> this paper addressed passive attacks, where the attacker controls only a receiver, but exploits the normal Wi-Fi traffic. In this case, the only useful traffic for the attacker comes from transmitters that are perfectly fixed and whose position is well known and stable, so that the NN can be trained in advance, thus the obfuscator needs to be installed only in APs or similar ‘infrastructure’ devices. Active attacks, where the attacker controls both the transmitter and the receiver are another very interesting research area, where, however, privacy protection cannot be based on randomization at the transmitter.
https://github.com/ansresearch/csi-murder/
> The experimental results obtained in our laboratory show that the considered localization method (first proposed in an MSc thesis) works smoothly regardless of the environment, and that adding random information to the CSI mess up the localization, thus providing the community with a system that preserve location privacy and communication performance at the same time.
Encryption is a technical solution trying to solve the problem of people being able to steal your data/money without your knowledge.
The law/police are the solution to the 5 dollar wrench problem, where you are very aware of the attack but unable to physically stop it
The law is there to enforce the “rule of law”
It’s a little ambiguous because the phrase is in English and doesn’t match up 1:1 with the common vernacular, but I want the “rule of law” to enforce that the rules are real, not to prevent someone from testing their existence
ISPs will always have the ability to at least deduce whether a connection was used, the MAC address, and it there is WiFi, unfortunately whether people are physically present.
If we look at the roadmap for WiFi/phones/etc, they will soon gain the ability to map out your home, including objects, using consumer radios.
This isn't really true. The easiest technical solution to the problem of ISPs using your wifi data is to simply use your own WiFi router which does not send the data to them.
pay him with a pack of beer
Every house should look like a party of 50.
Invest in potatoes
Comcast cannot administer my router/AP or modem.
Some other ISP's like AT&T force you to use their gateway. I try and avoid these companies or severely limit the functions of the built in gateway.
Edit: sorry my question is not strictly how one person would mangle their hardware so it breaks presence detection, it’s how the tech industry would develop an at scale everyday consumer solution to this problem.
Require that each privacy waiver is individually initialed, per clause, in wet ink.
This shit would end tomorrow if they had to start delivering modems with 1 inch high letters that said "THIS DEVICE WILL TRACK YOUR LOCATION WITHIN YOUR HOME AND SHARE THAT DATA WITH LAW ENFORCEMENT WITHOUT YOUR KNOWLEDGE", and the modem didn't work until you went down to the Comcast store to sign your rights away.
You don't have to force anything except taking this knowledge out of the fine print and prove that your customers are actually aware of the contractual clauses they are subject to.
The tech industry could come together and come up with a privacy standard guarantee that device manufacturers could use (Something as simple as, we will never share data with law enforcement unless legally compelled).
There's a lot of solutions, ranging from technical (firmware update) to social (pass some laws with teeth).
I have the urge to laugh at this, but maybe I'm just too cynical. Pretty sure we still live in an age where most people would let go of principles like privacy for a bit of convenience.
I guess you could put it in a cage. Maybe I should go door to door selling privacy cages. Do people pay for tinfoil hats these days?
I don't know, how many people that didn't care much about privacy said things like "There is no way the US government would deport US citizens" 7 months ago.
Only with cash.
Sure, this has a fair amount of truth to it. However, security is not a social problem, it's an economic one. No one, not even the most well funded and skilled organizations like the NSA, has access to infinite resources. Whether a given attack/data harvesting effort costs $1 million, $10 thousand, $100, $1, or $0.01 makes an enormous difference in impact. Can a given three letter agency afford to spend $1m on anyone? Sure. Can they afford it against everyone? No. Same with private orgs, if harvesting data costs $10000/person, it has to generate well over that much money in profit to make it worth it. Is that likely on average? Probably not. If it costs fractions of a cent, then they will be incentivized to scale it as hard as possible, since payoff from even one person will cover thousands of duds.
So sure, by all means we should pursue laws too, as that also shifts costs a bit. But there is zero reason not to simultaneously pursue technical means to make costs as high as possible. Both tracks matter a lot.
The obvious solution is to not use that device. But that’s not necessarily possible for a variety of reasons, not all of them controllable.
So, what is the technical solution to this? Anything that’s going to mask a persons RF signal is probably going to make WiFi difficult to use. Anything at the network level is already lost because we have a potentially hostile device in a critical point in the network path.
Am I missing a different solution?
Are you? Comments are full of obvious solutions like using your own hardware, which you clearly understand.
>We’re talking about a device in a home that the owner doesn’t control
No, we definitely are not. As you yourself immediately acknowledge:
>The obvious solution is to not use that device. But that’s not necessarily possible for a variety of reasons, not all of them controllable.
...but then immediately try to do a fuzzy hand wave it away for reasons I don't really understand. Technical solutions don't have to be completely perfect, which is surely not a standard you're holding any social/legal solution to right? Since that would be ridiculous.
As I said, simultaneously pursuing multiple tracks in parallel is the correct approach, as hybrids can be more then the sum of their parts. A purely legal solution ("law against ISPs collecting this data"), if it's even possible to get passed at all, ends up depending heavily on the honor system with all sorts of perverse incentives, and is very challenging to verify. A purely technical solution ("use your own hardware", "route through another end point") could potentially be interfered with (though let's be clear: this isn't actually a thing basically ever). But we can easily imagine hybrid approaches, just as was done in the past with efforts like CableCARD. The law doesn't need to necessarily try to mandate and police hard to verify behavior like how non-property owner controlled hardware acts, but instead can mandate that ISPs must always allow direct dumb interfaces to their network via customer controlled hardware. That's something easy to verify, which enhances compliance, and easy to understand which enhances the politics.
But make no mistake: the technical aspect is an inseparable part of this approach. We need both.
E.g. the you should be able to own your router and even if you choose to rent you should have full control over the software.
I disagree. Solutions should be technical whenever possible, because in practice, laws tend to be abused and/or not enforced. Laws also need resources and cooperation to be enforced, and some laws are hard to enforce without creating backdoors or compromising other rights.
"ISPs will be prohibited from spying on their customers" doesn't mean ISPs won't spy on their customers.