Locking out private wifi devices

[drinkingbird]

For BLE, randomization does apply - which is the typical use case for BT tracking in commercial settings...

Bluetooth security

Apple provides numerous security features for the two types of Bluetooth it supports: Bluetooth Classic and Bluetooth Low Energy (BLE).

support.apple.com

Appears to be only on IOS at this point, but a move in the right direction. But that means these stores are going to start sniffing your cellular connection probably.

 

[sfx2000]

But that means these stores are going to start sniffing your cellular connection probably.

Yes and no...

With LTE/5G, the stores don't have access to the radio data directly, however the Wireless Carriers may sell your information to them.

ATT, T-Mobile (and I assume Verizon) here in the US - one can opt out, but one has to do the opt-out, as the default is opt-in. Calling customer care can do the opt out, or one can do it from the account page on their websites.

With US MVNO's (like Cricket, Mint Mobile, MetroPCS, etc), depends on them - one should call their customer care if one has any questions.

 

[drinkingbird]

Yes and no...

With LTE/5G, the stores don't have access to the radio data directly, however the Wireless Carriers may sell your information to them.

ATT, T-Mobile (and I assume Verizon) here in the US - one can opt out, but one has to do the opt-out, as the default is opt-in. Calling customer care can do the opt out, or one can do it from the account page on their websites.

With US MVNO's (like Cricket, Mint Mobile, MetroPCS, etc), depends on them - one should call their customer care if one has any questions.

They can still sniff hardware IDs and if those IDs don't change, track your phone over time. Though I believe in many cases cellular modems actually use a dummy non-unique MAC address, there are supposedly still some bits that can be sniffed and tracked.

But in reality, the maker of the OS (Google and Apple) are storing plenty of data on you and selling it to anyone who wants it. Even if you disable location history in your account, they've been caught storing that data. I'd much rather a store track my MAC address (which they can't associate back to an actual person unless I log into my account on their website or launch their app while on their wifi) than history of all my locations with all my identifying info attached to it.

Honestly its happening no matter what measures you take to prevent it, they figure out new ways. I have bigger things to worry about, our privacy has been gone for decades now.

 

[dfunked]

Not sure about iOS, but for Android at least it's a per network setting and not an overall setting for the device. You can disable it for your home network and still make use of it on public networks, where as a security setting it actually makes sense.

I tend to turn it off at home on each of my devices, just so I can do stuff like use MAC address filtering to force devices to use specific bands.

 

[Yota]

Though I believe in many cases cellular modems actually use a dummy non-unique MAC address

Yes, there is a globally unique ID called International Mobile Equipment Identity(IMEI) for each phone, and it cannot be changed (change is even illegal in some jurisdictions) It is often used for law enforcement and mass surveillance, when cell phones are connected to telecom operators' towers, the IMEI is a necessary condition when connecting.

But before iOS 5 (maybe iOS 4, I can't remember), any app on the phone could get the IMEI, so Apple banned apps from the app store from getting the IMEI in a later iOS update, which was around 2012 year thing.

This is very late compared to Android. Before Android 10 (2019), any app could obtain IMEI by requesting "phone" permission. Google finally fixed this long-standing privacy hole in Android 10.

But today, the IMEI is printed on the phone's box, on the laser engraving of the phone body, on the phone's settings page, and although unprivileged apps from the app store can't get that information today, you can't hide or change that information, except by putting the phone in airplane mode, otherwise it will always be shared with the operator, even if you change the SIM card and phone number, the operator will still know the phone.

International Mobile Equipment Identity - Wikipedia

en.wikipedia.org

 

[drinkingbird]

Yes, there is a globally unique ID called International Mobile Equipment Identity(IMEI) for each phone, and it cannot be changed (change is even illegal in some jurisdictions) It is often used for law enforcement and mass surveillance, when cell phones are connected to telecom operators' towers, the IMEI is a necessary condition when connecting.

But before iOS 5 (maybe iOS 4, I can't remember), any app on the phone could get the IMEI, so Apple banned apps from the app store from getting the IMEI in a later iOS update, which was around 2012 year thing.

This is very late compared to Android. Before Android 10 (2019), any app could obtain IMEI by requesting "phone" permission. Google finally fixed this long-standing privacy hole in Android 10.

But today, the IMEI is printed on the phone's box, on the laser engraving of the phone body, on the phone's settings page, and although unprivileged apps from the app store can't get that information today, you can't hide or change that information, except by putting the phone in airplane mode, otherwise it will always be shared with the operator, even if you change the SIM card and phone number, the operator will still know the phone.

International Mobile Equipment Identity - Wikipedia

en.wikipedia.org

Yeah not too worried about retailers being able to see your IMEI by sniffing radio traffic, as the only way that would work is if they had a cellspot in the store that you connect to. But there is other data in there too. As far as apps being able to access the IMEI - doesn't matter that much since the app can collect much more valuable data about you through many other permissions that you must grant them for the app to work.

 

[sfx2000]

Yeah not too worried about retailers being able to see your IMEI by sniffing radio traffic, as the only way that would work is if they had a cellspot in the store that you connect to. But there is other data in there too. As far as apps being able to access the IMEI - doesn't matter that much since the app can collect much more valuable data about you through many other permissions that you must grant them for the app to work.

Even if there is a cellspot in the store, one cannot ID the IMEI unless it's whitelisted in the cellspot UI

The connection across the 3GPP iuh interface is ipsec, iuh being the femtocell to gateway interface inside the EPC