{"id":1121,"date":"2010-06-11T15:55:10","date_gmt":"2010-06-11T23:55:10","guid":{"rendered":"\/?p=1121"},"modified":"2010-06-19T23:18:44","modified_gmt":"2010-06-20T07:18:44","slug":"rethink-things-in-light-of-googles-gstumbler-report","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=1121","title":{"rendered":"Rethink things in light of Google&#39;s Gstumbler report"},"content":{"rendered":"<p>A number of technical people have\u00a0given\u00a0Google the benefit of the doubt in the Street View Wifi case and\u00a0as a result published information\u00a0that<em> Google&#39;s new\u00a0&#8220;<a href=\"http:\/\/www.google.com\/googleblogs\/pdfs\/friedberg_sourcecode_analysis_060910.pdf\">Gstumbler<\/a>&#8221; report\u00a0shows is completely incorrect<\/em>.\u00a0 It is\u00a0important that people re-evaluate what they are saying in light of this report.\u00a0<\/p>\n<p>I&#39;ll pick on <a href=\"http:\/\/conorcahill.blogspot.com\/2010\/06\/kim-vs-google-summary.html\">Conor&#39;s recent posting <\/a>on our discussion as\u00a0an example &#8211;\u00a0it contains a number of statements and\u00a0implies a number of things\u00a0explicitly contradicted by Google&#39;s new report.\u00a0 Once he reads the report and applies the logic he has put forward,\u00a0logic will require\u00a0Conor to change his conclusions.<\/p>\n<p>Conor begins with a bunch of\u00a0statements that are true:<\/p>\n<ul>\n<li>MAC addresses typically are persistent identifiers that by the definition of the protocols used in wireless APs can&#39;t be hidden from snoopers, even if you turn on encryption.<\/li>\n<li>By themselves, MAC addresses are not all that useful except to communicate with a local network entity (so you need to be nearby on the same local network to use them.<\/li>\n<li>When you combine MAC addresses with other information (locality, user identity, etc.) you can be creating worrisome data aggregations that when exposed publicly could have a detrimental impact on a user&#39;s privacy.<\/li>\n<li>SSIDs have some of these properties as well, though the protocol clearly gives the user control over whether or not to broadcast (publicize) their SSID. The choice of the SSID value can have a substantial impact on it&#39;s use as a privacy invading value &#8212; a generic value such as &#8220;home&#8221; or &#8220;linksys&#8221; is much less likely to be a privacy issue than &#8220;ConorCahillsHomeAP&#8221;.<\/li>\n<\/ul>\n<p><strong>Wishful thinking and completely wrong<\/strong><\/p>\n<p>\u00a0These\u00a0are followed by a\u00a0statement that\u00a0is just plain wishful thinking.\u00a0 Conor continues:<\/p>\n<ul>\n<li>Google purposely collected SSID and MAC Addresses from APs which were configured in SSID broadcast mode and inadvertently collected some network traffic data from those same APs. Google did not collect information from APs configured to not broadcast SSIDs.<\/li>\n<\/ul>\n<p>Google&#39;s report\u00a0says\u00a0<strong>Conor is wrong about this,<\/strong> explicitly saying in paragraph 26, &#8220;<em>Kismet can also detect the existence of networks with non-broadcast SSIDs, and will capture, parse, and record data from such networks<\/em>&#8220;.\u00a0\u00a0 Conor continues:<\/p>\n<ul>\n<li>Google associated the SSID and MAC information with some location information (probably the GPS vehicle location at the time the AP signal was strongest).<\/li>\n<\/ul>\n<p>This is true, but it is important to indicate that this was not limited to access points.\u00a0 Google&#39;s report says that\u00a0it recorded the association between the MAC address and geographic location of a<strong>ll the active\u00a0devices on the network<\/strong>.\u00a0 When it did this, the MAC addresses became, according to Conor&#39;s own earlier definition, &#8220;worrisome data aggregations&#8221;.<\/p>\n<ul>\n<li>There is no AP protocol defined means to differentiate between open wireless hotspots and closed hotspots which broadcast their SSIDs.\u00a0<\/li>\n<\/ul>\n<p>This is true, but Google&#39;s report indicates this would not have mattered &#8211; it collected MACs regardless of whether SSIDs were broadcast.<\/p>\n<ul>\n<li>I have not found out if Google used the encryption status of the APs in its decision about recording the SSID\/MAC information for the AP.<\/li>\n<\/ul>\n<p>Google&#39;s report indicates it did not.\u00a0 It only used that status to decide whether or not to record the payload &#8211; and only recorded the payload of unencrypted frames&#8230;<\/p>\n<p>I like Conor&#39;s logic that, &#8220;When you combine MAC addresses with other information (locality, user identity, etc.) you can be creating worrisome data aggregations that when exposed publicly could have a detrimental impact on a user&#39;s privacy.&#8221;\u00a0\u00a0 I urge Conor to read the Gstumbler report.\u00a0\u00a0Once he knows\u00a0what was\u00a0actually happening, I hope he&#39;ll tell the world about it.<\/p>\n<p>\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The report indicates Google has been purposely collecting a lot of information its defenders couldn&#39;t have imagined.<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,3,47,40,11,77],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1121"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1121"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1121\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1121"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1121"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1121"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}