If you pass by a café that operates a WiFi network, you can be identified – even if you do not carry a smart phone with you. Researchers of Karlsruhe Institute of Technology (KIT) have found out that it is possible to identify people solely through WiFi signals. They point out that this constitutes a significant risk to privacy. To infer the identity of persons, it is no longer necessary that they carry a smart phone or tablet on them. It takes nothing but WiFi devices communicating with each other in the person’s surroundings. This creates an image comparable to a camera shot, but based on radio waves. The research team calls for adequate privacy safeguards.
Even the abstract doesn't explore the angles required, the image potential from the data (or lack thereof) and how granular of an image it could create. If I'm not carrying a device, does it see...
Even the abstract doesn't explore the angles required, the image potential from the data (or lack thereof) and how granular of an image it could create.
If I'm not carrying a device, does it see the freckle on my nose when I pass it or does it just see Signal Lost and Signal Regained?
I suppose one could perhaps send false BFI, or be "noisy" to perhaps make it harder to identify. Though if you're the only one yelling, it's not exactly hard to discern who's yelling. From their...
I suppose one could perhaps send false BFI, or be "noisy" to perhaps make it harder to identify.
Though if you're the only one yelling, it's not exactly hard to discern who's yelling.
From their paper:
since BFI identification capabilities were still unknown,
we also purposely collected the dataset under controlled condi-
tions, for instance regarding the clothing of individuals. As these
restrictions were meant to ensure that the gait of subjects could
be recorded by preventing clothing from obstructing it, we may
be overestimating the identification potential of BFI.
Perhaps wearing long leather jackets like in the Matrix is good enough :^)
This wouldn’t really work, since the concept in the paper was to use beamforming information that you happen to be walking in the middle of (basically). So you couldn’t fake the signals; you’d...
I suppose one could perhaps send false BFI, or be "noisy" to perhaps make it harder to identify.
This wouldn’t really work, since the concept in the paper was to use beamforming information that you happen to be walking in the middle of (basically). So you couldn’t fake the signals; you’d have to change your gait or something similar. But this is a completely infeasible attack in real life anyway so it probably doesn’t matter too much. :)
I wonder if there are materials that can absorb or disrupt signals enough to foil this sort of thing. This is making me want to live inside a Faraday cage.
I wonder if there are materials that can absorb or disrupt signals enough to foil this sort of thing. This is making me want to live inside a Faraday cage.
I can see it now, victorian trench coats in style to avoid WiFi IDing you, combine that with the airships coming out and maybe a steampunkish future is possible! :D
I can see it now, victorian trench coats in style to avoid cameras WiFi IDing you, combine that with the airships coming out and maybe a steampunkish future is possible! :D
This reminds me of something I came across a while ago, which is how WiFi can be used to map the position of human bodies. From Popular Mechanics in 2023. Quote from the paper: Link to the paper:...
This reminds me of something I came across a while ago, which is how WiFi can be used to map the position of human bodies. From Popular Mechanics in 2023.
Quote from the paper:
“We developed a deep neural network that maps the phase and amplitude of WiFi signals to UV coordinates within 24 human regions. The results of the study reveal that our model can estimate the dense pose of multiple subjects, with comparable performance to image-based approaches, by utilizing WiFi signals as the only input.”
I have been wondering about the utility of this mechanic in a smart home for more comprehensive presence sensing (we've been having issues with the Aqara FP2..).
I have been wondering about the utility of this mechanic in a smart home for more comprehensive presence sensing (we've been having issues with the Aqara FP2..).
You should check this out then: https://news.ycombinator.com/item?id=45684230 Basically someone has implemented motion sensing using esp32 devices and integrated it with home assistant.
Less than zero. From a technological standpoint it’s extremely cool, but from a practical standpoint - thank god! - worse than useless. The tech relies on sniffing beamforming configuration...
Less than zero. From a technological standpoint it’s extremely cool, but from a practical standpoint - thank god! - worse than useless.
The tech relies on sniffing beamforming configuration messages between myriad devices and routers and then analyzing them to see how someone walking through them changes things. So far, so scary. But one needs to think about how that works outside a laboratory setting. How would any actor manage to sniff enough packets from enough devices to actually track you? They would need to either be physically following you with specialized equipment or already know where you were going to go and have pwned the routers along the route. In either case, we’re talking some sort of intelligence agency dedicating personal effort against you… and then why wouldn’t they just either tell the guys who are following you “hey, just tell us what she’s doing” or use cameras?
Functionally it’s impossible to construct a realistic scenario where someone is using this technology against you and there wasn’t a thousand easier ways to do that. Infinitely worse is something that people don’t really talk about anymore - the deanonymization of advertising IDs (primarily because they use your phone’s reported location information, so it’s specific, tied to you, and accurate).
Edit to add: The authors of the paper sort of acknowledge this, but in my opinion it’s basically technical malpractice for them to add “yeah but someday it might become a nearly comprehensive surveillance infrastructure.” Think of how many beamforming configuration messages are exchanged between devices every minute. These packets aren’t on the internet (they’d clog the whole thing), they’re local, meaning you need physical access to get them. Who, exactly, is going to collect them all and how? Cool idea for a cyberpunk dystopia, completely fictitious in real life. The authors would know that.
I do see the impracticality with the high likelihood of noise making identifying a person much more complex. I’ll also agree with the much bigger obstacle which is requiring some form of access to...
I do see the impracticality with the high likelihood of noise making identifying a person much more complex. I’ll also agree with the much bigger obstacle which is requiring some form of access to these devices and/or networks. But I won’t dismiss the non zero chance of this technology becoming another piece of digital fingerprint tied to you as with them many other tools already present.
Where I see the value in “sounding the alarm” is due to how ubiquitous open networks are. Given how little importance some countries place on protecting personal information online, I’d say there’s a decent chance someone could attempt to monetize this technology. Maybe I’m missing something but I think this wouldn’t be used on the average person, at least not until its deployment is simplified.
Also: my thought is that there’s way too many open networks, outdated hardware, accounts with weak protections, etc that are the reasons behind most leaks today. Is it that much more to include a tool like the one mentioned on the paper when accessing these devices?
Keep in mind that BFI is not typically transmitted over the internet - it’s local-only information exchanged between a router and the device communicating with that router. So it’s not just some...
Keep in mind that BFI is not typically transmitted over the internet - it’s local-only information exchanged between a router and the device communicating with that router. So it’s not just some scriptkiddie breaking into a poorly-defended server and stealing the list of passwords in plaintext that were already there, it’s getting into a million different types of router and then installing actual malware that makes them take BFI and send it over the internet back to some sort of C2 server. Similarly, the fact that a network is open doesn’t mean you could get BFI remotely. You’d still need to be able to log in to the actual router as an administrator (or at least be physically present to sniff the network yourself.)
It’s not that it’s technically impossible, it’s that it’s technically infeasible and wouldn’t really make any sense to even try to do, if that makes sense. There’s a similar argument against monetization - exfiltrating the data overtly would be prohibitively expensive in terms of bandwidth, and for what gain? To figure out what people who don’t have phones on them are doing so that you can serve them ads later? Why not just use their adID data?
I'm so tired
If it makes you feel better, the article is heavily glossing over technical details that make this completely impractical in practice.
Even the abstract doesn't explore the angles required, the image potential from the data (or lack thereof) and how granular of an image it could create.
If I'm not carrying a device, does it see the freckle on my nose when I pass it or does it just see Signal Lost and Signal Regained?
Basically active sonar in pretty much every populated location on earth. Scary stuff
I suppose one could perhaps send false BFI, or be "noisy" to perhaps make it harder to identify.
Though if you're the only one yelling, it's not exactly hard to discern who's yelling.
From their paper:
Perhaps wearing long leather jackets like in the Matrix is good enough :^)
This wouldn’t really work, since the concept in the paper was to use beamforming information that you happen to be walking in the middle of (basically). So you couldn’t fake the signals; you’d have to change your gait or something similar. But this is a completely infeasible attack in real life anyway so it probably doesn’t matter too much. :)
I wonder if there are materials that can absorb or disrupt signals enough to foil this sort of thing. This is making me want to live inside a Faraday cage.
I think you've answered your own question!
Hah, I am going to look so rad in my aluminum foil duster.
I can see it now, victorian trench coats in style to avoid
camerasWiFi IDing you, combine that with the airships coming out and maybe a steampunkish future is possible! :DResearch Paper available here [PDF]:
https://publikationen.bibliothek.kit.edu/1000185756/168100988
This reminds me of something I came across a while ago, which is how WiFi can be used to map the position of human bodies. From Popular Mechanics in 2023.
Quote from the paper:
Link to the paper: https://arxiv.org/abs/2301.00250
I have been wondering about the utility of this mechanic in a smart home for more comprehensive presence sensing (we've been having issues with the Aqara FP2..).
You should check this out then: https://news.ycombinator.com/item?id=45684230
Basically someone has implemented motion sensing using esp32 devices and integrated it with home assistant.
Is there a reason that you would utilize this over cameras?
Less than zero. From a technological standpoint it’s extremely cool, but from a practical standpoint - thank god! - worse than useless.
The tech relies on sniffing beamforming configuration messages between myriad devices and routers and then analyzing them to see how someone walking through them changes things. So far, so scary. But one needs to think about how that works outside a laboratory setting. How would any actor manage to sniff enough packets from enough devices to actually track you? They would need to either be physically following you with specialized equipment or already know where you were going to go and have pwned the routers along the route. In either case, we’re talking some sort of intelligence agency dedicating personal effort against you… and then why wouldn’t they just either tell the guys who are following you “hey, just tell us what she’s doing” or use cameras?
Functionally it’s impossible to construct a realistic scenario where someone is using this technology against you and there wasn’t a thousand easier ways to do that. Infinitely worse is something that people don’t really talk about anymore - the deanonymization of advertising IDs (primarily because they use your phone’s reported location information, so it’s specific, tied to you, and accurate).
Edit to add: The authors of the paper sort of acknowledge this, but in my opinion it’s basically technical malpractice for them to add “yeah but someday it might become a nearly comprehensive surveillance infrastructure.” Think of how many beamforming configuration messages are exchanged between devices every minute. These packets aren’t on the internet (they’d clog the whole thing), they’re local, meaning you need physical access to get them. Who, exactly, is going to collect them all and how? Cool idea for a cyberpunk dystopia, completely fictitious in real life. The authors would know that.
I do see the impracticality with the high likelihood of noise making identifying a person much more complex. I’ll also agree with the much bigger obstacle which is requiring some form of access to these devices and/or networks. But I won’t dismiss the non zero chance of this technology becoming another piece of digital fingerprint tied to you as with them many other tools already present.
Where I see the value in “sounding the alarm” is due to how ubiquitous open networks are. Given how little importance some countries place on protecting personal information online, I’d say there’s a decent chance someone could attempt to monetize this technology. Maybe I’m missing something but I think this wouldn’t be used on the average person, at least not until its deployment is simplified.
Also: my thought is that there’s way too many open networks, outdated hardware, accounts with weak protections, etc that are the reasons behind most leaks today. Is it that much more to include a tool like the one mentioned on the paper when accessing these devices?
Keep in mind that BFI is not typically transmitted over the internet - it’s local-only information exchanged between a router and the device communicating with that router. So it’s not just some scriptkiddie breaking into a poorly-defended server and stealing the list of passwords in plaintext that were already there, it’s getting into a million different types of router and then installing actual malware that makes them take BFI and send it over the internet back to some sort of C2 server. Similarly, the fact that a network is open doesn’t mean you could get BFI remotely. You’d still need to be able to log in to the actual router as an administrator (or at least be physically present to sniff the network yourself.)
It’s not that it’s technically impossible, it’s that it’s technically infeasible and wouldn’t really make any sense to even try to do, if that makes sense. There’s a similar argument against monetization - exfiltrating the data overtly would be prohibitively expensive in terms of bandwidth, and for what gain? To figure out what people who don’t have phones on them are doing so that you can serve them ads later? Why not just use their adID data?