OT: Great WiFi Security Tip: _nomap

musicvid10 wrote on 10/27/2013, 1:07 PM
Did you know Google knows the exact location of your wifi router, and that location is available on Google Earth and Maps?

They don't do this by drive-by scanning from Street View cars any more. That stopped a couple of years ago after they got caught doing bad things.

Most of us have wifi-enabled cell phones and tablets. Many of us don't know or care whether location services are on or off on our devices. Many people actually like the shopping convenience and safety of being able to find themselves or their device if either is lost. I sometimes turn mine on when away from home.

Geotracking uses GPS, cell-phone towers, and wifi connections to find out where you are. Once Google knows where your Wifi router is, the information is stored by SSID.

Here is how to opt out of mapping your router's precise location with Google when you or your guests are home with a wifi enabled device. Maybe 1% of us know this trick, but 100% should be using it.

https://support.google.com/maps/answer/1725632?hl=en

Comments

farss wrote on 10/27/2013, 3:21 PM
[I]"Maybe 1% of us know this trick, but 100% should be using it."[/I]

It's not a trick and it does nothing to improve security.

Google are simply providing a way for you to notify them you don't want your WiFi access point in their database. You'll still be broadcasting your SSID to the world and it's not at all hard for anyone to determine its location by triangulation.

As Google rightly point out this "trick" only works by convention, Google have promised to respect it but they're not the only ones out there.

If you want to improve security disable SSID broadcasting. Then guests need to be told your SSID before than can connect. Even this is not 100% effective as sniffers can detect the SSID anyway.

Bob..

Steve Mann wrote on 10/27/2013, 6:38 PM
And, this is a problem... why?
musicvid10 wrote on 10/27/2013, 6:56 PM
No, it means that some uninvited "service" won't pinpont my router or SSID on Google Earth or Maps, such as I discovered was being done a 1-1./2 years ago. Although I see Cisco has since disconnected the public Meraki Mapper, I'm sure there are plenty of others out there.
http://www.sonycreativesoftware.com/forums/ShowMessage.asp?ForumID=4&MessageID=760507.

_nomap is another layer of privacy if not security, in a time when both are in short supply.

Also, not broadcasting your SSID in the beacon provides no added security whatsoever, and may actually attract more attention from passing scanners. Not recommended.
farss wrote on 10/28/2013, 2:38 AM
[I]"Also, not broadcasting your SSID in the beacon provides no added security whatsoever, and may actually attract more attention from passing scanners"[/I]

I believe I already mentioned in my original post that it will not stop anyone determined but I can assure you within hours of my advertising my SSID several neighbours were trying to use my network.

I'd also imagine appending "_nomap" to your SSID will also attract attention.

If what you're worried about is someone finding out where you live good luck with that. It's been demonstrated to me that almost anyone who posts anything on a forum can be found in minutes and that's in Australia where there's a few more impediments than in the USA.

One of the biggest security problem we all face as I found out the hard way is email. Virtually every ISP's email servers are also web facing and very easy to hack into, once your email can be intercepted you can be in for a rocky ride. Apart from the usual cautions regarding passwords make certain none of your email is being left on your ISP's servers.

Bob.
musicvid10 wrote on 10/28/2013, 3:41 PM
"And, this is a problem... why?"

UPDATE:
It's enough of a problem that in the last thirty days, a US federal judge has ruled that Google can be sued for drive-by data collection, Google has taken down the public GEAR Geolocation API, and the drive-by data has disappeared from all of their maps and those being used by other services.

Apparently, the only wifi router data collection Google does now is through Android users, who specifically give Google permission to do so whenever they turn on Android Location on their phone or tablet and connect to an AP.

I can confirm that with the _nomap suffix on my SSID, Google still sees my home router when Android Location is turned on, but it no longer sticks to Google Maps, and the location disappears rather quickly once I turn the service on my tablet off.

So all around, it looks like a victory for home privacy advocates. I sure don't mind sharing my router with guests, but as bob correctly points out, private routers and networks can be cracked by any number of means. And given the correct address, so can one's front door.

Somehow, giving our precise location on a Google Map to all the jokers in the bars a half-block up the street just didn't seem to have much appeal for me.
EOR
Steve Mann wrote on 10/28/2013, 10:40 PM
" in the bars a half-block up the street "

That explains a lot (LOL).
musicvid10 wrote on 10/28/2013, 11:10 PM
Yep, it's true; still a great neighborhood, and my SSID remains socially neutral.
;?)
Chienworks wrote on 10/29/2013, 1:27 PM
I've wandered through the park across the street from my house and overheard people with their smartphones mention my, admittedly bizarrely ridiculous many-syllabic SSIDs and say "what the heck are these?" Meanwhile, almost everyone else in the neighborhood uses their family name for theirs.
musicvid10 wrote on 10/29/2013, 2:22 PM
One of my neighbors, not sure who, goes as the "FBI Surveillance Van."
Guess it's to keep people away from his router.

Another thing I found out is that WPS is a big security hole. The manufacturers are recommending that after initial setup, we disable the router's PIN or WPS permanently.
Chienworks wrote on 10/29/2013, 5:20 PM
Even with location services enabled on my android phone, Google usually thinks my wifi access points are in New Jersey, about 120 miles southeast of my house, or sometimes Google thinks it's in Maryland (the village, not the state), which is about 30 miles northeast of me. They have sometimes reported that i live at TimeWarner's headquarters in NYC, and once or twice has reported that i'm in Dallas.

Obviously for some odd reason they're using an IP->Geo lookup table which is sketchy and often out of date, rather than wifi triangulation. I suppose that's probably because they've never sent their trucks through my rural neighborhood.
musicvid10 wrote on 10/29/2013, 10:35 PM
Android Location generally finds me within 20 feet or so.
It only gets interesting when I turn the service off. "Last known location" was in the ocean somewhere off the west coast of Africa.

"Major Tom to Ground Control . . ."

Chienworks wrote on 10/29/2013, 11:03 PM
Oh, when i'm on cellular data network they have me pegged to within 20 feet, and the GPS is likewise as accurate. It's only when i'm on my wifi at home that they seem to use the incorrect IP address/location lookup instead of what the GPS tells them. (*shrug*)
musicvid10 wrote on 10/29/2013, 11:24 PM
GPS does have its good side.
In 2009, I was stuck alone in a warehouse elevator.
It took several tries, but once I got through to 911, they locked on and fire rescue found the elevator in about 20 minutes.