From Newsgroup: alt.internet.wireless


Help!
How do we get Apple to care about privacy for entities who own APs?
i. People
ii. Companies
iii. Governments
Basically, everyone in the world is affected by Apple's WPS privacy policy
not being respected by Apple and by Apple's highly insecure WPS structure.

Here are the facts as documented by independent researchers:

Apple's WPS implementation has been described as highly insecure.
It behaves differently from standard WPS implementations.
Researchers have shown that anyone can collect Apple's entire WPS database.
<https://krebsonsecurity.com/2024/05/why-your-wi-fi-router-doubles-as-an-apple-airtag/>

Because of those claims, I tested the situation myself:

a. I modified publicly available open-source code
and confirmed the researchers' findings.
<https://github.com/darkosancanin/apple_bssid_locator>

b. I located my own BSSID-despite using the _nomap suffix-in Apple's
WPS database.
<https://wavedigger.networksurvey.app/?tab=bssid&bssid=00-22-3f-a5-7b-33>

c. Mozilla, for example, says they'll honor the hidden SSID or the _nomap.
<https://en.wikipedia.org/wiki/Mozilla_Location_Service>
"Mozilla's client applications do not collect information
about WiFi access points whose SSID is hidden or ends with
the string '_nomap' (e.g. 'Simpson-family-wifi_nomap')."

But not Apple.

A. Apple has stated in writing to me that they do not intend to respect
the opt-out flag even as it is clearly Apple's published privacy policy:
<https://support.apple.com/en-us/102515>
"The owner of a Wi-Fi access point can opt it out of
Apple's Location Services iX which prevents its location
from being sent to Apple to include in Apple's crowd-sourced
location database iX by changing the access point's SSID (name)
to end with '_nomap.' For example, 'Access_Point' would be
changed to 'Access_Point_nomap.'"

B. Google also documents the use of "_nomap" suffix to opt out:
<https://support.google.com/maps/answer/1725632>
"To opt out, change the SSID (name) of your Wi-Fi access point
(your wireless network name) so that it ends with '_nomap.'
For example, if your SSID is '12345,' you would change it
to '12345_nomap.'"

C. What's different is Google's WPS doesn't make the entire database
available to everyone (including me!) in the with no oversight!
*Surveilling the Masses with Wi-Fi-Based Positioning Systems*
<https://par.nsf.gov/servlets/purl/10540853>

Those points are factual and easily verifiable.

My view is that keeping millions of access points in an insecure, globally accessible database, especially when the owners have opted out following Apple's own privacy policy, is legally, morally & ethically dead wrong.

Apple's recent written response to me only reinforces that privacy concern.

I need help though, from the users, in how to make Apple change the policy
to be privacy friendly since this action by Apple (of not respecting users'
opt out wishes and making the database available to everyone in the world
with no restrictions) is the antithesis of what Apple "says" they stand
for.

Any ideas to get Apple to do what they say they do when it comes to
supporting consumer, corporate and government privacy?
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.internet.wireless

Any ideas to get Apple to do what they say they do when it comes to supporting consumer, corporate and government privacy?

I need to build isolated Wi-Fi environments whose only purpose is to
broadcast (or hide) SSIDs by following Apple's own published legally
binding privacy rules so we can observe how Apple's WPS system behaves.

I have a friend at Google in the Silicon Valley who is willing to help
prove what Apple is doing using a simple test using 3 old spare routers.

How does this look for a checklist to set up those routers for the test?

APPLE WPS / SSID PRIVACY TEST
ASCII CONFIGURATION CHECKLIST ----------------------------------------------------------------------

GENERAL SETTINGS FOR ALL THREE ROUTERS
[ ] Set to "AP" mode (not router, not gateway)
[ ] Disable WAN connection
[ ] Disable DHCP server
[ ] Disable DNSMasq
[ ] Disable DHCP-Authoritative
[ ] Disable Local DNS
[ ] Set Gateway to 192.168.1.1
[ ] Set Local DNS to 192.168.1.1
[ ] WPA2-Personal, AES/CCMP only
[ ] Channel width: 20 MHz
[ ] Save (not Apply) after each section
[ ] Apply once at the end

----------------------------------------------------------------------

ROUTER 1: BROADCAST / PUBLIC
Router name: broadcast-public
Hardware: WRT54G v5 (Linksys)
Firmware: Stock Linksys v1.02.8
IP address: 192.168.1.128 (Macintosh 128K was the first Macintosh)
SSID: AppleWPS.broadcast.public
Channel: 1
DHCP: Disabled
Notes: Baseline consumer router, no _nomap

----------------------------------------------------------------------

ROUTER 2: BROADCAST / PRIVATE / NOMAP
Router name: broadcast-private-nomap
Hardware: WRT54G v8.1 (Linksys)
Firmware: DD-WRT v24 RC-7 (03/19/08) micro
IP address: 192.168.1.129
SSID: AppleWPS.broadcast.private_nomap
Channel: 6
DHCP: Disabled
Notes: Broadcast SSID, opted out via _nomap

----------------------------------------------------------------------

ROUTER 3: HIDDEN / PRIVATE / NOMAP
Router name: hidden-private-nomap
Hardware: WNR834B v2 (Netgear)
Firmware: DD-WRT v3.0-r51937 mini (03/05/23)
IP address: 192.168.1.130
SSID: AppleWPS.hidden.private_nomap
Channel: 11
DHCP: Disabled
Notes: Hidden SSID, opted out via _nomap

----------------------------------------------------------------------

POST-CONFIGURATION TEST STEPS
[ ] Verify all 3 APs appear in a Wi-Fi scan (hidden one as "hidden")
[ ] Verify channels 1, 6, 11 are correct
[ ] Verify no router is issuing DHCP leases
[ ] Verify each AP responds to ping at its static IP
[ ] Move APs to a new location
[ ] Wait for Apple devices in the area to upload Wi-Fi scans
[ ] Query Apple's location database (via any Apple device)
[ ] Observe that all three APs appear at the new location
[ ] Observe that _nomap did not prevent tracking
[ ] Document timestamps and movement history

----------------------------------------------------------------------
When I leave the routers in one location, and then move to the next
location, I expect the following based on my prior tests of Apple's WPS.

EXPECTED OUTCOME
Apple's WPS will not track:
- broadcast.private_nomap
But Apple's WPS will forever track:
- broadcast.public
- hidden.private_nomap

Even though Apple claims:
"_nomap prevents inclusion in Apple's crowd-sourced location database."

----------------------------------------------------------------------
How does this look for a checklist to set up the 3 old spare routers
to prove how Apple's WPS is poorly designed as per what independent
security researchers have explained in the recently cited references? ----------------------------------------------------------------------
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.internet.wireless

Marian wrote:

How does this look for a checklist to set up the 3 old spare routers
to prove how Apple's WPS is poorly designed as per what independent
security researchers have explained in the recently cited references?

OK. I ran into 32-character SSID limitations, and DD-WRT had issues
with dashes in router names, but how's this setup look for the test?

TEST PLAN: Apple WPS / SSID Privacy / _nomap Behavior ----------------------------------------------------------------------

Each AP will be set up to test proper opt-out directives Apple publishes:
https://support.apple.com/en-us/102515
"The owner of a Wi-Fi access point can opt it out of
Apple's Location Services -- which prevents its location
from being sent to Apple to include in Apple's crowd-sourced
location database -- by changing the access point's SSID (name)
to end with '_nomap.' For example, 'Access_Point' would be
changed to 'Access_Point_nomap.'"

Goal:
Demonstrate that anyone in the world can see when and where
these APs move, even when opted out, and that Apple does not
follow its own published privacy policy.

----------------------------------------------------------------------
SSID STRUCTURE ----------------------------------------------------------------------

SSID format (fits 32-char limit):
<Prefix>.<visibility>.<privacy>[_nomap]

----------------------------------------------------------------------
IP ADDRESSES & SSID's befitting of the character limitations: ----------------------------------------------------------------------

192.168.1.128 SSID: AppleWPS.broadcast.public
192.168.1.129 SSID: AppleWPS.broadcast.private_nomap
192.168.1.130 SSID: AppleWPS.hidden.private_nomap

---------------------------------------------------------------------- CHANNEL PLAN (non-overlapping) ----------------------------------------------------------------------

Channel 1 -> Broadcast / Public
Channel 6 -> Broadcast / Private / nomap
Channel 11 -> Hidden / Private / nomap

---------------------------------------------------------------------- HARDWARE AND FIRMWARE ----------------------------------------------------------------------

WRT54G v5 (Linksys) -> Stock Linksys v1.02.8
WRT54G v8.1 (Linksys) -> DD-WRT v24 RC-7 (03/19/08) micro
WNR834B v2 (Netgear) -> DD-WRT v3.0-r51937 mini (03/05/23)

Most public AP uses stock firmware.
Most private/hidden AP uses newest firmware.

----------------------------------------------------------------------
ROUTER NAMES (ASCII-safe, no dashes) ----------------------------------------------------------------------

Router name: broadcast-public
Router name: broadcast-private-nomap
Router name: hidden-private-nomap

----------------------------------------------------------------------
FINAL CONFIGURATIONS (CORRECTED) ----------------------------------------------------------------------

Broadcast / Public (baseline consumer router)
Router name: broadcast-public
IP: 192.168.1.128
SSID: AppleWPS.broadcast.public
Mode: plain AP
Test: Broadcast SSID, no _nomap, no DHCP
Hardware: WRT54G v5 (Linksys)
Firmware: Stock Linksys v1.02.8
Wireless Network Mode: Mixed
Channel: 1 - 2.412GHz (20MHz)
Security Mode: WPA2 Personal
WPA Algorithms: CCMP-128 (AES)
WAN Connection Type: Disabled
Local IP Address: 192.168.1.128/24
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1
DHCP Server: Disable
DNSMasq: Disable
DHCP-Authoritative: Disable
Local DNS: Disable
Backup: 20251226_192.168.1.128_wpstest_wrt54gv5_broadcast-public.cfg

Broadcast / Private / nomap (public, opted out)
Router name: broadcast-private-nomap
IP: 192.168.1.129
SSID: AppleWPS.broadcast.private_nomap
Mode: plain AP
Test: Broadcast SSID, _nomap, no DHCP
Hardware: WRT54G v8.1 (Linksys)
Firmware: DD-WRT v24 RC-7 (03/19/08) micro
Wireless Network Mode: Mixed
Channel: 6 - 2.437GHz (20MHz)
Security Mode: WPA2 Personal
WPA Algorithms: CCMP-128 (AES)
WAN Connection Type: Disabled
Local IP Address: 192.168.1.129/24
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1
DHCP Server: Disable
DNSMasq: Disable
DHCP-Authoritative: Disable
Local DNS: Disable
Backup: 20251226_192.168.1.129_wpstest_wrt54gv81_broadcast-private-nomap.bin

Hidden / Private / nomap (hidden, opted out)
Router name: hidden-private-nomap
IP: 192.168.1.130
SSID: AppleWPS.hidden.private_nomap
Mode: plain AP
Test: Hidden SSID, _nomap, no DHCP
Hardware: WNR834B v2 (Netgear)
Firmware: DD-WRT v3.0-r51937 mini (03/05/23)
Wireless Network Mode: Mixed
Channel: 11 - 2.462GHz (20MHz)
Security Mode: WPA2 Personal
WPA Algorithms: CCMP-128 (AES)
WAN Connection Type: Disabled
Local IP Address: 192.168.1.130/24
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1
DHCP Server: Disable
DNSMasq: Disable
DHCP-Authoritative: Disable
Local DNS: Disable
Backup: 20251226_192.168.1.130_wpstest_wnr834b2_hidden-private-nomap.bin

I'm moving forward with the setup as the Google employee will only
be home later today so I'm setting up all 3 routers as we type.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.internet.wireless

Marian wrote:

Broadcast / Public (baseline consumer router)
Router name: broadcast-public
IP: 192.168.1.128
SSID: AppleWPS.broadcast.public
Mode: plain AP
Test: Broadcast SSID, no _nomap, no DHCP
Hardware: WRT54G v5 (Linksys)
Firmware: Stock Linksys v1.02.8
Wireless Network Mode: Mixed
Channel: 1 - 2.412GHz (20MHz)
Security Mode: WPA2 Personal
WPA Algorithms: CCMP-128 (AES)
WAN Connection Type: Disabled
Local IP Address: 192.168.1.128/24
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1
DHCP Server: Disable
DNSMasq: Disable
DHCP-Authoritative: Disable
Local DNS: Disable
Backup: 20251226_192.168.1.128_wpstest_wrt54gv5_broadcast-public.cfg

On this stock Linksys v1.02.8 firmware, there is no DHCP "Disabled" option
So, "Automatic Configuration - DHCP" is the default
If nothing is plugged into the WAN port, the router simply does nothing
It does not broadcast WAN DHCP
It does not affect SSID broadcasting
It does not affect your Apple WPS / _nomap test
It does not interfere with LAN DHCP (which is disabled)

So I only need to change the test setup from:
WAN Connection Type: Disabled
To:
WAN Connection Type: Automatic Configuration - DHCP

And, apparently Linksys also saves a bin file (and not a cfg file).

Broadcast / Public (baseline consumer router)
Router name: broadcast-public
IP: 192.168.1.128
SSID: AppleWPS.broadcast.public
Mode: plain AP
Test: Broadcast SSID, no _nomap, no DHCP
Hardware: WRT54G v5 (Linksys)
Firmware: Stock Linksys v1.02.8
Wireless Network Mode: Mixed
Channel: 1 - 2.412GHz (20MHz)
Security Mode: WPA2 Personal
WPA Algorithms: CCMP-128 (AES)
WAN Connection Type: Automatic Configuration - DHCP
Local IP Address: 192.168.1.128/24
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1
DHCP Server: Disable
DNSMasq: Disable
DHCP-Authoritative: Disable
Local DNS: Disable
Backup: 20251226_192.168.1.128_wpstest_wrt54gv5_broadcast-public.bin

Now I'll set up the middle router test.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.internet.wireless

Marian wrote:

Now I'll set up the middle router test.

Drat. I found another inconsistency we need to overcome by design.

Router 1 (broadcast-public) was intentionally left in Mixed mode because it
is meant to behave like a normal consumer router. Mixed mode reflects
typical real-world defaults and ensures Apple's WPS treats it as an
ordinary, indexable access point.

But router 2 is set to G-only.
This avoids DD-WRT's 802.11n elements (eliminating mixed-mode quirks).
And it provides for more predictable beacon frames.
Plus, it reduces RF noise by minimizing the RF signature.
And, it ensures consistent behavior for the privacy test.
This distinction is intentional and part of the experimental design.

Router 3 is a much newer router (relatively speaking), so it's set to mixed mode like router one was set. So, in summary, the mode settings will be:
Router 1 (broadcast-public) = Mixed
Router 2 (broadcast-private-nomap) = G-Only
Router 3 (hidden-private-nomap) = Mixed

This combination is intentional and based on the hardware
but the settings also take into account our test goals.

1. Router 1 stays in Mixed mode
It is the "normal consumer router" baseline.
Mixed mode matches real-world defaults.
Apple WPS should treat it as a standard, indexable AP.
This gives you a clean reference point for comparison.

2. Router 2 is set to G-Only
It is a WRT54G v8.1, which is 802.11g hardware anyway.
DD-WRT micro behaves more predictably in G-Only mode.
Mixed mode on this old hardware can introduce quirks.
G-Only produces cleaner, simpler beacon frames.
It reduces RF variability and noise.
It ensures consistent behavior for the "broadcast + _nomap" test case.

3. Router 3 stays in Mixed mode
It is an 802.11n-capable router (WNR834B v2).
Setting it to G-Only would disable 802.11n features entirely.
That would distort the hidden SSID test.
Apple WPS fingerprints N-capable APs differently.
We want Router 3 to behave like a normal hidden SSID AP,
not a crippled or downgraded one.
Mixed mode preserves the correct beacon structure for this hardware.

Summary:
Router 1 = baseline, normal consumer behavior.
Router 2 = controlled, simplified G-only for the _nomap broadcast test.
Router 3 = normal mixed-mode behavior for the hidden SSID test.

This setup gives us three distinct, meaningful test cases without
introducing artificial distortions from forcing the wrong wireless mode
on the wrong hardware.

Broadcast / Public (baseline consumer router)
Router name: broadcast-public
IP: 192.168.1.128
SSID: AppleWPS.broadcast.public
Mode: plain AP
Test: Broadcast SSID, no _nomap, no DHCP
Hardware: WRT54G v5 (Linksys)
Firmware: Stock Linksys v1.02.8
Wireless Network Mode: Mixed
Channel: 1 - 2.412GHz (20MHz)
Security Mode: WPA2 Personal
WPA Algorithms: CCMP-128 (AES)
WAN Connection Type: Automatic Configuration - DHCP
Local IP Address: 192.168.1.128/24
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1
DHCP Server: Disable
DNSMasq: Disable
DHCP-Authoritative: Disable
Local DNS: Disable
Backup: 20251226_192.168.1.128_wpstest_wrt54gv5_broadcast-public.bin

Broadcast / Private / nomap (public, opted out)
Router name: broadcast-private-nomap
IP: 192.168.1.129
SSID: AppleWPS.broadcast.private_nomap
Mode: plain AP
Test: Broadcast SSID, _nomap, no DHCP
Hardware: WRT54G v8.1 (Linksys)
Firmware: DD-WRT v24 RC-7 (03/19/08) micro
Wireless Network Mode: G-Only
Channel: 6 - 2.437GHz (20MHz)
Security Mode: WPA2 Personal
WPA Algorithms: CCMP-128 (AES)
WAN Connection Type: Disabled
Local IP Address: 192.168.1.129/24
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1
DHCP Server: Disable
DNSMasq: Disable
DHCP-Authoritative: Disable
Local DNS: Disable
Backup:
20251226_192.168.1.129_wpstest_wrt54gv81_broadcast-private-nomap.bin

Hidden / Private / nomap (hidden, opted out)
Router name: hidden-private-nomap
IP: 192.168.1.130
SSID: AppleWPS.hidden.private_nomap
Mode: plain AP
Test: Hidden SSID, _nomap, no DHCP
Hardware: WNR834B v2 (Netgear)
Firmware: DD-WRT v3.0-r51937 mini (03/05/23)
Wireless Network Mode: Mixed
Channel: 11 - 2.462GHz (20MHz)
Security Mode: WPA2 Personal
WPA Algorithms: CCMP-128 (AES)
WAN Connection Type: Disabled
Local IP Address: 192.168.1.130/24
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1
DHCP Server: Disable
DNSMasq: Disable
DHCP-Authoritative: Disable
Local DNS: Disable
Backup: 20251226_192.168.1.130_wpstest_wnr834b2_hidden-private-nomap.bin
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: alt.internet.wireless

Marian wrote:

This combination is intentional and based on the hardware
but the settings also take into account our test goals.

Proposed (WIP) APPLE WPS TEST PLAN
----------------------------------

GOAL:
Determine how Apple's WPS database treats:
1. A normal broadcast SSID (Router 1)
2. A broadcast SSID with _nomap (Router 2)
3. A hidden SSID with _nomap (Router 3)

Specifically:
Does Apple index them?
How long does it take Apple to index them?
Does Apple retain them after relocation?
Does Apple treat _nomap consistently?

TEST LOCATIONS:
Location A = Friend's house in Palo Alto
Location B = A second test site in Cupertino

ROUTERS:
Router 1 = broadcast-public (Mixed)
Router 2 = broadcast-private-nomap (G-Only)
Router 3 = hidden-private-nomap (Mixed)

TEST SEQUENCE OVERVIEW:
Phase 1: Deploy all routers at Location A
Phase 2: Leave them running for a fixed time window
Phase 3: Query Apple WPS database daily
Phase 4: Move all routers to Location B
Phase 5: Leave them running again
Phase 6: Query Apple WPS database daily
Phase 7: Compare entries from both locations

-----------------------------------------------
PHASE 1: DEPLOY AT LOCATION A
-----------------------------------------------
1. Power on all three routers.
2. Verify:
AP 1 visible as broadcast-public
AP 2 visible as broadcast-private_nomap
AP 3 hidden (SSID not broadcast)
3. Confirm channels:
Router 1 = 1
Router 2 = 6
Router 3 = 11
4. Confirm no DHCP servers active on any router.
5. Confirm all three respond to ping:
192.168.1.128
192.168.1.129
192.168.1.130
6. Record the exact start time.

-----------------------------------------------
PHASE 2: WAITING PERIOD AT LOCATION A -----------------------------------------------
1. Leave routers running for (I don't know how long yet) days.
Recommended minimum: 3 days
Ideal: 5 to 7 days
2. I will not reboot or reconfigure routers.
3. I will not move them or change orientation.

-----------------------------------------------
PHASE 3: DAILY APPLE WPS QUERIES (LOCATION A) -----------------------------------------------
Each day, record:
A. Does AP 1 appear in WPS?
B. Does AP 2 appear in WPS?
C. Does AP 3 appear in WPS?
D. What coordinates does Apple report?
E. What confidence or accuracy radius?
F. Does Apple drop any entries?

-----------------------------------------------
PHASE 4: MOVE TO LOCATION B
-----------------------------------------------
1. Power off all three routers.
2. Transport them to Location B.
3. Power them on in the same order:
Router 1 first
Router 2 second
Router 3 third
4. Verify:
AP 1 visible
AP 2 visible
AP 3 hidden
5. Confirm channels again:
1 / 6 / 11
6. Record the exact relocation time.

-----------------------------------------------
PHASE 5: WAITING PERIOD AT LOCATION B -----------------------------------------------
1. Leave routers running for ? days.
Recommended minimum: 3 days
Ideal: 5 to 7 days
2. I will not reboot or reconfigure routers.

-----------------------------------------------
PHASE 6: DAILY APPLE WPS QUERIES (LOCATION B) -----------------------------------------------
Each day, record:
A. Does Apple create new entries?
B. Does Apple update the old entries?
C. Does Apple merge Location A and B?
D. Does Apple drop Location A?
E. Does Apple treat _nomap differently?
F. Does Apple treat hidden SSID differently?

-----------------------------------------------
PHASE 7: FINAL ANALYSIS
-----------------------------------------------
Compare:
1. Router 1 behavior across both locations
2. Router 2 behavior across both locations
3. Router 3 behavior across both locations
4. Whether _nomap suppressed indexing
5. Whether hidden SSID suppressed indexing
6. Whether Apple retained stale coordinates
7. Whether Apple merged or split entries
8. Whether Apple respected relocation timing

EXPECTED OUTCOMES (HYPOTHESES):
Router 1:
Should appear at both locations.
Should update location after relocation.

Router 2:
May appear at Location A.
May or may not update at Location B.
Apple may treat _nomap inconsistently.

Router 3:
May not appear at all.
If it appears, it may be unstable or delayed.
Hidden SSID behavior is the key unknown.

DATA TO RECORD:
Date
Time
Router ID
SSID (if visible)
Apple WPS coordinates
Accuracy radius
Confidence
Whether entry is new or updated
Notes

END OF (proposed, WIP) TEST PLAN
--- Synchronet 3.21a-Linux NewsLink 1.2