Let's just say California wanted to find all the people who moved from
California to Florida who retired to ask them to pay their 401K taxes.
It would be trivial, using Apple's WPS system, to find everyone in any
given county in Florida who recently moved there from California.
... and Donald still hasn't achieved his "trivial" exercise.
Let's just say California wanted to find all the people who moved from
California to Florida who retired to ask them to pay their 401K taxes.
It would be trivial, using Apple's WPS system, to find everyone in any
given county in Florida who recently moved there from California.
Despite literally hundreds of posts he is no nearer to resolving this. At best he's proven my assertion that a simple address look-up from publicly available data is much a more serious privacy risk than is ever possible
with a BSSID db. What an utter waste of time...
What he has achieved is violate the privacy of hundreds of californians. He has no interest in privacy.
Chris wrote:
... and Donald still hasn't achieved his "trivial" exercise.
Let's just say California wanted to find all the people who moved from >>>> California to Florida who retired to ask them to pay their 401K taxes. >>>>
It would be trivial, using Apple's WPS system, to find everyone in any >>>> given county in Florida who recently moved there from California.
Despite literally hundreds of posts he is no nearer to resolving this. At
best he's proven my assertion that a simple address look-up from publicly
available data is much a more serious privacy risk than is ever possible
with a BSSID db. What an utter waste of time...
What he has achieved is violate the privacy of hundreds of californians. He >> has no interest in privacy.
Hi Chris,
We have already shown that any BSSID can be looked up and tracked over
time.
Any address can be scanned for nearby BSSIDs with an ordinary
phone. Those BSSIDs can be matched to entries in Apple's WPS data. The database can be expanded outward indefinitely. Nobody contests that.
None of this is hypothetical.
The scripts already demonstrated the mechanics.
The disagreement now is about effort, not possibility.
My not
wanting to enumerate every BSSID from California to Florida does not
change the fact that it can easily be done.
May I have your BSSID please, Chris, to prove this point to you?
Give me your BSSID. Then I will track you. Forever.
Your not wanting to share your own BSSID does not change that either.
The technical point stands on its own.
You simply do not want to give me your BSSID (and I understand that).
But you not wanting to give it to me doesn't mean it can't be done.
I can track your AP forever once I have your BSSID.
If we arbitrarily pick a home in San Jose, I can track them too.
Wanna do that?
Let's pick a home, in San Jose, that I can drive up to.
a. I can sit outside that house in my car for a minute or two
b. I can get the most powerful SSID/BSSID combination in that time
c. Now we have a BSSID:GPS:Address we can work with
I can do that.
Nobody disputes it. You can do it too.
But the fact I don't feel like doing it doesn't mean it can't be done.
As for your political comments, I am not engaging with personal accusations because they do not help the discussion.
The issue is the capability of the
WPS system, not anyone's motives.
Chris wrote:
... and Donald still hasn't achieved his "trivial" exercise.
Let's just say California wanted to find all the people who moved from >>>> California to Florida who retired to ask them to pay their 401K taxes. >>>>
It would be trivial, using Apple's WPS system, to find everyone in any >>>> given county in Florida who recently moved there from California.
Despite literally hundreds of posts he is no nearer to resolving this. At
best he's proven my assertion that a simple address look-up from publicly
available data is much a more serious privacy risk than is ever possible
with a BSSID db. What an utter waste of time...
What he has achieved is violate the privacy of hundreds of californians. He >> has no interest in privacy.
Hi Chris,
We have already shown that any BSSID can be looked up and tracked over
time.
Any address can be scanned for nearby BSSIDs with an ordinary
phone. Those BSSIDs can be matched to entries in Apple's WPS data. The database can be expanded outward indefinitely. Nobody contests that.
None of this is hypothetical.
The scripts already demonstrated the mechanics.
The disagreement now is about effort, not possibility.
My not
wanting to enumerate every BSSID from California to Florida does not
change the fact that it can easily be done.
May I have your BSSID please, Chris, to prove this point to you?
Give me your BSSID. Then I will track you. Forever.
Your not wanting to share your own BSSID does not change that either.
The technical point stands on its own.
You simply do not want to give me your BSSID (and I understand that).
But you not wanting to give it to me doesn't mean it can't be done.
I can track your AP forever once I have your BSSID.
If we arbitrarily pick a home in San Jose, I can track them too.
Wanna do that?
Let's pick a home, in San Jose, that I can drive up to.
a. I can sit outside that house in my car for a minute or two
b. I can get the most powerful SSID/BSSID combination in that time
c. Now we have a BSSID:GPS:Address we can work with
I can do that.
Nobody disputes it. You can do it too.
But the fact I don't feel like doing it doesn't mean it can't be done.
As for your political comments, I am not engaging with personal accusations because they do not help the discussion.
The issue is the capability of the
WPS system, not anyone's motives.
Maria Sophia <mariasophia@comprehension.com> wrote:
Chris wrote:
... and Donald still hasn't achieved his "trivial" exercise.
Let's just say California wanted to find all the people who moved from >>>>> California to Florida who retired to ask them to pay their 401K taxes. >>>>>
It would be trivial, using Apple's WPS system, to find everyone in any >>>>> given county in Florida who recently moved there from California.
Despite literally hundreds of posts he is no nearer to resolving this. At >>> best he's proven my assertion that a simple address look-up from publicly >>> available data is much a more serious privacy risk than is ever possible >>> with a BSSID db. What an utter waste of time...
What he has achieved is violate the privacy of hundreds of californians. He >>> has no interest in privacy.
Hi Chris,
It's notable that you've addressed nothing of the above.
Do you really not
care about other people's privacy that you yourself hold so dear? Why such
a hypocrite?
We have already shown that any BSSID can be looked up and tracked over
time.
Incorrect. "we" haven't shown this at all. The arxiv paper has some
disaster related examples. Your trivial suggestion is still unresolved.
Any address can be scanned for nearby BSSIDs with an ordinary
phone. Those BSSIDs can be matched to entries in Apple's WPS data. The
database can be expanded outward indefinitely. Nobody contests that.
None of this is hypothetical.
The scripts already demonstrated the mechanics.
None of this is news either. Public information is public information.
The disagreement now is about effort, not possibility.
Incorrect. I explained to you very clearly how your "trivial" thought experiment is far from it. Additionally, the authorities would have far
more accurate methods at their disposal to achieve the above scenario far more easily (i.e. electoral rolls).
My not
wanting to enumerate every BSSID from California to Florida does not
change the fact that it can easily be done.
It shows you have not considered computational scaling. An important
omission when dealing with millions of data points. It cannot "easily be done".
May I have your BSSID please, Chris, to prove this point to you?
Give me your BSSID. Then I will track you. Forever.
Me? Impossible. Forever?! lol. I could change my router tomorrow and give
my old one away. You'd have no idea.
Your not wanting to share your own BSSID does not change that either.
The technical point stands on its own.
No it doesn't. I wouldn't give you my BSSID for exactly the same reason I wouldn't give you my address in any form. The BSSID is simply a (bad) proxy for a physical address.
You simply do not want to give me your BSSID (and I understand that).
But you not wanting to give it to me doesn't mean it can't be done.
I can track your AP forever once I have your BSSID.
Remember that all you're tracking is my house. Which unless I live in a mobile home, which I don't, can be done with just a map. This is the whole premise of the postal service. You're simply re-inventing a 150 year old institution.
If I go away on holiday or a work trip, you'll have no idea. Again.
If we arbitrarily pick a home in San Jose, I can track them too.
Wanna do that?
Let's pick a home, in San Jose, that I can drive up to.
a. I can sit outside that house in my car for a minute or two
b. I can get the most powerful SSID/BSSID combination in that time
c. Now we have a BSSID:GPS:Address we can work with
So you're trying to argue that a BSSID is more of a privacy risk than an address or map but you need to *drive to that address first*?! How can you not see how ridiculous you sound?
I can do that.
I can get the GPS and Address of anywhere in the world from my sofa. Why bother with a car?
Nobody disputes it. You can do it too.
But the fact I don't feel like doing it doesn't mean it can't be done.
You said this is a global problem. Now it's only a problem for addresses within driving distance of your house. lol.
What about addresses in Florida? Completely at random I chose this address: 1537, W 10th Street, Jacksonville, FL. Tell me their BSSID and whether they've recently moved from California.
Now do the same for Buenos Aires or Jakarta or Nairobi.
As for your political comments, I am not engaging with personal accusations >> because they do not help the discussion.
I have made no personal accusations nor political comments.
The issue is the capability of the
WPS system, not anyone's motives.
The issue is your incapacity for reason and logic.
You have not, nor ever will be able, to demonstrate your assertion that tracking "*people*" with only a BSSID is a global privacy risk.
It's a ridiculous and easily refutable claim.
Clearly you've lost interest WPS privacy as in the days since this post you've gone out of your way to look for other ways to bash Apple in your
own inimitable way: Dozens of posts full of anecdote, opinion and unverifiable claims.
Chris wrote:
Clearly you've lost interest WPS privacy as in the days since this post
you've gone out of your way to look for other ways to bash Apple in your
own inimitable way: Dozens of posts full of anecdote, opinion and
unverifiable claims.
Hi Chris,
Happy New Year!
I'll ignore that you're constantly hurling insults to focus on the
technical issues we've been discussing that you need to process fully.
1. I'm currently running the experiment I said I was going to run.
<https://i.postimg.cc/44WKMKpJ/apple-wps-testing.jpg>
2. These three access points have been set up in a random home.
a. no opt out directive, no hidden-beacon frame
b. opt-out directive, no hidden-beacon frame
c. opt-out directive, hidden-beacon frame
3. I already know what's going to happen as I understand what Apple does
But as you can surmise, I've been busy with other things lately.
What you need to process fully is I already proved it was trivial.
You don't understand the proof so there's nothing more for me to do.
A. You don't understand what the original code does
B. You don't understand what my modifications to the code did
C. And, you've never run either the original code or the modified code
Just from seeing my results, everyone who processed the results can understand how trivial it is to reproduce what the researchers claimed.
I simply reproduced it.
And it was trivial.
To understand how trivial it is, you need to process the proof provided.
Since you haven't processed what we've done, nor what the researchers actually said about the process that I, myself, proved was easy, it's not really going to help for me to give you the same proof over & over again.
If I felt like it, and if I felt like dedicating the disk space for it, I could easily obtain two billion GPS:BSSID pairs out of the Apple WPS db.
Just like the researchers said anyone could do.
Once I have the two billion pairs (the researchers said it took a few weeks but a determined malefactor would invest that time) I can track the APs.
That's for every access point in the world (that's in Apple's WPS db).
It would be less for every access point in any given state, of course.
I already wrote the script to track an AP that moves more than 100KM.
You haven't processed that proof yet, but I gave it to you weeks ago.
What's so hard about changing that script to be one specific locale?
It's trivial.
For you to require me to modify the script to do what it obviously can do (and does do, but for 100KM at this point), is not worth my time, Chris.
If you can't process the proof you have, then there's nothing more anyone
can say to you, because you have to be able to process it to understand it.
The onus is on you to present the facts correctly and completely.
Your inability to do this means that your claims are unfounded.
You have no proof. It's only one datapoint.
| Sysop: | Amessyroom |
|---|---|
| Location: | Fayetteville, NC |
| Users: | 54 |
| Nodes: | 6 (0 / 6) |
| Uptime: | 12:06:01 |
| Calls: | 742 |
| Files: | 1,218 |
| D/L today: |
1 files (1,690K bytes) |
| Messages: | 183,172 |
| Posted today: | 1 |
