Microsoft Exposes Locations of PCs and Phones

suraj.sun sends this excerpt from CNET: "Microsoft has collected the locations of millions of laptops, cell phones, and other Wi-Fi devices around the world and makes them available on the Web without taking the privacy precautions that competitors have, CNET has learned. The vast database available through Live.com publishes the precise geographical location, which can point to a street address and sometimes even a corner of a building, of Android phones, Apple devices, and other Wi-Fi enabled gadgets. Unlike Google and Skyhook Wireless, which have compiled similar lists of these unique Wi-Fi addresses, Microsoft has not taken any measures to curb access to its database."

Comments

So?

[YodasEvilTwin]

All the full article really says is that someone could tie a MAC address to a location. So? Knowing your MAC address gives me almost no information about you -- nothing personally identifiable, anyways, unless I have an unrelated method of attaching your MAC to you personally (such as having physical access to your phone...). So the information is entirely useless for someone trying to invade your privacy, unless there's something I'm missing (that wasn't included in the article).

Re:So?

[John.P.Jones]

I see you on the street and decide to target you, I sniff some packets and learn your MAC address. I then use this MAC address to find where you are/have been/will be. The point is the connection between you and a set of MAC addresses is random but pretty static which can then be indexed to learn a lot about your locations.

Re:So?

[hawguy]

All the full article really says is that someone could tie a MAC address to a location. So? Knowing your MAC address gives me almost no information about you -- nothing personally identifiable, anyways, unless I have an unrelated method of attaching your MAC to you personally (such as having physical access to your phone...). So the information is entirely useless for someone trying to invade your privacy, unless there's something I'm missing (that wasn't included in the article).

Or, if I know my ex-gf's phone's or home access point's MAC address, I could find out where she moved when she told me to leave her alone and stopped answering my phone calls and emails. Makes it easier to pay her a surprise visit and convince her to take me back. Once she sees that I tracked her down and followed her halfway across the country to sit at her doorstep and wait for her to come home, she'll be bound to want me back. Fortunately, the MAC was captured from her phone while she was at work and at he gym, so I can always meet her in one of those places if she spots me at her house.

Re:So?

[adolf]

So the information is entirely useless for someone trying to invade your privacy, unless there's something I'm missing

Suppose that there is a method to determine (with reasonable certainty) what your wireless MAC address is.

Suppose this method is just as simple as driving by a location where you are known to be present (ie: at home) while you're using WiFi.

What then?

Or: Suppose that you have legal reasons to be paranoid, and physical access to the device by armed thugs with jackboots is only a warrant away.

What then?

Or. Suppose that an app on your phone calls home with your MAC address.

What if it also knows your phone number?

What then?

Sharing your personal information

[DickBreath]

Sharing your personal information is part of Microsoft's efforts to be more open.

Isn't this just being more honest?

[m50d]

The only difference is that MS are letting us see what they have. Google have collected the same data and more. (And bear in mind anyone with a fleet of vans could do the same). When it comes to violating my privacy, I don't think I have more faith in any of these companies than I do in random strangers on the internet.

Well...

[msauve]

Their security consultant, Mark Zuckerberg, said it was OK.

Re:wut?

[NoNonAlphaCharsHere]

You make it sound as if Microsoft does anything in a premeditated fashion. Stuff just happens and then it bubbles up until the lawyers and marketroids find out about it.

Re:wut?

[GameboyRMH]

Google: I caused a screwup.

Microsoft: That's not a screwup. THIS is a screwup!

Re:Question...

[ElectricTurtle]

Ignore the idiot who doesn't know where his shift key is. It's not the same. Most wireless networks broadcast a beacon signal that informs nearby receivers the name of the network and other information. Triangulating this signal which is public in its very nature is neither illegal nor unethical.

Google was capturing the packets being broadcast within the networks themselves by other clients. So a system authenticating with a server in plain text (which happens too often) would have the authenticating information (user/password) intercepted. Depending on the view one takes of open networks, this probably violates the Electronic Communications Privacy Act, or at least its spirit.