize that network names are public information if they have ever connected to a network in an urban setting, where you can always see your neighbors network names in addition to yours.

You realize that in Germany for example, most house are hidden in google street view ?

I know, and I don't think it makes sense. The cityscape should be in the public domain and for everyone to use, don't you agree?

I think we have fundamentally different opinions on what control you should be allowed to have on your privacy.

There is a similar debate about being photographed while in public: the fact that I'm walking in the street shouldn't allow anybody to take pictures of me, just because it has been decided that doing so would remove any "expectation of privacy".

That's my image. That's my house. If I don't want people to take picture of it and put in on the internet, it's my choice. And I don't think it is that unreasonable to want to control it.

I don't care about cityscape where the picture is taken from afar, where you can not discern any details of my house. But I don't want strangers to be able to see for example if I have dogs just by googling my address on internet.

It's not an unreasonable desire to want to control it, but you should also consider what it leads to when applied universally. For example, Street View is now almost completely disabled in Germany. I find it a beneficial public service and would be saddened if it was disabled in my country. Similarly, I could not publish a book in France whose cover is an image of the Louvre pyramid - this part of the public sphere has been rendered someone's intellectual property. Something that is seemingly public, inviting and free to use has been made in part private. Not good.

In a world where free public spaces are becoming increasingly rare, we should strive to retain and protect them rather than make everything private and controlled.

That being said, I do think the privacy of what is clearly and truly in the private sphere should be protected strongly – such as what goes on inside your house outside of what is directly and easily visible to the street. But there need to be just as strong rights to enjoy the virtues of the public sphere to counterbalance the strong protection of the private sphere.

> In a world where free public spaces are becoming increasingly rare, we should strive to retain and protect them rather than make everything private and controlled.

by empowering a private company to profit from what this person considers to be private?

By empowering anyone to make free use of what is clearly public. Private company building a service to show streetscape around world should be no different than me publishing photography I took around the city in my blog.

That sounds like a very different argument.

How come?

Not broadcasting your SSID doesn't offer any real privacy benefit. If you're using the wifi, every packet sent out by the AP or the clients includes the permanent (and usually unchangeable) hardware serial number (BSSID MAC) of the access point.

IP addresses are considered uniquely identifiable information under most (all?) GDPR jurisdictions. Pinpointed locations are also considered PII for obvious reasons.

I'd argue that by the same reasoning, SSID and MAC address are even more identifying, because IP addresses aren't as static as changing your WiFi configuration. Driving around and mapping this type of data should probably be considered a violation of the GDPR in the same way tracking the IP address of users visiting a website is.

I'm fairly certain you could make a claim against Google for processing this data without consent, without an immediate retraction (Google Streetview still lists 8 year old photos here) or opt-in.

Receiving data is fine, but processing it and mapping it out is not. In the same way, gathering IP addresses for logging and diagnostic purposes is okay, but selling "what IP accessed what page" is not. Taking a picture of your house from the street is not illegal, yet if I were to point a camera at your house that takes a picture every second so I can sell accounts for a premium "vesinisa's house stream" online, you'd probably get the police involved in its removal eventually. Intent matters as much as the actions themselves in most cases.

Reply on news.ycombinator.com