9 comments

  • luma 22 hours ago
    Looks like an open version of SkyHook from way back in 2003: https://en.wikipedia.org/wiki/Skyhook_Wireless

    For a while they had a paid program, I had a Windows Mobile app I could run with an external GPS dongle that would record wifi APs and location, upload to skyhook, who would occasionally cut me a check for my trouble. I made tens of dollars!

  • drnick1 22 hours ago
    I started rotating my BSSID weekly after I learned Apple and Google abused it to track the location of people and devices.

    Permanent hardware or software IDs, such as the Windows GUID or machine-id on Linux (systemd) are inevitably abused for surveillance sooner or later.

    • S0und 22 hours ago
      You have all the good intentions, but since no one else does this around your location, I don't think you're achieving anything.
    • astrange 19 hours ago
      You mean, they used it so people trying to use their maps apps didn't have to wait several minutes for a cold GPS fix?
      • gpm 15 hours ago
        > wait several minutes for a cold GPS fix

        My phone doesn't take several minutes to get a GPS fix even when I'm in the middle of nowhere well beyond the range of cell towers let alone wifi routers...

        I understand that in theory it could if it had no clue what time it was either for some reason... but in practice we're talking seconds (though more than 2) not minutes.

        • Fabricio20 14 hours ago
          I feel like that's not a true cold GPS signal! Though I'm not arguing the parents scenario is realistic either. I got a GPS module for a drone I was building and it took 20 minutes to get a proper GPS lock from cold!!! I was sitting there watching betaflight doing it's thing wondering why the heck it takes so long when there's so many satellites in view!
          • gpm 14 hours ago
            You're right that it's not a true cold GPS signal. I've connected to the network in the last 180 days (and thus have information on satellite information), I have a rough clock (time within 20s or so). The phone probably assumes it's closeish to where it last turned on. Etc.

            It is the realistic scenario that people would face without using WiFi routers or cell towers though. True cold fixes aren't something phones need to deal with basically ever.

          • 15155 7 hours ago
            It doesn't need to be a cold GPS signal, it only needs to be one that doesn't track you. Your drone doesn't have access to the internet to do the almanac and ephemeris download, that's the difference.

            Aiding the fix by obtaining data from a faster unidirectional source (instead of satellite to device, it's just internet to device) doesn't reveal anything private, unlike mass-capture of WiFi (B)SSIDs.

            Also, I would look into the quality of the GPS radio and antenna you are using - $95 u-blox modules will get an RTK-quality fix without outside assistance in minutes.

          • 05 7 hours ago
            20minutes just means a shitty module or lots of ~1.3ghz noise (e.g. from dji o3/o4 or gopro cpu), although bad input filtering and gps located near an antenna could saturate the amplifier even with antenna on a different frequency. 1min is typical for cold fixes but you can make it faster by uploading ephemeris/cache using AssistNow (valid for about a month).
    • skinfaxi 19 hours ago
      How do you coordinate across all of your devices?
    • XorNot 18 hours ago
      The same physical location showing a different SSID every week but the surrounding ones not changing would be deanonymizing you much more aggressively.

      People mostly don't change SSIDs or even move networking hardware - e.g. AirBnBs.

      Edit: and also are you still carrying a smart phone while doing this? The device which has GPS and a cloud internet connection?

  • anigbrowl 22 hours ago
    Isn't this just wha WIGLE does?
    • jcims 21 hours ago
      Basically except it's using an Apple service for the backend.

      Which will likely get cut off at some point.

      • mcculley 20 hours ago
        Why would it be cut off? Doesn’t Apple use this on devices?
  • bryancoxwell 15 hours ago
    Worth noting that the coordinates for cell towers returned by the WLOC API are coarse enough to be just about useless for locating towers. For APs it’s much better but still not great.
  • totetsu 16 hours ago
    This talk seems to give a good introduction to bssid https://www.youtube.com/watch?v=hlbjUvkoyBA
  • oulipo 23 hours ago
    Interesting, wondering why Apple doesn't restrict the queries to its server using a certificate that would be pinned on the devices, etc, so at least you would need a legit iPhone/Mac to be able to do a query?
    • mcculley 20 hours ago
      Are you imagining some certificate unique to each device? What would prevent someone copying it?
      • BobbyTables2 13 hours ago
        I don’t think Apple would have much trouble burying a certificate and key in a IOS device that would be very hard to access.
  • doublerabbit 1 day ago
    Cool. This'll go nicely with my hackslab and tinfoil hat upgrade.
  • WorseIsBetter 6 hours ago
    [dead]