Worth reading http://www.theregister.co.uk/2011/05/16/android_impersonation_attacks/
and perhaps following http://forum.xda-developers.com/showthread.php?t=1086878 (ok -- maybe not -- that thread is pretty useless)
In brief:
The weakness stems from the improper implementation of an authentication protocol known as ClientLogin in Android versions 2.3.3 and earlier, the researchers from Germany's University of Ulm said. After a user submits valid credentials for Google Calendar, Contacts and possibly other accounts, the programming interface retrieves an authentication token that is sent in cleartext. Because the authToken can be used for up to 14 days in any subsequent requests on the service, attackers can exploit them to gain unauthorized access to accounts.
Announced today, apparently there will be silent OTA patches for Contacts and Calendar.
that is crazy!!!!
this made me feel a little at ease, just a little.
The attacks can only be carried out when the devices are using unsecured networks, such as those offered at Wi-Fi hotspots.
Click to expand...
Click to collapse
not sure what else to say about it.
Bloggers and media like to hype this stuff up.
Bottom line is this. Don't connect to a public wifi you don't trust, and always log in via SSL.
The issue here stems from using public wifi that allows people to sniff your traffic.
For instance:
You walk into starbucks, I'm already there and with my phone I create a mobile hotspot, I call it "StarbucksWifi" for the SSID. You're none the wiser and you connect with your phone (OR with your laptop, it's not just your phone but the media didn't share that).
I turn on Shark Mobile (Wireshark) and start capturing all those lovely packets. I then dissect them later to see your login info etc.
Again, don't connect to public wifi you don't trust or are unsure about. Starbucks uses ATT for hotspots and the wifi name is always ATT from what I remember.
fknfocused said:
that is crazy!!!!
this made me feel a little at ease, just a little.
not sure what else to say about it.
Click to expand...
Click to collapse
Not a real issue unless you're one to use unsecured wifi networks.
joedeveloper said:
Bloggers and media like to hype this stuff up.
Bottom line is this. Don't connect to a public wifi you don't trust, and always log in via SSL.
The issue here stems from using public wifi that allows people to sniff your traffic.
For instance:
You walk into starbucks, I'm already there and with my phone I create a mobile hotspot, I call it "StarbucksWifi" for the SSID. You're none the wiser and you connect with your phone (OR with your laptop, it's not just your phone but the media didn't share that).
I turn on Shark Mobile (Wireshark) and start capturing all those lovely packets. I then dissect them later to see your login info etc.
Again, don't connect to public wifi you don't trust or are unsure about. Starbucks uses ATT for hotspots and the wifi name is always ATT from what I remember.
Click to expand...
Click to collapse
Thanks.
I love hearing about this kind of stuff. It's good to keep current....now I know why they have that accept conditions page at wifi places like starbucks and mcdonalds. You couldn't create that with your hot spot...or could someone
Sent from my SGH-T959V using XDA Premium App
thanks for the info fellas. I rarely connect to wifi spots when Im out and about. Actually, the only time I do is when im home or at work. Looks like im good.
While "always log in via SSL" is a great suggestion, the Google services aren't going to go over a secure channel (unless you have VPN enabled).
The same warning should apply if you aren't using WPA2 -- the older WEP (and WPA) is still common on many "secure" wireless connections, especially home units, and takes not more than a few minutes to crack with widely available tools.
http://www.google.com/search?q=wep+crack
From http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access
WPA2 has replaced WPA; WPA2 requires testing and certification by the Wi-Fi Alliance. WPA2 implements the mandatory elements of 802.11i. In particular, it introduces CCMP, a new AES-based encryption mode with strong security. Certification began in September, 2004; from March 13, 2006, WPA2 certification is mandatory for all new devices to bear the Wi-Fi trademark.
This is what I was asking about in another post. I like to vacation where I have 0-1 bars on the phone, and motel wifi is available. I would like my pet/house sitting service to be able to call me when I'm away.
Also kid moved to England. We use Skype, Skype on Android is wifi only.
Mostly do use home WPA encrypted, but there should be some kind of safety for those who do need the service. Do not use the phone for personal stuff like banking, etc. even on a network.
And there are areas here in the west where there is no service for any carrier. Canyons are not conducive to line of site.
SGS4G does have wifi calling built in.
Related
Just got my Samsung Captivate about a month and I got my wifi connected to the school network, but when i open the broswer or any apps need internet i didnt get any connections? at the first week it works.. and when connecting to the school wifi it should be come out with the school login page,, then the internet will work.. however the wifi is connected doesnt matter how strong the wifi singal is.. it just cant load and cant bring me to the login page..
I really need help..
and the wifi works everywhere.. except my school...
btw my friends iphone 3gs works..
I am also at college and have had the same problem. the best reason I have found is the phone itself. half of our wifi is an older standard that does not work on the phone. it shows up as wep and i can not get it to recognize it as 802.1x . in my tinkering I have also messed up the wifi that was working.
long story short it probably won't work. I have spent a long time trying to get it to work with no luck
Sent from my SAMSUNG-SGH-I897 using XDA App
Hello to both of you,
I also attend a college with an 802.1x connection and the captivate supports most of these networks; however you will probably need to configure the network settings manually (usually retrievable on your schools IT site). If you dont mind digging up your settings I would love to check to see if I can configure your phone.
FYI, you might be having a problem similar to what's seen in this post.
http://androidforums.com/captivate-support-troubleshooting/142397-odd-netmask-issues-wifi.html
I definitely had this problem today. It appeared connected but no web pages would load. Going to have to investigate further. Why can't things just work
I know my school recently implemented some new security certificates that you must agree to before logging in, has anything like that changed for you? My wife's Aria is running 2.2 and can log into the school network, but my captivate cannot. It is frustrating I know.
Seems some colleges and universities are noticing issues with android devices letting the DHCP leases to expire but keeps using the IP address assigned instead of requesting a new one.
See the following links.
h t t p ://www . natecarlson . com/2010/08/27/android-att-captivates-wifi-networking-is-broken/
h t t p ://www . net . princeton . edu/android/android-stops-renewing-lease-keeps-using-IP-address-11236.html
I actually have similar issues with my Belkin wireless router at home. My laptops and other wireless devices have no problems connecting or re-connecting but the Captivate just refuses to re-connect after the connection was terminated. Even after resetting the router, the phone just keeps trying to use the same IP address for some reason.
The only way I could get it to reconnect is to either reboot the phone or to remove the AP entry which is a pain especially if you have wireless passwords.
Hopefully someone with better insight into how Eclair and Froyo handles WiFi can come up with some fix.
more solutions?
I believe the new 2.2 firmware solves this issue. I too am at College and my captivate FAILS to actually access the internet through wifi unless I statically assigned the IP.
I just updated to Froyo and it connected instantly. I'll have to do more testing to make sure, but I think Samsung finally fixed it.
captivate wifi issue at school
i just got Galaxy S (Captivate) and wi-fi is giving trouble.
when i tried at a university campus, it gives error and says can't open and try again later. it is like, i get connected to the network, IP and DNS and everything is generated. But when i open browser to open a website, instead of taking me to login page it gives the above error.
here is what i get when i try to open a website.
'web page not available'. the page might be temporarily down or it may have been moved permanently to new address.
here are some suggestions:
- check to make sure device has signal and data connection. (I made sure it is connected to wifi)
- reload page later. (i tried after 5 mins, same result)
- view cached copy from google. (doesn't work either)
i am not able to understand why is this happening. i tried restarting the phone after connecting to wifi but no luck. any pointers?
Sounds like they use a portal system which requires logon and doesn't play nice with the Captivate's browser. Unfortunately many such portal systems are written poorly and I've even seen some that only work with Internet Explorer.
You could try a different browser on the Captivate. Dolphin allows spoofing assorted User Agents, which might help.
Hey guys, I have the same problem connecting to m school's network login page. It would say connected but the website always says cant be found. But the good news is that I found a way to connect to it manually! What you need is your captivate and friends iphone 4 or 3gs. First have use your friends iphone to connect to the wifi and then go into wifi settings. You should see 2 DNS address, Ip address, netmask (subnet mask) and router address. Now jot those addresses down except the ip address. Go to settings->wireless and network->Wi-Fi settings->now tap the bottom left button under the samsung logo and click advanced. Now check use static ip. Do not enter anything for your ip address just yet (we will do this last). Now enter router address into gateway, subnet mask into netmask, DNS1 to DNS1 and DNS2 to DNS2. ok when you are done click back and tap the network you want to connect to. Once you are connected jot down your ip address by taping the network once more. now go back to where the static ip was and input the ip address you just jot down into the ip address underneath use static ip. Disconnect and reconnect to the desired network. You may have to do this a few times or reboot your phone. This has been working for me so far around different buildings but with the same school network connection. I hope this helps cheers!
sremick said:
Sounds like they use a portal system which requires logon and doesn't play nice with the Captivate's browser. Unfortunately many such portal systems are written poorly and I've even seen some that only work with Internet Explorer.
You could try a different browser on the Captivate. Dolphin allows spoofing assorted User Agents, which might help.
Click to expand...
Click to collapse
Yeah, my school uses the Bradford dissovable agent. Funny thing is, some connections work perfectly, others not at all. Technically none should work, and sometimes I feel that maybe I should tell them that sometimes somehow it is possible to bypass the whole agent thing- but why rock the boat just yet
Does it need a proxy to work? If so, this app is amazing.
http://forum.xda-developers.com/showthread.php?t=766569
I figured it out a month ago, and it is actually petty easy. But you really have to change ip address manually, usually just the last number.
Sent from my SAMSUNG-SGH-I897 using XDA App
[Q] Is it secure to use android on a public wifi? How do I protect against droidsheep, firesheep, ssl stript...?
I currently use android 2.3.4 and I would love to connect in cafeterias or places alike wich use none. wep. wpa, wpa2 or radius encryption. So that I could use skype or gtalk videocall or even youtube. But I am fearful, am I being paranoid or is it normal to be so cautious? What are the risks? Could somehow my gmail account be hijacked by just connecting to one of this networks with some malicious people around?
Should I use ssh tunneling or vpn?
Wich free vpn or ssh tunneling services would you suggest?
I also found this app, but it seems that it just creates many fake connections wifi and wifi noise so you can camouflage
[APP] Wifi Protector - Wireless Security | Anti WifiKill | Anti DroidSheep
http://forum.xda-developers.com/showthread.php?t=1350941
I've used my phone on several WiFi hotspots ever since my iPhone 3g and have never had a problem getting hacked. It's more about what kind of sites you visit and that is a problem even on a locked secure connection. If someone is good enough it doesn't matter how you protect yourself. It's not worth worrying about though as long as you know how to spot a problem when it arises. I'm sure avg from the market is good enough if you insist on using something. I have never used any of these kind of programs on my phone though.
Sent from my Desire HD using xda premium
devrruti said:
[Q]I also found this app, but it seems that it just creates many fake connections wifi and wifi noise so you can camouflage
[APP] Wifi Protector - Wireless Security | Anti WifiKill | Anti DroidSheep
http://forum.xda-developers.com/showthread.php?t=1350941
Click to expand...
Click to collapse
Well, actually it does not create any connections, no noise and you cannot camouflage with it. It passively monitors your phone for unusual network events and alarms you in case of an active attack against your phone.
Full disclosure: I'm the author.
Gizmoe said:
I've used my phone on several WiFi hotspots ever since my iPhone 3g and have never had a problem getting hacked.
Click to expand...
Click to collapse
How do you know? DroidSheep's attack cannot be noticed without a specialized app.
Gizmoe said:
If someone is good enough it doesn't matter how you protect yourself.
Click to expand...
Click to collapse
If you don't protect yourself someone doesn't need to be good. It's like locking the front door and leave the window open.
gurkedev said:
How do you know? DroidSheep's attack cannot be noticed without a specialized app.
If you don't protect yourself someone doesn't need to be good. It's like locking the front door and leave the window open.
Click to expand...
Click to collapse
To be honest. Mobile security apps are over rated. With a little common sense you will be fine.
gurkedev said:
How do you know? DroidSheep's attack cannot be noticed without a specialized app.
If you don't protect yourself someone doesn't need to be good. It's like locking the front door and leave the window open.
Click to expand...
Click to collapse
I have never had my identity stolen or noticed anything weird going on with my phone that would be a sign of hacking. Nor have I had any online accounts hacked. If someone is worried then they should protect themselves. I'm just saying that I am not worried about it and using a program to protect yourself is not 100% effective. I would be more worried about all the paperwork with your personal information sitting in filing cabinets at places where people have access to them.
Sent from my HTC Desire HD A9191 using xda premium
The issue with connecting to these public networks, or even encrypted ones, is that people usually have bad surfing practices. Your connection to the router might be encrypted, but what if someone has access to the data that the router accepts or sends to the internet.
What you need to do is always use secure protocols to access the services you need like gmail or hotmail.
Besides that, it's always good to have a radar on in case somebody has zombied your device for some delayed exploits.
It is easy to set up a fake router with your computer's WiFi or with another router, name it what you want (ssid) and the mac you want. You can then disconnect a device and make it connect to you.
Evil twin router, rogue WiFi, airpwn, man in the middle, karma, metasploit...
And I don't trust my evil neighbour
As a new XDA user involved with development, but unable to post in the development boards because of minimum post restrictions, I am going to drop some general information here (getting my post count up). This is also an attempt to see how many people are frustrated with the VPN connectivity on Samsung Platforms and desire a kernel fix.
Behavior:
An inability to connect to a VPN concentrator, or a seemingly successful connection with a failure to pass traffic across the tunnel. You can observe the behavior by connecting to your VPN, having the interface report a successful connection, but when you attempt to access resources on the other side of the tunnel you will not be able to reach them. When you view the status of the VPN connection, you will see that no packets were encrypted and passed along the tunnel.
Cause:
While I cant rule out a configuration error in every case, I can in mine. Samsung was/is creating kernels for GB and ICS with a slimmed down version of ipsec-tools/racoon. Without getting to technical, this is the module responsible for negotiating the multiple phases necessary for a fully functional VPN tunnel. Because it is slimmed down, IPsec-Tools lacks its usual level of configuration necessary to support a wider range of VPN encryption types.
Solution:
Sorry, for all of you vanilla/non rooted users (really, who is that here anyway?) there is no fix. For everyone else, we need a kernel (the version depends on your rom) with a full version of IPSec-Tools baked in.
Let me know what you people think, the more responses the better my chances of getting this put together. Feel free to also give me a tl:dr
PS: I already tried and failed at compiling this myself, if anyone knows of any good places to start learning a bit more about kernel compiling please drop it here or PM me.
Thanks, I thought the problem was in my router. I am using a Linksys router with DD-WRT on it, and thought the problem was on that end.
Hawkeye9723 said:
Thanks, I thought the problem was in my router. I am using a Linksys router with DD-WRT on it, and thought the problem was on that end.
Click to expand...
Click to collapse
Could be, what version of android are you on? Were you experiencing the behavior above, successful connect and no packets transmitted? Usually dd-wrt wants you to setup the vpn as SSL IPsec (RSA Certificate). I have not yet given tried that implementation but have been attempting IPsec + xAuth PSK (3des encryption).
I have in the past configured dd-wrt to work successfully using the "VPN (the easy way)" on the dd-wrt site (sorry, I'm not allowed to post hyperlinks yet).
It would be great if we could get VPN running like it should. Would make my life a ton easier for work, I wouldn't need to carry around my laptop just to diagnose a tiny problem.
~PsyCl0ne
PsyCl0ne said:
It would be great if we could get VPN running like it should. Would make my life a ton easier for work, I wouldn't need to carry around my laptop just to diagnose a tiny problem.
~PsyCl0ne
Click to expand...
Click to collapse
As an IT professional, that's my motivation as well. Been following all of the leaks and releases, no fix yet. Looks like we'll have to take matters into our own hands.
I haven't tried in on ICS yet. I was running the stock GB. It would connect, bu could not access anything on my home network. I also could not access anything on the internet. Trying to access the router config page would just timeout. I had dd-wrt set up using PPTP.
Yeah, could be the same issue.
Don't mean to patronizing, if I am I apologize...
Did you try setting the advanced options? See attached image.
Leave the DNS settings alone. Try adding the forwarding route ie. If your router address is 192.168.1.1, put 192.168.1.0/24 in that field (192.0.0.0/8 or 192.168.0.0/16 should work too).
Sent from my SAMSUNG-SGH-I727 using xda premium
this issue exists on most samsung phones, from GB to ICS - not sure about JB.
ipsec is broken
So the S3 has known WiFi issues, but mine seems to have none of the issues I've read about thus far. It does have one irritating thing that has been driving me crazy for the longest time. If I ever move outside of the range of my network, reboot, or etc such that the WiFi has to be reestablished, it will decide that my network is "out of range" even though the signal is well within an acceptable minimum (it's a tad bit weak, but, once established it holds extremely steady pretty much no matter what I'm doing.) If I remove and re-add the network settings it works perfectly, again with a stable signal and perfect speeds until the next time I move out of range or reboot.
For now I've reenabled SSID broadcast, but I really liked the idea of having it off as it's a ridiculously simple yet strikingly effective security mechanism (I like the "security through obscurity" methods when I can -- especially since I'm having to use the old WEP encryption protocol to support some older devices, though I'm just about ready just to give up on them at this point. Even the best hacker in the world couldn't get into my network if (s)he never actually made any attempt to do so in the first place.) With SSID enabled, it has no troubles picking up my network every time, it just won't automatically pick it up without it.
Is this just an issue with the software itself or something? Anything that can be fixed from the user side, or is it something that can only be fixed by an update to the OS or related software itself? (But then with 4.1 coming soon supposedly I'm kind of hoping that if it is an issue with the software that would fix it. Still, that's a while away at least and this is assuming their plans aren't messed up with this whole lawsuit business causing them so many problems right now.)
If you have SSID broadcast disabled, how do you expect your phone to recognize the network? I can see how it would work if you enable SSID, connect to your network then disable it again, but it's not going magically reconnect with SSID disabled, its not logical seeing your SSID is what makes it possible for your phone to find your network.
Sent from my SCH-I535 using xda app-developers app
Wep sucks ofcourse but how about just setting up a mac addy auth to give another layer of security and enable ur ssid
Sent from my SCH-I535
I do use MAC address filtering if that's what you mean. While it might stop a script kiddie, I don't have a huge amount of confidence in it. MAC address spoofing is so pitifully easy than with computer equipment at least you usually are even presented with a configuration option that lets you specifically change the MAC address to anything you want. I'm definitely sticking with it because, well, there's absolutely no reason not to, but I actually have less confidence in MAC address filtering to stop anyone than disabled SSID broadcasting because anyone actually actively trying to break in should pretty much immediately bypass that particular mechanism right off.
Shibby87 said:
If you have SSID broadcast disabled, how do you expect your phone to recognize the network? I can see how it would work if you enable SSID, connect to your network then disable it again, but it's not going magically reconnect with SSID disabled, its not logical seeing your SSID is what makes it possible for your phone to find your network.
Click to expand...
Click to collapse
ALL other devices are smart enough to search for a manually configured network if they actually know the SSID to search for. My Roku, my Android 2.2 "Internet Tablet" (basically a PDA) by Archos, my Nintendo DS (this is the main thing holding me back at WEP, and as ancient and pitiful as its networking is, even IT can connect on its own without making me manually recreate the settings every time!) and my EeePC running Windows XP without any software to manage the WiFi settings except the built-in Windows thing.
Nazo said:
So the S3 has known WiFi issues, but mine seems to have none of the issues I've read about thus far. It does have one irritating thing that has been driving me crazy for the longest time. If I ever move outside of the range of my network, reboot, or etc such that the WiFi has to be reestablished, it will decide that my network is "out of range" even though the signal is well within an acceptable minimum (it's a tad bit weak, but, once established it holds extremely steady pretty much no matter what I'm doing.) If I remove and re-add the network settings it works perfectly, again with a stable signal and perfect speeds until the next time I move out of range or reboot.
For now I've reenabled SSID broadcast, but I really liked the idea of having it off as it's a ridiculously simple yet strikingly effective security mechanism (I like the "security through obscurity" methods when I can -- especially since I'm having to use the old WEP encryption protocol to support some older devices, though I'm just about ready just to give up on them at this point. Even the best hacker in the world couldn't get into my network if (s)he never actually made any attempt to do so in the first place.) With SSID enabled, it has no troubles picking up my network every time, it just won't automatically pick it up without it.
Is this just an issue with the software itself or something? Anything that can be fixed from the user side, or is it something that can only be fixed by an update to the OS or related software itself? (But then with 4.1 coming soon supposedly I'm kind of hoping that if it is an issue with the software that would fix it. Still, that's a while away at least and this is assuming their plans aren't messed up with this whole lawsuit business causing them so many problems right now.)
Click to expand...
Click to collapse
hidden ssid enabler will solve this problem. it works great for me. follow the directions in comments of play store though.
You know, I do believe that did actually solve the problem. I guess more testing is needed, but in my initial test it seems to have worked just fine with the SSID broadcast set to hidden again (I even rebooted the router and phone both just to be sure the settings fully took.)
It still strikes me as being a bit dumb that my ancient Nintendo DS that can't even handle WPA can handle a non-broadcast SSID and my previous Android PDA could as well, yet this Android phone couldn't out of the box...
So if you are walking around in public with wifi enabled - you are allowing stores to collect data such as how often and how long you are in their stores.
SOURCE
Wow that's kinda scary. Nice find, thank you.
Why is the right door always locked?
I don't find this nearly as unnerving as the NSA tracking me; if I don't like it, I can take my money elsewhere. We can't "opt out" from government tracking us. Retailers analyzing this data makes them more efficient; has the potential for reducing their advertising and marketing budgets, lowering their costs in one area, helps them lower prices in the long run.
erikoink said:
Retailers analyzing this data makes them more efficient; has the potential for reducing their advertising and marketing budgets, lowering their costs in one area, helps them lower prices in the long run.
Click to expand...
Click to collapse
I agree that to an extent this isn't really a big deal; so Dillards knows that you spend more time shopping for men's clothing than women's shoes.. Who cares right? Problem is, will they stop there? No, they wont. We don't know what information could be (easily) collected (and sold) in the future, that is the problem. Today its "customer 74593654 spent and hour in the store total, 20 minutes in refrigerated goods, 10 minutes in the deli, and 30 minutes in canned foods". But tomorrow, it could be "John Doe who visited our store for an hour today, mostly connects to these two wifi points; they must be his home and work locations. We sell his information to our partners in those areas."
I don't really think that they're tracking (or able to track) that type of information. They're just taking advantage of the way the 802.11 discovery process works.
When a WiFi device is on and not associated with an Access Point (AP), it announces it's presence and attempts to discover a nearby AP. APs respond to these queries with their BSSID and SSID which then gets listed in your device's list of connection options. If it's a "hidden" AP, it will only respond if the discovery query includes a specific SSID. Instead of responding, all it does is log the querying devices MAC Address and timestamps it. Other APs can compare the Rx signal strength and approximate the location of the device.
As far as I know, unless and until your device actually associates with (connects to) the AP, no other communication occurs. If there are any WiFI engineers in here that know of a way to force a device to associate to an AP remotely and request it send data that it isn't configured to send, I'm willing to be corrected.
WiredPirate said:
So if you are walking around in public with wifi enabled - you are allowing stores to collect data such as how often and how long you are in their stores.
SOURCE
Click to expand...
Click to collapse
I'd like to bump because im honestly curious if anyone knows what kind of info they could pull from our phones through this.
erikoink said:
I don't really think that they're tracking (or able to track) that type of information. They're just taking advantage of the way the 802.11 discovery process works.
When a WiFi device is on and not associated with an Access Point (AP), it announces it's presence and attempts to discover a nearby AP. APs respond to these queries with their BSSID and SSID which then gets listed in your device's list of connection options. If it's a "hidden" AP, it will only respond if the discovery query includes a specific SSID. Instead of responding, all it does is log the querying devices MAC Address and timestamps it. Other APs can compare the Rx signal strength and approximate the location of the device.
As far as I know, unless and until your device actually associates with (connects to) the AP, no other communication occurs. If there are any WiFI engineers in here that know of a way to force a device to associate to an AP remotely and request it send data that it isn't configured to send, I'm willing to be corrected.
Click to expand...
Click to collapse
Thank you for explaining that better.
Perhaps you connect to their free wifi, it's tempting if you want to save data or maybe you are in an area with bad reception.. Couldn't they then gather more personal information?
WiredPirate said:
Perhaps you connect to their free wifi, it's tempting if you want to save data or maybe you are in an area with bad reception.. Couldn't they then gather more personal information?
Click to expand...
Click to collapse
See, now if you associate with (connect to) their network, that changes things. But let's explore that hypothetical:
Have you ever heard of a "captive portal"? You see them in airports, hotels, anywhere with a so-called "guest wifi network", whereupon if you connect to their network and try to go to a website, it first redirects you to a page. And this page requires you to enter a password, or answer a survey, or agree to their terms and conditions. I'm sure we've all seen these.
Let's say that part of their terms are you must download their smart phone apps as a condition of connecting to their network and allowing you to be routed onto the global internet. Lets also say that in order to install the app, you have to grant the app certain permissions. Among these reading from areas of your phone, you might not want people reading from. As you suggested in a previous post, your list of saved WiFi networks, etc. Then yes, they could start gathering additional data. In this case, it's still your choice to use their resources, you still have the choice not to. Their network, their rules.
I will say this though.. be careful of how your device is configured. I think the setting is available that tells your device to connect to any available open (unsecured) WiFi network. I would advise anyone to disable this. Once your device connects to any network, and you an IP address on said network, then something could make a connection attempt to a vulnerable/compromised device (whether that be the network owner, or another compromised or rogue device) running some kind of Trojan service that responds to certain requests without you knowing. This of course, would be illegal and if they got caught doing this then they would face a huge backlash from their customers. I doubt they'd attempt something like this.
Mac address is worse enough.
Today's data is aggregated, ALWAYS.
You can buy it you can sell it... There isn't just one source.
Cameras in the shops running track analysis and soon facial recognition, mimics and so on.
Your mac address? Your router knows it.. And so your provider has access to it. He also has your ip.
Your ip? Most websites you visit and some more tracking / advertising sites.
So, as your mac is known, data sold, we assume your owned devices are well known.
Now we don't need anything else than a WLAN to track your GPS like location.. Beside.. This is how android WLAN location service works. Did I say android? Sorry, it is an exclusive google service.
You can:
Adapt your behavior .
Use tor or i2p.
Host your own services.
Encrypt everything.
And again, adapt your behavior... Elseway no onion routing brings any advantage.
So, if you are willing to go the painful road, opt out of most things.. You can't opt out of your phone providers data collection, if you still want a mobile phone.
But still... ANY data reduction is the right way.
The data is and will be more and more widely used, aggregated and abused.
It is time to realize that there won't be any freedom in the modern world - this IS the new world order.
Forgot one freedom: you are free to be a consumer and a product.
And for people arguing with laws... Laws can and will be changed... In the name of safety.
Sent from mobile.