negative zero

Determining Location from Wi-Fi

2020 August 29

[info] [privacy] [tech]

Today I decided I wanted to look up maps to a location. I don't have a great way to do this in general, as I'm generally unwilling to run JavaScript code in my browser, which severely limits my options for maps services. But I recently rediscovered GNOME Maps, and I thought it would be worth giving it a try.

So I installed the gnome-maps package from dnf and started it up. To my surprise, it placed a little pin on the map indicating my location, and it was very accurate. It didn't pinpoint my exact building, but it placed me just down the road. I was shocked! I hadn't realized it was possible for my computer to figure out where it was.

Of course, this is what it's supposed to do, so let me contextualize why this was surprising to me. I'm using a desktop computer. It doesn't have a GPS device anywhere in it, nor a cell modem. The only device networking it is a USB Wi-Fi dongle. This identification had to happen over Wi-Fi. I know one's IP address can be used to approximate one's location (like the city you're in or near), but I was connected to a VPN server in another country, and GNOME Maps placed me in a location I could see from my window.

So how did it do this? Well, GNOME Maps uses another piece of software called GeoClue (in Fedora as geoclue2) to determine your location. Here's how it works for Wi-Fi:

  1. GeoClue gets a BSSID from your Wi-Fi access point (such as your router) and possibly other Wi-Fi access points nearby. This is a unique identifier (which may be the MAC address of the device).
  2. This BSSID is sent to Mozilla, which returns the location of the device.

How does Mozilla know where all these devices are? Well, they have programs which have users collect and send them this data. Firefox for Android can do this if you enable it, and Mozilla Stumbler for Android exists for this purpose.

What if you don't want this?

Personally, I'm not comfortable with Mozilla getting a ping asking about my address every time I want to look up a map. (No, I don't trust Mozilla to be the benevolent keeper of my data. But that's a topic for another post.) GeoClue is a mandatory dependency for GNOME Maps (at least on Fedora) and appears to be installed by default in Fedora (at least the GNOME and Xfce versions), but it runs as a SystemD service, which you can stop and prevent if you want:

sudo systemctl stop geoclue.service

sudo systemctl mask geoclue.service

(Note: You have to mask the service, not just disable it. To "mask" a service creates a symlink to /dev/null, preventing anything from starting that service. Disabling the service only stops it from running at startup. When GNOME Maps starts, it also starts the geoclue service even if geoclue.service is disabled. Other programs may do this as well.)

Note also that this simply stops that particular program, but other programs could still do this lookup themselves.

If you want to stop Mozilla and some other organizations from collecting this data about your Wi-Fi access point, you can append "_nomap" to your SSID (the name of your network). For example, if your Wi-Fi access point is named "Black Lives Matter" then you could rename it to "Black Lives Matter_nomap". Some organizations will respect this method of opting out. Some will not. See this Wikipedia page sections "Privacy concerns" and "Public Wi-Fi location databases" for more information.