10 ms·

Nearby peer discovery without GPS using environmental fingerprints

78 points by waerhert 10mo ago

Will-Reppeto 10mo ago
[dead]
thomas-shelby 10mo ago
[dead]
figmert 10mo ago
I've noticed many metro systems in cities do somehow receive GPS and cellular networks which I'm always impressed by. London on the other hand, has only recently started receiving signal for cellular networks, and rollout is slow. GPS does not work at all. I've always thought using the WiFi access points that have been installed on the underground could be a great addition to something like Citymapper to figure out where you are located even when there is no GPS.
- ahoka 10mo ago
  Phones already use WIFI for location.
  - thenthenthen 10mo ago
    Yep, you could actually fool phones into thinking they were somewhere else by just cloning a couple of ssids from another place (around 2014 iirc). I dont think this works anymore since phones now use multiple gnss bands etc. That said, my phone thinks its at my home station for the whole 20km’s ride underground, while 5g connectivity is excellent and i have wifi and gps turned on (edit, using Apple Maps).
- Sayrus 10mo ago
  Both Apple (WPS?) and Android (Location Accuracy) support improving location through WiFi access points and cellular network discovery. That's usually why you are able to get a lock onto your position even while underground.
- ezfe 10mo ago
  Wi-Fi and Cellular is why your phone knows where it is, that already works.
- vessenes 10mo ago
  I believe Google Maps on iOS can tell you where you are on the Underground. But I presume it’s not using GPS, as you say.
vessenes 10mo ago
There are a couple of difficult cryptographic-type problems with this plan. (Which I like, by the way). I don’t think it’s privacy preserving, and I also don’t think it works well for finding shared locations as currently specified. Also, the privacy and the finding are in direct opposition to each-other, which isn’t always a comfortable system dynamic. On the one hand, a simple hash of ESSIDs near you, if you take all of them, is highly unlikely to ever match - radio strength varies and you’ll see stuff on the edges of your device pop in and out if you look at radio traces. So you need to limit the list. However, if you limit the list, to say 3 ESSIDs, you’re well into rainbow table attack territory - if there are 100mm WiFi access points in the world, then you need 100mm^3 hashes - doable - and if you rough geoloc them first so that you’re not hashing out stuff more than a mile away from other APs, you’re down to “very manageable”. At the same time, the question of “which 3” means that it’s going to be hard to ever get the same list, or at least you’re not in the one 9s territory of loc matching. To do this without some sort of either trusted server or some sort of group key sharing (and therefore a totally different threat model) you’ll need to get some sort of location-aware hashing together, and I think also you’ll want to be able to get some sort of data from the local APs that’s not easily accessible elsewhere. Not sure what that is off the top of my head, but I bet there’s something in the WPS spec that you could hang off of. So if you had the ability to be like “my hash puts me somewhere within this square (area) and only those of us here know that the secret salt for this minute is XXX” then I think you’d get back to the original goals of the project. I bet that’s doable! Looking forward to v2
- waerhert 10mo ago
  Thanks for the feedback! Rainbow tables probably won't work here since the epoch (rounded to 5 minutes) salts everything, so precomputed tables would expire constantly. You would use use BSSIDs + SSID in real implementations. The MinHash part creates 128 hash values from the entire observed set, not a subset of 3, then LSH divides these into bands where similar sets collide probabilistically based on Jaccard similarity. I've tested with two phones where one saw 3-4 networks and the other saw ~10. They still found each other, and you can try it in the interactive demo yourself. You're right it's not entirely privacy preserving, really depends on your threat model as I discuss in the security section. Your idea about combining area hints with time-based salts is interesting though, feels like it could bridge geospatial indexing with this approach! The whole geospatial indexing thing was something I became aware of late in the project and didn't go into further. It's probably a much simpler approach if geolocation is important. In the current approach, geolocation doesn't matter at all, only 'the environment', whatever that may be.
alan-jordan13 10mo ago
[dead]
tomgag 10mo ago
Watch out, possibly similar to this patent: https://patentimages.storage.googleapis.com/e4/9b/4e/883a9df8991a9a/EP4333359A1.pdf https://patentimages.storage.googleapis.com/e4/9b/4e/883a9df... (disclaimer: I am co-inventor at a previous employer, I don't get royalties for it, just reporting)
- waerhert 10mo ago
  Thanks for the heads up! Good to know what's out there. Interesting that I independently arrived at something possibly similar.
  - charcircuit 10mo ago
    >Good to know what's out there. It opens you up to legal risk for knowingly infringing patents. If possible you never should look at a patent.
    - nullc 10mo ago
      That is somewhat outdated advise post seagate: https://www.stblaw.com/docs/default-source/cold-fusion-existing-content/publications/pub629.pdf https://www.stblaw.com/docs/default-source/cold-fusion-exist...
arcbyte 10mo ago
I never got very far with this idea beyond coming up with it, but whe thinking about unfakable calculable characteristics that could be used for locality verificacion, i could only come up with latency as the key characteristic. Based on some geographical threshold distance the speed of light gives a reasonable estimate of how much latency there ought to be when communicating with someone. So if you could issue a challenge and time the response, you should know someone is local to you or not.
meindnoch 10mo ago
TL;DR: it's just using the WiFi networks' names to decide whether you're close or not. I thought "environmental fingerprints" were referring to something more elaborate, like a fingerprint of the local audio environment, or using the accelerometer to measure the local spacetime curvature.
- waerhert 10mo ago
  It's not limited to WiFi networks and indeed the fingerprints you suggest would be a lot better because they would change significantly over time. The whole WiFi networks idea kinda stuck because it's an obvious an easy thing to grab from the environment using a mobile phone. An audio fingerprint would definitely be doable on mobile.
smath 10mo ago
Shameless plug: More than a decade ago, I wrote a paper [1] on how the random perturbations in the wireless channel between an ambient RF transmitter (FM radio, TV) to the two devices, allow nearby devices to authenticate locality because the perturbations are correlated only if they are nearby (where nearby is relative to the wavelength being monitored) [1] https://dspace.mit.edu/handle/1721.1/121443 https://dspace.mit.edu/handle/1721.1/121443
nanomonkey 10mo ago
This could be useful for dynamic clique routing used in mesh networking in large crowds. Although I would think one would need to do the peer discover prior to any Internet shutdown events. It gets around the problem of GPS spoofing, and physical barriers that traditional GPS based groupings have.

78 points by waerhert 10mo ago

Will-Reppeto 10mo ago

[dead]

thomas-shelby 10mo ago

[dead]

figmert 10mo ago

I've noticed many metro systems in cities do somehow receive GPS and cellular networks which I'm always impressed by. London on the other hand, has only recently started receiving signal for cellular networks, and rollout is slow. GPS does not work at all. I've always thought using the WiFi access points that have been installed on the underground could be a great addition to something like Citymapper to figure out where you are located even when there is no GPS.

ahoka 10mo ago
Phones already use WIFI for location.
- thenthenthen 10mo ago
  Yep, you could actually fool phones into thinking they were somewhere else by just cloning a couple of ssids from another place (around 2014 iirc). I dont think this works anymore since phones now use multiple gnss bands etc. That said, my phone thinks its at my home station for the whole 20km’s ride underground, while 5g connectivity is excellent and i have wifi and gps turned on (edit, using Apple Maps).
Sayrus 10mo ago
Both Apple (WPS?) and Android (Location Accuracy) support improving location through WiFi access points and cellular network discovery. That's usually why you are able to get a lock onto your position even while underground.
ezfe 10mo ago
Wi-Fi and Cellular is why your phone knows where it is, that already works.
vessenes 10mo ago
I believe Google Maps on iOS can tell you where you are on the Underground. But I presume it’s not using GPS, as you say.

vessenes 10mo ago

There are a couple of difficult cryptographic-type problems with this plan. (Which I like, by the way). I don’t think it’s privacy preserving, and I also don’t think it works well for finding shared locations as currently specified. Also, the privacy and the finding are in direct opposition to each-other, which isn’t always a comfortable system dynamic. On the one hand, a simple hash of ESSIDs near you, if you take all of them, is highly unlikely to ever match - radio strength varies and you’ll see stuff on the edges of your device pop in and out if you look at radio traces. So you need to limit the list. However, if you limit the list, to say 3 ESSIDs, you’re well into rainbow table attack territory - if there are 100mm WiFi access points in the world, then you need 100mm^3 hashes - doable - and if you rough geoloc them first so that you’re not hashing out stuff more than a mile away from other APs, you’re down to “very manageable”. At the same time, the question of “which 3” means that it’s going to be hard to ever get the same list, or at least you’re not in the one 9s territory of loc matching. To do this without some sort of either trusted server or some sort of group key sharing (and therefore a totally different threat model) you’ll need to get some sort of location-aware hashing together, and I think also you’ll want to be able to get some sort of data from the local APs that’s not easily accessible elsewhere. Not sure what that is off the top of my head, but I bet there’s something in the WPS spec that you could hang off of. So if you had the ability to be like “my hash puts me somewhere within this square (area) and only those of us here know that the secret salt for this minute is XXX” then I think you’d get back to the original goals of the project. I bet that’s doable! Looking forward to v2

waerhert 10mo ago
Thanks for the feedback! Rainbow tables probably won't work here since the epoch (rounded to 5 minutes) salts everything, so precomputed tables would expire constantly. You would use use BSSIDs + SSID in real implementations. The MinHash part creates 128 hash values from the entire observed set, not a subset of 3, then LSH divides these into bands where similar sets collide probabilistically based on Jaccard similarity. I've tested with two phones where one saw 3-4 networks and the other saw ~10. They still found each other, and you can try it in the interactive demo yourself. You're right it's not entirely privacy preserving, really depends on your threat model as I discuss in the security section. Your idea about combining area hints with time-based salts is interesting though, feels like it could bridge geospatial indexing with this approach! The whole geospatial indexing thing was something I became aware of late in the project and didn't go into further. It's probably a much simpler approach if geolocation is important. In the current approach, geolocation doesn't matter at all, only 'the environment', whatever that may be.

alan-jordan13 10mo ago

[dead]

tomgag 10mo ago

Watch out, possibly similar to this patent: https://patentimages.storage.googleapis.com/e4/9b/4e/883a9df8991a9a/EP4333359A1.pdf https://patentimages.storage.googleapis.com/e4/9b/4e/883a9df... (disclaimer: I am co-inventor at a previous employer, I don't get royalties for it, just reporting)

waerhert 10mo ago
Thanks for the heads up! Good to know what's out there. Interesting that I independently arrived at something possibly similar.
- charcircuit 10mo ago
  >Good to know what's out there. It opens you up to legal risk for knowingly infringing patents. If possible you never should look at a patent.
  - nullc 10mo ago
    That is somewhat outdated advise post seagate: https://www.stblaw.com/docs/default-source/cold-fusion-existing-content/publications/pub629.pdf https://www.stblaw.com/docs/default-source/cold-fusion-exist...

arcbyte 10mo ago

I never got very far with this idea beyond coming up with it, but whe thinking about unfakable calculable characteristics that could be used for locality verificacion, i could only come up with latency as the key characteristic. Based on some geographical threshold distance the speed of light gives a reasonable estimate of how much latency there ought to be when communicating with someone. So if you could issue a challenge and time the response, you should know someone is local to you or not.

meindnoch 10mo ago

TL;DR: it's just using the WiFi networks' names to decide whether you're close or not. I thought "environmental fingerprints" were referring to something more elaborate, like a fingerprint of the local audio environment, or using the accelerometer to measure the local spacetime curvature.

waerhert 10mo ago
It's not limited to WiFi networks and indeed the fingerprints you suggest would be a lot better because they would change significantly over time. The whole WiFi networks idea kinda stuck because it's an obvious an easy thing to grab from the environment using a mobile phone. An audio fingerprint would definitely be doable on mobile.

smath 10mo ago

Shameless plug: More than a decade ago, I wrote a paper [1] on how the random perturbations in the wireless channel between an ambient RF transmitter (FM radio, TV) to the two devices, allow nearby devices to authenticate locality because the perturbations are correlated only if they are nearby (where nearby is relative to the wavelength being monitored) [1] https://dspace.mit.edu/handle/1721.1/121443 https://dspace.mit.edu/handle/1721.1/121443

nanomonkey 10mo ago

This could be useful for dynamic clique routing used in mesh networking in large crowds. Although I would think one would need to do the peer discover prior to any Internet shutdown events. It gets around the problem of GPS spoofing, and physical barriers that traditional GPS based groupings have.