Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xfinity using WiFi signals in your house to detect motion

xfinity.com

Post reply on HN
Print view View original

331–340 of 517 posts

Re: Xfinity using WiFi signals in your house to detect motion

#331

Post by preisschild »

josho wrote: post #29
jacobgkau wrote: post #2

> Subject to applicable law, Comcast may disclose information generated by your WiFi Motion to third parties without further notice to you in connection with any law enforcement investigation or proceeding, any dispute to which Comcast is a party, or pursuant to a court order or subpoena. Sounds like, at least in some limited circumstances (using the provided WiFi AP, having this feature turned on, etc), ISPs are goi…

The solution here shouldn't be technical; it should be legal. If we rely on the technical path, Comcast can achieve the same by how many active IPv6 addresses are in use. Even if you aren't using your phone, the device is going to be constantly pinging services like email, and your ISP can use that to piece together how many people are at home. If we rely on legal protection, then not only Comcast, but all ISPs will…

> Comcast can achieve the same by how many active IPv6 addresses are in use

Isn't this basically impossible with IPv6 Privacy Extension Addresses?

Re: Xfinity using WiFi signals in your house to detect motion

#332

Post by lovich »

scarface_74 wrote: post #266
lovich wrote: post #185

Earlier quoted context omitted.

Technical and legal solutions are for different classes of problems. Encryption is a technical solution trying to solve the problem of people being able to steal your data/money without your knowledge. The law/police are the solution to the 5 dollar wrench problem, where you are very aware of the attack but unable to physically stop it

And the law can’t stop someone from using a $5 wrench before the harm is done…

I don’t expect the law to prevent the crime. Much like my comment you replied to, I recognize different tools are for different situations.

The law is there to enforce the “rule of law”

It’s a little ambiguous because the phrase is in English and doesn’t match up 1:1 with the common vernacular, but I want the “rule of law” to enforce that the rules are real, not to prevent someone from testing their existence

Re: Xfinity using WiFi signals in your house to detect motion

#333

Post by tomhow »

heywoods wrote: post #83
transpute wrote: post #31

Sensing is (sadly) part of Wi-Fi 7. If you have a recent Intel, AMD or Qualcomm device from the past few years, it's likely physically capable of detecting human presence and/or activity (e.g. breathing rate). It can also be done with $20 ESP32 devices + OSS firmware and _possibly_ with compromised radio basebands.

[flagged]

Please don't do this. Whether it's LLM-generated or not, we don't want big blocks of text from elsewhere pasted into comments here. Please at least try to craft original human thoughts.

Re: Xfinity using WiFi signals in your house to detect motion

#334

Post by aspenmayer »

Dylan16807 wrote: post #328
aspenmayer wrote: post #212

Earlier quoted context omitted.

> Your take is both alarmist and defeatist. Legal limits on national security agencies are not enforceable due to Five Eyes etc. Allied foreign spies do what American spies don’t. I’m just admitting the political reality of the situation. What you do with that information may be limited, but it’s not a failing on my part that this is the status quo.

> Legal limits on national security agencies You're not talking about what they're talking about. They're talking about limiting corporate data collection. If companies don't build this into routers, then 99% of routers won't be collecting this data, and foreign spies won't have any data to steal.

They will classify the data as necessary for business purposes and collect it under a different name. They will be obligated to pass full take information if necessary, and it will be tapped at any point by employees who are given NSLs and asked/told to do things under penalty of law where applicable, and on threat of arrest or dismissal if not, or by federal agents themselves or their deputies or other approved third parties. Your modem may be intercepted in the mail and reflashed if necessary or over the wire, and that functionality is part of the operating standards of the modems. You could find a way to secure this on your own maybe, which is perhaps just another signal which flips a bit somewhere and may be logged. You can’t close Pandora’s box. It doesn’t matter if Comcast has the WiFi data to sell because they will have access to the information due to how the WiFi signals propagate. It’s diagnostic data. It’s the signals themselves. So all this is perhaps a misdirect, as any third party in range of the WiFi network can likely do the same thing passively, so it is a moot point. The data being gathered and sold should be legislated, but I don’t think that it will affect any of the actual concerns raised, because feds will still legally do whatever they are authorized to do, the justification and doctrine may not be public information. You probably won’t know, so you won’t object. Third parties who lack principles will gather the data regardless of legality. I don’t know how you could even legislate against passive monitoring unless you could demonstrate intent to harm or violate FCC regulations and applicable laws about harming people or computer systems like CFAA, which is a whole other issue.

Re: Xfinity using WiFi signals in your house to detect motion

#335

Post by craftkiller »

dylan604 wrote: post #72
nandomrumber wrote: post #59

Earlier quoted context omitted.

Doesn’t turning off SSID broadcast result in devices that have the wifi network saved repeatedly broadcast a request for the AP to identify itself in an effort to establish a connection?

I'm not sure I follow. Why would a network known to the device not be connected to the network? If you never connected your device to their wifi and only connected to your wifi connected via ethernet, why would it even know to make a request? If you're not actively connecting to the WiFi in your house, why not just "forget network"? Seems like a strange hypothetical, but aren't they all?

> Why would a network known to the device not be connected to the network?

I think they're referring to when you leave your home. Your device(s) will be constantly broadcasting probe requests for the hidden network.

The away-from-home probe requests wouldn't be that useful for mapping, but your AP/router is equally useful for mapping with or without broadcasting the SSID. Hiding your SSID just means it sets the SSID to null in the beacon frames but it's still sending out beacon frames with its far-more-unique MAC address (BSSID). If you're on linux you can see this pretty easily by running `sudo iw dev wlan0 scan`. The "hidden" wifi networks will have their SSID as "SSID: \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" but all the other information including MAC address is still there. Personally it seems there are two "hidden" wifi networks within range of my bedroom.

Re: Xfinity using WiFi signals in your house to detect motion

#336

Post by grues-dinner »

gxs wrote: post #278
dcow wrote: post #220

Earlier quoted context omitted.

We suffer from a problem that engineers want nothing to do with politics. I 1000% agree we need a digital bill of rights. It pains me every time a “well behaved” website pops up a cookie consent banner for the billionth time after I already consented because the browser wiped all the persistent user identifiers available to it. For my protection -_- I want privacy codified in human law. I didn't vote for standards bo…

I’ve been asked at work to build less than savory stuff, here are some general observations, none of which are admittedly an excuse: * you get caught up in the moment, hell bent on solving the problem you don’t really think twice * you don’t want to get that stink on you, you don’t want to be that guy that brings this type of stuff up * you are mindful of the fact that you are being very well compensated to build it…

This is all true, and I suppose I participated in a signed update mechanism that I knew the (corporate) end user probably wasn't going to be given the keys to. But, I think there's a difference between this and deliberately going to work on a system that's clearly just top-down designed for something low.

For example, I don't think there's anyone in the (large!) fixed-odds betting terminal industry that can honestly say their work is a good thing for the end users.

Re: Xfinity using WiFi signals in your house to detect motion

#337

Post by andsoitis »

dcow wrote: post #220
josho wrote: post #29

Earlier quoted context omitted.

The solution here shouldn't be technical; it should be legal. If we rely on the technical path, Comcast can achieve the same by how many active IPv6 addresses are in use. Even if you aren't using your phone, the device is going to be constantly pinging services like email, and your ISP can use that to piece together how many people are at home. If we rely on legal protection, then not only Comcast, but all ISPs will…

We suffer from a problem that engineers want nothing to do with politics. I 1000% agree we need a digital bill of rights. It pains me every time a “well behaved” website pops up a cookie consent banner for the billionth time after I already consented because the browser wiped all the persistent user identifiers available to it. For my protection -_- I want privacy codified in human law. I didn't vote for standards bo…

> Why is it that if someone said “we need a legal solution to gun violence” the people that say “no we need a technical solution all people should wear kevlar and carry 9mm pistols” are considered the lunatics but when we ask for a legal solution to rampant non-consensual tracking for the purpose of indoctrinating the consumer class with propaganda we all laugh and say bah the solution must be technical? I don’t get it

I don’t know that a reasonable person would compare privacy threats to the threat of death from gun violence.

They exist in totally different altitudes of concern.

Re: Xfinity using WiFi signals in your house to detect motion

#338

Post by troupo »

xp84 wrote: post #330
dcow wrote: post #220

Earlier quoted context omitted.

We suffer from a problem that engineers want nothing to do with politics. I 1000% agree we need a digital bill of rights. It pains me every time a “well behaved” website pops up a cookie consent banner for the billionth time after I already consented because the browser wiped all the persistent user identifiers available to it. For my protection -_- I want privacy codified in human law. I didn't vote for standards bo…

I think I’m kind of on your side in general, but I have more of the opposite feeling about legal versus technical solutions. If we had no idiotic EU cookie laws, no “consent” bs required, a technical solution would be easy: default segmentation of cookies by what site you are actually visiting, plus all non-first-party ones silently expired after 60 minutes or whatever. It seems like this would be very easy, except f…

> If we had no idiotic EU cookie laws

The obnoxious cookie banners are not required by "idiotic EU cookie laws".

> a technical solution would be easy: default segmentation of cookies by what site you are actually visiting, plus all non-first-party ones silently expired after 60 minutes or whatever.

1. This was already implemented

2. Tracking isn't limited to cookies only

> except for the fact that the number one ad network is also the only browser vendor that matters.

Oh, so an "easy" solution isn't easy after all. Who would've thought.

> And of course they also suffer from the politicians who wrote them having no clue how any of this works.

But you do? Like how you only speak about cookies when tracking and user data isn't limited to cookies? Or how "stupid EU cookie law" doesn't even talk about cookies (if we're talking about GDPR)?

Usually the people who really have no clue are exactly the people who say that "there's an easy technical solution".

Re: Xfinity using WiFi signals in your house to detect motion

#339

Post by Latty »

dcow wrote: post #326
jraph wrote: post #320

Earlier quoted context omitted.

> It pains me every time a “well behaved” website pops up a cookie consent banner for the billionth time after I already consented because the browser wiped all the persistent user identifiers available to it. Do yourself a favor and enable the Cookie lists in uBlock Origin. I'm personally grateful that a law requires my consent before tracking me. That means I should not be tracked without me saying OK without monet…

Setting a language preference cookie is not tracking and I will die on that hill. The law requires consent before using a cookie to store even a mundane option that was just directly modified by a user. Collecting a crash report is not tracking a user. Even first party product analytics is not tracking a user. Tracking a user across domains using a 3rd party aggregator to serve add and do attribution is the evil. And…

A language preference cookie is not tracking under the GDPR and doesn't need to be promoted for. Of course, if you take that language preference and feed it into your advertising to identify and target people, then it becomes tracking.

Re: Xfinity using WiFi signals in your house to detect motion

#340

Post by guerrilla »

bdcravens wrote: post #163
johnklos wrote: post #70

I've been telling people for ages to not trust ISP provided hardware. Notice the vague language here which means they reserve the right to share private information for anything that might be called an investigation, or for any dispute which includes them (didn't pay your bill?), or a subpoena. Subject to applicable law, Comcast may disclose information generated by your WiFi Motion to third parties without further n…

Scary, but is it any scarier than the status quo before this feature was implemented? The fidelity of the data, perhaps, but it's more or less been the standard that our footprint where we intersect with a third-party is no longer ours to control.

If you're asking if it's worse then yes it is worse.
Post reply on HN