170
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 23 May 2024
170 points (96.2% liked)
Technology
57944 readers
3518 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Apple's got one, so does Google, and Microsoft. They're common tools for scam baiters tracking down call centres and individual scammers. Pretty effective actually.
They've got beacon location data, yes, but Apple is the only one that gives up that information without first conforming that the query is coming from someone who sees that BSSID. As OP notes:
If you click through to the paper, it describes 2 approaches for using BSSIDs to identify location:
See the problem there? Approach 2 gives more raw information away, by outsourcing the positioning calculation to untrusted clients.
And the paper outlines how Apple goes even further than that:
It goes on later:
That's the discussion here. Apple keeps a large database, like many other big tech/mapping firms, but does nothing to keep that database hard for strangers to scrape in bulk.
In contrast, Google uses the first approach and keeps the information a bit more restricted by performing the location calculation at the server:
So it's possible to run this type of service with this type of database, without sharing BSSID locations with anyone else who asks.
Seems like apple was hoping to keep their API hits down at the expense of everyone’s privacy including their own customers. Very uncool.
It seems that Apple may be interested in at least requiring authentication that the query comes from an Apple device (or even an Apple-approved API key), which would go a long way in alleviating the security flaw.
I can see some value in the server returning BSSID location data directly (especially with risk of intermittent or slow data connections), but the combination of all the factors seems sloppy.
It could even be privacy preserving with the right implementation. With a bunch of device locations nearby you’re not hitting the server constantly and leaving a trail… but I think Apple just had limiting API hits and maybe computing.
I'm sure they are also pretty effective for people with more nefarious uses for them.
Certainly. I'm not saying they're a good thing; just lending credence to their existence.
Though I'll note; to use them you need access to the wifi radio carried by the individual you're tracking. Ie; you've already hacked their device.