[tombrossman]

I did a talk on privacy topics from a user's perspective at a small 'tech fair' this weekend and I was delighted to see this tweet showing a map of the venue showing everyone's precise location: https://twitter.com/johnebridge/status/662984007370612736

I was able to add it to the slide deck just in time and people were genuinely surprised by it. It's a good thing that the company were transparent about it and shared the image but for many non-technical attendees it was a bit of a wake-up call.

"Do you use the free WiFi at the local supermarkets?" "Did you buy a bunch of liquor and condoms, and then come back a few weeks later and buy pregnancy tests?" "Did you think you were pretty slick because you paid cash?" The audience's eyes getting bigger and bigger...

[conductor]

With face-recognition software using CCTV cameras pointed at your face while in the checkout lane they will recognize and profile you, credit card or cash, WiFi or no WiFi. At least, the technology is there.

[shostack]

Can you share more around how that map was generated?

[atomwaffel]

Not the original poster, but when you sign into a Wi-Fi network, the router needs to know where to send the packets, so it needs to have a way to identify your device. That's why all devices that can connect to a network have what's called a MAC address[1] – a very long number that is unique to your device. Your device also broadcasts that address when it scans for networks, so just about all the time. When you control several access points and a few of them see the same device at the same time, you can triangulate the location of that device down to a few metres.

The company I used to work for did something similar[2] at a conference over the course of three days. (You can drag on the map to highlight individual devices.) It's really cool and really quite creepy.

[1]: https://en.wikipedia.org/wiki/MAC_address

[2]: https://apps.opendatacity.de/relog/

[shostack]

Really helpful, thanks for sharing.

Is disabling wifi when you are not connected sufficient to stop this sort of tracking?

[atomwaffel]

I'm not an expert, but yes, when you disable Wi-Fi, your device will stop scanning for networks and broadcasting your MAC address, so you can no longer be tracked that way. More recently, phones have also started randomising MAC addresses while scanning (starting in iOS 8, I don't know about others), so you can only be tracked for a short time as long as your Wi-Fi is on but not connected.

[tombrossman]

I have no idea, sorry. I just happened to see it when someone else re-tweeted it and it looked perfect.

The service was provided by JT Global (website here: http://www.jtglobal.com/jersey/) and Purple WiFi (http://www.purplewifi.net/) so you might try following up with them? I don't know any of the people involved, I just showed up for my talk and left soon after.