I've got a WiFi only iPad2, so the non 3G, non-GPS version of the device. And yet, using its maps app, it's capable of pinpointing my current location accurately up to a few meters! I'm absolutely amazed by this and have tried this at several locations, everytime with the same incredibly accurate result.

How does it do that? It's not like it can triangulate my position. I'm guessing the external IP address is used, but I've never known this to be very accurate. Usually it can only pinpoint the town you're in and most of the time not even that. So how does Apple do it?

Skyhook (or similar).

Similar now. Apple licensed Skyhook initially, and has switched over to their own database. This location tech is also built into OS X and can be used to find a missing laptop if it's within range of WiFi.

This cache of information (WiFi, and Cell towers for 3G units) on the iOS devices is what lead to the locationgate stories last year. It was mostly overblown, and in the investigation, Apple revealed a bit more info. Specifically if you use Maps on a unit without 3G, and search for something on the map, it also downloads WiFi location info around the area you searched. This allows GPS like tracking when the device lacks an internet connection and real GPS chip. It's not as good, but can be better then nothing for a quick walk in a downtown environment in a foreign city.

Also neat, the iPhone will relay actual GPS information to the WiFi only iPads if the iPad tethers to the iPhone.

Google Maps on Android is the same. Using my home Wifi, it gets the location to less than a meter or two. i.e. it pinpoints the specific area of the phone socket my ADSL connects to. Of course that must be a fluke since I could move my ADSL to one of the other sockets and it wouldn't know any better.

I had presumed that at some time possibly when the GPS and Wifi were both on at home, it matched the external IP against the GPS location?

I'd guess that it also remembers the SSID from the wifi, and uses that as a validation step against the IP address.

It actually just uses the WiFi BSSID (effectively the MAC address of the access point), which obviates the need to perform any active communication with the AP, It also means that the SSID is irrelevant.

This is a myth that somehow steamrollered into being and internet fact in a very short space of time!

I thought it was a bit odd when the article first came about all those months ago.

Hrm, I'll have to check again when I can do so in a more isolated location. If it is a myth, it was pretty convincing, and speaks highly of how well the WiFi location system does work.

Certainly when my iPad 2 is tethered to my iPhone 4 via Bluetooth the iPad has accurate GPS data. We use it often while traveling in the car for live mapping, and my iPad 2 is the WiFi only 3G model (but without an active SIM card) which does not have it's own GPS receiver.

I have not tested whether the GPS data is also available to the iPad when tethered to the iPhone via WiFi Personal Hotspot, without Bluetooth.

Edit: I have two iPads, one with 3G and one WiFi only. I may be in error as I have used both in the car, but apparently I have not have properly verified map updates with both.

About to update iPad to iOS 5 and new iPhone 4S. Will report back later.

Here's a section from the FAQ from the Motion-X (Makers of GPS Software in the App Store)



http://gps.motionx.com/iphone/faq/#12

Theres also a couple of links inside that which show why this is false.

Finally verified this, and indeed, it is a myth. Would be cool if Apple did add this though somehow, especially if it was done as a Bluetooth gos setup to work with other devices too.

My testing spot was some random highway exit in New Mexico. The area was so unpopulated, they didn't bother to name the exit. The iPad couldn't find the location via wifi or Bluetooth tethering.

The good part of the experiment, using star walk to find tons of constellations in the night sky. Always fun to do this where the stars visible number well into the thousands.

I'll bet you missed the stars during your time in the OC.

Just another question regarding this Skyhook system. I've read through their website, and it seems you need to submit your wifi access point to them in order for it to work.

Then I'm wondering how the system was able to pinpoint my location so accurately, since I'm 100% sure I've NEVER registered anywhere that I've got a Wifi router. I'm pretty sure my neighbours haven't either since they are not really technology savvy. Then how does this system receive its data?

http://www.skyhookwireless.com/howitworks/coverage.php

they have cars driving down streets with gpses and logging access points as they drive by.

Dammit! Me thinks it's time for a new router!

Just change the MAC address and SSID.

Even more fun would be to "swap" MAC address and SSID with lots of Internet Contacts/Friends at distant locations. "Why does my phone say I'm in Alaska??"

Heh! Yeah, that would be cool! Now, an SSID is changed easily enough. But how do you change a MAC address?

Edit: read up a bit on MAC cloning. Doesn't seem all that difficult, but the router must support it.

Chaos gains another toe hold.

How about we all change to the ssid and mac address to that of someone in Hell, Michigan.

It's a standard feature of the common replacement firmwares (eg. Tomato, DDWRT, ..).

Am I the only one to think this is a bit scary, at least the fact that this is not at all being shared with general audience (at least, not here)? I had only >read< about the possibility of tracing back to your location these ways, a while back, but did not know it was actively being done.

No, you're not the only one. This is where that mac cloning feature comes in. But in a way it's sad one has to resort to these kinds of measures to protect one's privacy.

What kind of information do you think could possibly be gleaned from that data? There's nothing that identifies anything about you in your MAC address and SSID (unless you specifically put personal information in your SSID). It's merely being used as a beacon. That said, if you're really that concerned about it, stop transmitting radio waves into public areas.

..and they know when he's at home (or not) from the geolocating data.

Who is "they"? My Wifi access point doesn't indicate if I'm home or not. And if someone buys an iOS powered device, it specificially asks about using location features (where wifi locating would be used, along with cell towers and gps in appropriately equipped units). If its off, no one knows. If its on, only the services the person chooses knows the location, and it's only easily accessible if the user chooses to post location somewhere. This stuff all defaults to off and forces the user to make an active choice to turn it on.

Sure, with cell tower info, it's somewhat easy for the phone company to know where someone is, especially with E911 laws mandating this. But that's separate from wifi, and has been a general "concern" since cell phones existed, due to how they have to work. Or really any radio transmitter in general. And sure, someone local could have the right radio scanning equipment and use it to track my phone. I accept this as a minor risk to have the convenience of a phone usable nearly anywhere.

I would think that your telephone directory is compromising your privacy more than whatever info might be gleaned from your SSID and your MAC address. There you are, putting out your name, your address, your telephone number, even [sometimes] your marital status, for every nefarious ne'er-do-well to peruse at his leisure.

tanstaafl.

Heh. I don't know if that's possible where you live, but I simply opted NOT to be registered in the telephone directory. Saves me a lot of time from those pesky tele-marketing companies as well.

In the US, opting out of the directory only opts one out of the alphabetical one they deliver to clients. There is also an address based one that you'll still be included in, and that's the one the telemarketingscum will be using.

Don't they just autodial sequential numbers? Holding back only on the do not call nos.

They do. Some autodial and log when a voice answers, and then you're called by everyone...

Using the street book has it's dark side, they'll say your neighbour bought whatever (like some public service thing that has nothing to do with the public service).

That's not my point, actually. My point is that pieces of info I created locally for my personal local use - my SSID - is being sent over to some other organization who uses it to provide a service to me. This is perfectly fine with me, and possibly a great idea, provided I am told before, and I agree in doing this (which I would do, in this case). Instead, i don't seem to see any sort of information sheet, or clear disclaimer anywhere, in my iPad2, that tells me this.

Also, the fact that my SSID is being bradcasted locally, within the range of my WAPs, is not a good justification to send that info via the internet to somebody else, as that is not my intended use of that piece of info.

The issue I personally see here is not technical, but rather ethical. And legal as well.

The fact that, as usual, the legal system is lagging behind tech development and failing to understand it is in this and all similar privacy-related cases proving a de facto privacy risk for people. If Apple can take the SSID and use it without asking the consumer (which, pratically means whitout a **very** significant liability risk for Apple), then why can't Apple get the brand and model of my router for marketing research, which is still pretty ok, or for profiling, which is possibly less ok depending on what type of profiling, or my firmware version to find out if I am vulnerable to this or that bug / backdoor, or what not?

Again, I am using Apple as an example. I don't intend to make this a brand-centered discussion. I am talking in general.

Here in Italy we've had some scaldals related to phone companies working for secret services gathering a lot of intel from citizens' phone calls and ip traffic without any legal justifications, and they got away with the IP-related part because actually no law existed to make that type of "tapping" actually illegal. Not that a law can prevent this type of abuse completely but at least I would make it clearly illegal.

You're broadcasting that information into public areas. The iPad is not collecting that information; Skyhook (or whoever) is driving around and collecting that information. If you don't want your SSID to appear in public, stop transmitting it into public areas.

Are you sure about that ? I was under impression that they did collect location data for SSIDs when you turned on Location Services.

"Apple and its partners and licensors may provide certain features or services through the Service that rely upon device-based location information, which use GPS (where available), along with crowd-sourced Wi-Fi hotspot and cell tower locations. To provide such features or services, where available, Apple and its partners and licensors must collect, use, transmit, process and maintain your location data, including the real-time geographic location of your device, and you hereby agree and consent to Apple's and its partners' and licensors' collection, use, transmission, processing and maintenance of such location data to provide such services. In addition, by enabling and/or using any location-based services or features within the Service (e.g. Find My iPhone, Find My Friends), you agree and consent to Apple and its partners and licensors transmitting, collecting, using, processing and maintaining information related to your iCloud account (“Account”), and any devices registered thereunder, for purposes of providing such location-based service or feature to you, and use of your location data and location search queries to provide and improve location-based and road traffic-based products and services. Such information may include, but is not limited to, your Apple ID, device ID and name, device type and real-time geographic location of your device at time of your request. You may withdraw this consent at any time by not using the location-based features and turning off the Find My iPhone, Find My Friends, or Location Services settings (as applicable) on your device and computer. When using third party services that use or provide location data as part of the Service, you are subject to and should review such third party's terms and privacy policy on use of location data by such third party services. Any location data provided by the Service is not intended to be relied upon in situations where precise location information is needed or where erroneous, inaccurate, time-delayed or incomplete location data may lead to death, personal injury, property or environmental damage. Apple shall use reasonable skill and due care in providing the Service, but neither Apple nor any of its content providers guarantees the availability, accuracy, completeness, reliability, or timeliness of location data or any other data displayed by the Service."

http://www.apple.com/legal/icloud/en/terms.html

If turning off your SSID beacon is inconvenient and you don't want to be in a location database, you can add "_nomap" to the end of your SSID.

I think we're conflating two different issues: (1) The gathering of SSID information in order to build a database of location beacons. (2) The use of these to locate me (my phone).

Arguably, gathering the SSID information isn't an invasion of privacy, any more than cell tower triangulation is.

Using that information so that I can figure out where I am isn't an invasion of privacy either.

Making available information about where I am (whether gathered by GPS, SSID triangulation, cell triangulation or an inertial navigation system built with the compass and accelerometer) is an invasion of privacy.

.. except if/when they also retain that location information themselves.

Arguing semantics: Doesn't matter so long as that information's never made available in a form where I can be individually traced. But, yeah. Still a different issue to me broadcasting my SSID.

So, they did create a disclaimer, but they did not advertise it or point users to it very effectively, I think.


Again, this is related to how Apple built its location-DB.
I'm not talking about that (and even there, there's a fine like between what can and cannot be done with info available in pulic areas, but still...).
The issue is that when you ask your iPad where you are, your SSID/BSSID is taken from your WAP and sent to Apple -> over the internet <-. Which requires a disclaimer, at least. Obviously, I would add.

You're asking Apple to tell you, over the internet, your physical location, and your concern is that they know your SSID?

Keep in mind what is sent is not just your wifi spot, but every one the device can see. And the Apple servers simply use this info to initially seed the search, and in turn, the servers then send back all the wifi spots over a large area near you. From my understanding, the device never transmits the signal strength, and all the actual precise triangulation is performed on the device. If you are in Maps searching for directions, it also sends down the spots along the route, allowing for some navigation assistance while in route.

This info is being sent over the Internet much more frequently now, after the location gate cache scandal changed the retention of this data to be limited to one week on the device. It's unfortunate too, as I have noticed the reduced speed in acquiring my location after this change was made.

I also don't really understand the privacy concern here. For Apple devices, every user must opt into location services. On any iOS 5 device (upgraded or new) disclaimer is readable right from the initial spot where prompted to turn it on. How much more prominence does this info need? And do you have similar privacy concerns when your device requests map data around it, possibility revealing that you are looking for directions in an area?

My concern is that info from my PC, which I never intended to share with company X -->not even when I ask for my position on the planet <--, is instead sent over without my approval to company X, and without clear information being provided upfront.
If that happens, yes, I am concerned, and I predict problems.

You may have heard of scandals here and there due to similar behavior by organizations (Governmental, non governmental) or individuals.

I will politely ignore any future reference in this thread to "SSID", to avoid confusion. Don't take it the wrong way.

If I'm a little bit lost, and I'm walking past your house, should I be required to knock on your door before I can look at the house number (which is clearly written on your front door) to aid in my navigation?

That's different.

By appying your logic, I could then have my employees come to your house, install cameras in your garden just outside it, and use your internet connection to have live feed broadcasted to my headquarters, and that would be fine because I could be walking outside your house and see it, couldn't I?

The problem is that software on my PC must do what I expect it to do, and must provide precise and clear info, easily accessible, on what it does. Then, if I don't read the disclaimers, if I don't understand the technology, well, that's another story.
I don't expect software on my PC to get MAC addresses and SSID, as well as HDD usage patterns, or brands and models of my hardware components, or how long I keep my pc on, and send it via the internet to Apple, or Microsoft, or RedHat, or Amazon.

Unless I agree in doing so.

Agreed!

Looks like this myth could be a reality down the road, using a new Bluetooth profile:

http://www.theverge.com/2012/3/21/2891785/bluetooth-gnss-profile-1-0-specification-adopted-sig