4

Their commercial geolocation API doc says it needs a list of every WiFi access point around, with, for each of them:

  • MAC address,
  • ESSID
  • signal strength,
  • a few others.

Common devices probably query the geolocation web service like this.

However, I'm interested in knowing if Chrome/Android actually sends more information to Google, like:

  • my device WiFi MAC address or "ID"?
  • my GPS location? (say, to geolocalize WiFi APs around me for Google)
  • etc.

The best answer would be a (sniffed) query dump from a WiFi enabled device (bypassing https). A source code review may also be useful, but for Chromium only.

0

1 Answer 1

3

Looking at the source code of Chromium, the data structure holding the Wi-Fi data doesn't seem to have any more data that you mentioned, so I find it unlikely that they actually send other Wi-Fi related data somehow in secret to their servers from Chrome. (Only age is added to the request afterwards as I can see.)

And it wouldn't make much sense anyway. Your device's Wi-Fi MAC address or ID or anything that is Wi-Fi related is completely irrelevant for the geolocation system. It doesn't matter who wants to know his own position, what address he uses etc. The results only depend on the data provided in the API. The MAC address of the Wi-Fi network provides the approximate position of the network itself and the other data like the signal strength make a distance estimation possible.

The device's GPS location could come handy for the system though. I guess that Chrome doesn't send it only because most of the devices running Chrome don't really have a GPS chip thus they don't know the GPS location. But Android devices simply have to send this data. As stated above the network's address is what provides the position information in the queries. For that Google needs to map a more or less exact location to the address and they need to collect that information somehow. Some years ago there was a scandal that the Street View cards didn't take just pictures, but also collected Wi-Fi data. They were forced to stop doing that so now the only logical way for them to collect it is to rely on the trillions of Android devices in the wild.

4
  • I'm particularly interested in the GPS stuff, as I think you're right about Google using our phones to populate its database, never saying so "explicitly". Sniffing such a query would be great.
    – Totor
    Dec 29, 2014 at 13:24
  • Well, yeah. Good luck breaking HTTPS :)
    – ytg
    Dec 29, 2014 at 13:50
  • Man in the middle... :) Or can we find this information in the open Android source code?
    – Totor
    Dec 29, 2014 at 13:53
  • Man in the middle attacks don't work with sites using signed certificates. And the Android source... the device can legitimately send your coordinates to Google based on your settings, therefore finding hidden code that sends it illegitimately can be a search for a needle in a haystack.
    – ytg
    Dec 29, 2014 at 18:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .