Which is why Android restricts getting the current wifi SSID (WifiManager.getConnectionInfo()) or the nearby wifi SSIDs (WifiManager.getScanResults()) to apps with the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permissions. If an application doesn't have permission to know your location, it's also not allowed to know your wifi network's name.

.. from Android 8 (!) upwards.

(I'm still using a perfectly workable phone that is forever stuck on Android 5)

Does it mean you need to turn on location services as well, or just grant the permission? Noticed recently that WifiAnalyzer on fdroid needed location permissions (and explained why) but I never turn location on so just downgraded to 1.9.3.

Which phone? If you're willing to unlock the bootloader and flash a custom OS load, you could probably get 8 or at least 7.

Not OP, but my 2013 1st Gen Moto X (Verizon) is also stuck on 5(.1) and the bootloader is not unlockable.

I guess good time to point out XPrivacyLua[0], a privacy/permissions manager which should be default in Android imo (without having to root/install Xposed etc). But for the power users out there, worth it.

[0]: https://github.com/M66B/XPrivacyLua

Don't get your hope up like I did. From the readme:

     Installation
     Download, install and activate the Xposed framework
     Download, install and activate the XPrivacyLua module

IP addresses tend to have a relatively long lived association with a subscriber, often weeks. So an app which communicates out the wifi names naturally reveals the IP address (unless there is carrier NAT, i.e. on mobile, in Russia). So with a database of such information, the IP also reveals probable wifi names and hence location.

Upvoted big, because I was planning to get my SSID name for some sort of Chromecast wifi synchronisation for the devices.

What's even more fun is that your phone is also broadcasting those SSIDs to the world as you walk down the street, if you have wifi enabled, and likely also your unique MAC address.

So anyone in wireless range of you can 1) track you and recognize you again, and 2) possibly figure out where you work and live (although of course they may see your friends' wifi networks too and not be able to tell which is your network.)

Only if those SSIDs were configured as a "hidden SSID" (WifiConfiguration.hiddenSSID). AFAIK, that will only happen when you type the SSID manually, instead of selecting it from the list of scan results. And using a "hidden SSID" is a bad idea in the first place (https://superuser.com/questions/43836/automatically-connecti...).

That is entirely not true, both iOS and Android send out requests for known APs when not connected to Wi-Fi. iOS does it VERY often in fact (depending on your list of known APs, could be upwards of 50x/min while device is in use). If you have a wifi chipset you can put in monitor mode, it’s easy to see how noisy mobile devices are.

I looked at it back in 2015 (https://news.ycombinator.com/item?id=9217589), it seems there was a bug (https://www.eff.org/deeplinks/2014/07/your-android-device-te...) which sent these probe requests when the screen was off. I don't know if it has been fixed yet.

Don’t know about the bug you linked (will read up on it later), but I can easily provide radio captures to prove that most Android devices do what I described, with no “hidden” networks ever in use.

There are retail analytics startups who literally use this exact type of data to allow brick and mortar stores to gain insights into their passive customer behavior. Source: I used to work for one of them and designed and built a bunch of the hardware / software stack.

Phones don't broadcast previously-seen SSIDs. Where did you get that idea?

You are so wrong. Your phone is constantly broadcasting ALL the SSIDs it was ever connected to (and you did not remove).

I show this live when I do general security presentations. Live on stage with nothing more then a Raspi and a Wifi USB dongle.

It freaks people out to see there home, holiday, local bar, family in law and other historic SSIDs scroll by.

I suggest you Google "phones broadcast ssids". And then go get a stiff drink.

You can read up on it here:

https://robertheaton.com/2019/01/15/a-brief-history-of-wi-fi...

Looks like more recent phones are better about this, but there are still a lot of older phones out there! And there are still leakages that allow tracking.

Note that with "real computers", just keeping the software up to date is enough to get you the latest in MAC randomization and whatnot; with phones, you may or may not be able to upgrade your software. -.-

Set a wifi chip in monitor mode, fire up wireshark, then see for yourself. Rather easy to do and once you do, you’ll learn to keep wifi off when you aren’t intentionally wanting it.

On Android there are apps to manage this automatically. I'm using Smarter WiFi Manager myself, and it does work pretty well.

On iOS they have Shortcuts that can do something like that too.

It's real limited in what it does, but it can turn wifi / bluetooth / other stuff on depending on time, location, the usual stuff.

I would love to have a real "Tasker" type app for iOS, but I doubt that will happen anytime soon.

The now kind of forgotten Google row where it was discovered they were scanning all wifi networks while mapping speaks volumes to this. If you have a map that details signal strengths you can infer someones location pretty accurately (not gps accurate, but within the ballpark) even if they have location services off just by logging and plotting them against your wifi coverage map.

The thing that people were upset about was that Google Street View cars didn't only scan the public SSIDs, but also recorded all (open) network traffic.

https://www.theguardian.com/technology/2010/may/15/google-ad...

oh yes I remember and they still use the data they collected. I lived in Vienna for 30 years and just recently moved to the country side.

There are no wifi hotspots around me so when I set up my old wifi (same ssid as before and same hardware (bssid)) and checked my phone on google maps it was saying that I still am at the old place because it had not GPS at the moment and then google maps checked the SSIDs around me and looked up where those are located

Was a very weird thing

Both, actually.

Mozilla also has an opt in service where you can upload WiFi details you pass. Its useful for locating your device faster than gps

Knowing this from an Opsec perspective, it would also be better to use generic SSIDs for any wifi networks you're setting up. Something with a name like 'internet' or 'wifi' would be so generic that it would be impossible to pin down.

I tried to check numbers on WiGLE but it's being painfully slow for me.

True but there's also the MAC address...

You are right, you should definitely not feel safe when using a generic network name. In the file that OP posted, the MAC address was missing though. Doesn't mean that it wasn't present on the device. Android used to write the MAC address to logcat, nowadays it's off by default. Sometimes the MAC address of a network gets stored to wpa_supplicant.conf. I'm sure that NetworkManager reports the mac address in journald as well.

This can be spoofed I guess?

Yes

macchanger (I use a custom script that works better for me. Also does magic in places with limited interned, e.g. free 100MB limit)

You would want to look at a database of the most common MAC addresses and SSIDs (maybe even pairs of them) and spoof your MAC address and SSID to match one of the most common pairs.

But it won't help much if there are any other wifi networks or devices around.

"McDonalds Free Wifi" and a MAC address swiped from a nearby (but not so close your Wi0Fi signals will intersect) Mc Donalds...

For enhanced sneakiness, deploy three or more Wi-Fi base stations at the same location with the radios tx power turned right down and directional antennas - and try to make the geometry lookalike it's just a lucky long range shot to a real public/free wifi behind the antennas...

SSID is not significant. You can use a Google service to get a location, and what you need to supply is 3 or 4 mac addresses, not SSID.

Yeah it's returning 502 Bad Gateway errors (AFAIK that's what a CDN would return if it can't reach the actual host), probably a HN/reddit hug of death?

I just realized people can track my relocation across cities and countries if they can see "Ah this SSID was there last month, and here this month!".

My parents moved countries, bringing their WiFi router, and for months afterwards their iPhones would locate them back in the old country... Apple's database was quite slow to pick up the new location.

That's a bit of a simplistic programming, the phones should've seen other SSIDs around it and figured out they're not in Kansas any more. Except if your parent's WiFi network is the only one around the area.

They should be aware that some wifi channels are not legal in all countries.

This would by why my more security-conscious friend names his home network "NETGEAR".

Your friend should read more on WPA2: https://null-byte.wonderhowto.com/how-to/hack-wi-fi-cracking...

SSID unique data is hashed into the password. If you use a very common name there will be a precomputed rainbow table that will make cracking much faster.

https://www.renderlab.net/projects/WPA-tables/

Ideally you would rotate your SSID regularly, but of couse that is a massive pain.

The concern of having your wifi password hacked vs being tracked may be of different concerns for different people.

(Besides, it can be useful to treat your LAN as hostile, anyway, with rampant IOT and friends etc.)

Also I should have pointed out that GPUs crunch WPA2 pretty quick these days too, it is best to use a really long passphrase. There are too many ISP supplied systems with a default password like "9K141U".

It definitely seems like a good idea to put IOT things on a different subnet. I've not met a home router yet that allows me to put proper filters on devices. DD-WRT I guess. But there are so many patches which should be applied, I'm sceptical of old firmware for routers.

At the moment I have an embedded linux device with a wifi dongle and giant antennas. The modem box can probably still be hacked remotely (from the ISP), but at least I'm able to prevent any device on the network from talking to it and using some simple rebinding or XSS attack. (E.g.: https://www.gironsec.com/blog/2015/01/owning_modems_and_rout... http://www.routerpwn.com/ )

> Also I should have pointed out that GPUs crunch WPA2 pretty quick these days too

How quickly, really? I remember a while ago I had a discussion on here where someone told me a hash method was insecure, as you could crack it with a GPU. I downloaded hashcat, put in the hash of a 6 character string, and left it running overnight on a GTX1070 and it was still going.

The hash method (SHA1 iterated 4096 times) is quite secure for this purpose. Even md4 would be fine. Of course, lots of Bitcoin ASICs are designed to compute SHA256 fast, but they are very fixed function and lacking the bandwidth to a CPU to stream in passwords. Also, they are just a constant factor better than what a GPU can do. I'm sure the NSA and other peers have rooms full of ASICs devoted to WPA2 though.

A good GPU cracker rig will get 500k hashes/second per GPU. That is still very slow compared to the search space of a 12 character [a-z][A-Z][0-9][@#$_&-+*"':;!?~|{}%] password.

For a 6 character string, it still depends on what mask you are providing, or what the search space is, i.e are there requirements like one or more upper, 1 or more digits, or is it purely random from a RNG?

Still, if it isn't breaking it within a day I'd say you are in CPU mode, where a multicore box is still only 5k hashes/second.

I know a few people who think they're being clever by doing things like this (playing with their (E)SSID). I'm still patiently waiting for one of them to learn what a BSSID is.

Too bad wifi location services use Mac addresses (BSSID) instead of ESSID. If anything, it’s probably worse because you’re revealing your real MAC address every time it tries to connect to those APs. Normally most phones scan with randomized Mac addresses but the randomization turns off when it tries to connect.

This is exactly what android does when it uses WiFi for location tracking

By appending ‘_nomap’ to the end of your Wi-Fi hotspots you could opt out of all Wi-Fi network tracking and means your hotspot will not be used for improving location fixes on mobile devices.

(only honored by google, other OSs need different approaches)

This is a terrible standard, unfortunately. This makes branded or "clever" SSID's difficult and awkward. (And Microsoft has a different standard too ...)

https://krebsonsecurity.com/2015/07/windows-10-shares-your-w...

interesting doesn't have mine in the UK maybe its just USA

no, I'm from Austria and it works here too. But it doesn't magically get all SSIDs from the planet, someone in your are must have the wigle app that records those info. It's crowd sourced

Mine too - from an address I moved out of ~6 months ago though...

It's wherever a contributor has been.

Our home SSID isn't there, but a neighbour's network is visible on the street outside and is listed.

I thought the same when I went to my country, but after a longer while a heatmap pops up. My wifi isn't in it though.

It does now ;)

I hadn't either. Also what is the deal of random people contributing to the database at https://wigle.net/, why don't you mind your own business? There is a big difference between broadcasting the SSID in a 20-50m radius and effectively broadcasting it world-wide.

Google and other entities already have that data. Building open databases like wigle.net or https://location.services.mozilla.com/ seems good to me because:

1) It allows building alternative location providers that make it possible to have an Android device that doesn't rely on Google maps.

2) Publicizing the existences of these databases might make the general public more conscious of privacy and data protection issues involved.

1) I don't find such location-providers a good addition to society.

2) That is like saying you go around kicking people in the crotch to make them more conscious about the benefits of learning self-defence.

Update:

> Google and other entities already have that data.

How is this an argument FOR gathering sensitive information about the people around you? Should you also look to their trash and digitise any documents they throw away and make a website that allows you to search through these documents? You could argue that Google or some other entity already has that information anyway.

You could also argue that this would increase consciousness with regards to the privacy concerns of your trash.

Re #2 maybe if a few people got kicked in the crotch, there would be a groundswell of support to pass laws restricting who can kick you in the crotch and under what circumstances.

Of course, the likely outcome is that only big multinational corporations with a legal team are allowed to kick you in the crotch.

Re: #1 I think they are a good addition to society because otherwise every device has to rely on satellite positioning, which is slower, generally less accurate, and prone to failure indoors or around tall buildings.

I prefer privacy over location data to be honest.

The practice is questionable at best, but it's a good reminder about that everying sent with radio waves can be picked up by others even if they were not the intended recipients and no matter if you want them to or not.

It's pretty much like leaving the front door unlocked -- it would be unethical to use it to go inside and steal your stuff but we still need to lock the door if we want to reduce the chance of someone stealing your stuff.

Tips for avoiding this:

- Change SSID at least once per year.

- If your router support multiple SSID's, turn the current one off and use the next one in the settings instead -- it will usually result in the MAC address being changed as well.

- Do the above whenever you move the router from one location to another.

For fun I guess, been around since the beginning of Wi-Fi access points. I guess a similar kind of fun to geocaching, etc.

https://en.wikipedia.org/wiki/Wardriving

I am aware that they must find it fun, but I am challenging the ethics of this 'fun'. I think this information should not exist anywhere and even if it did, it shouldn't be made public.

Geocaching and trying to gather as much privacy sensitive information about the people around you are two different things. With geocaching there aren't any parties involved that are unaware of the activity who are still negatively impacted by it.

Me neither, but I think the whole point of this article was to promote wigle.net.