Hacker Proves Router Security Weakness

[engine]

Hacker Proves Router Security Weakness [bbc.co.uk]

One visit to a booby-trapped website could direct attackers to a person's home, a security expert has shown.

The attack, thought up by hacker Samy Kamkar, exploits shortcomings in many routers to find out a key identification number.

It uses this number and widely available net tools to find out where a router is located.

Demonstrating the attack, Mr Kamkar located one router to within nine metres of its real world position.

[J_RaD]

The attack uses data gathered by Google's Street View cars

Thanks goog!

[Demaestro]

One visit to a booby-trapped website could direct attackers to a person's home

One visit to a mall with a stalker willing to follow, then "someone" could also be directed to your home. I am not sure I am ready to stop visiting malls based on this "revelation"

Thanks goog!

exploits shortcomings in many routers

I'm not sure I am will to fault Google for a shortcoming in many routers that allows for this.

[J_RaD]

oh yes the blame still falls routers, just the fact they used some goog data collection to help them along.

when wifi is not in use at my house, the wifi radio is OFF.

[wheel]

I'm not sure I am will to fault Google for a shortcoming in many routers that allows for this.

The router's fault isn't their fault. But allowing the routers to be pinpointed physically IS their fault. Without the Google data that they so merrily made available there'd be no real exploit.

[fauxsoup]

It's a wonder how people ever committed crimes before Google with the way people talk on this forum.

I'm sorry, what's the use of this "attack?" I'm thinking it looks something like this:

1. Lure individuals to booby trapped site, determining their location
2. ?
3. Profit!

EDIT:

For the record, stalking is a threat regardless. There's a large number of people out their who could determine your physical location with very little information, and some of these people are stalkers. The people who are willing to go this far to stalk someone will do so no matter how easy or difficult it is.

Doesn't mean we should make it easier, but it also means don't blame Google for something that happens anyway.

[Demaestro]

Without the Google data that they so merrily made available there'd be no real exploit.

I have a hard time making statements that imply having more knowledge available to us can be a bad thing.

People can use a piece of info for bad or good, but the info isn't bad in of itself.

I have never learned something that I wish I hadn't learned. I have learned things I wished weren't true, but I was still glad to have learned about them.

[kaled]

I knew there was a reason I set my router to not broadcast its SSID when I set it up a couple of years ago. That said, it isn't clear from the report that this actually makes a difference but one would hope that Google ignored non-broadcasting (and encrypted) routers when they were accidentally recording all that other data.

Kaled.

[wheel]

I have a hard time making statements that imply having more knowledge available to us can be a bad thing.

Generalizing like that is nonsense. Knowledge of my personal life isn't yours to know or exploit. Keep out of my private life - you and Google. And yes, my wireless router is 'private'. Keep out of it.

You think it's a good idea that your search history be displayed for the world to see? How'd that go for AOL and their clients?

Quite frankly, it's not your privilege or right to know everything about other people's lives.

[Demaestro]

Knowledge of my personal life isn't yours to know or exploit

Like it or not, when you make parts of your personal life public then it is mine to know or exploit.

I am sure famous stars would love it if what you said was true. Unfortunately that just isn't the way it is.

You think it's a good idea that your search history be displayed for the world to see

A good idea? No, but if I had access to the data I may decide to use it for something good.

Quite frankly, it's not your privilege or right to know everything about other people's lives.

Of course not, however things that people make public it is my right to know about if I so choose.

Generalizing like that is nonsense.

I was simply making a point that access to information isn't bad, what you do with that info could be bad but access to info isn't bad. If you think that generalization is nonsense then that is your right. (note for irony that you are making my opinion your business) However I can't think of an example where if info is public I wouldn't want it recorded. The only reason to not record public info would be out of fear.

[kaled]

There seems to be a school of thought that collecting, collating and publishing vast quantities of publicly available information is always ok because it is "publicly available information". Well, it's a point of view but it's a dumb point of view and it's one that is generally not recognised by law. For instance...

I am on the electoral register (UK) but choose to not have my entry published on the public list. This means that someone looking for me would find the electoral register useless. However, doubtless my address is held on some publicly available list somewhere (even if I don't want it to be) so if some bright spark decided to collect, collate and publish all the available information on who lives where and if someone wanted to find me badly, all they would have to do is subscribe to that list.

Now, in my case, I'm not really all that bothered, but a woman who had an abusive boyfriend might be very bothered. Clearly, since this issue is recognised in law (by providing the electoral register option noted above) it would be ludicrous to suggest that allowing people to blindly publish all publicly available information is justifiable in the general case.

I think some people side with Google because they think Google are smart and therefore right. The problem is that Google are not nearly as smart as they think they are and are very often wrong. In the modern world, privacy should be the number one priority, but Google and others such as Facebook seem to put privacy way down the list - certainly well below profitability.

Kaled.

[fauxsoup]

...if someone wanted to find me badly, all they would have to do is subscribe to that list.

Exactly. Here in the United States I can figure out where someone lives with their name, license plate number, phone number, or any other of a number of seemingly minor details. Same goes for that girl you bring up, and I'm willing to bet her abusive boyfriend has more access to those tidbits of information than I ever could.

Most violent crimes are committed by someone the victim knows, and the others are effectively random, so it stands to reason that hiding those details away would do, um, nothing to help prevent violent crimes.

But wait! What about identity theft, or property theft!? Sorry to tell you this, folks, but if your identity is stolen it's probably because you weren't careful enough with your sensitive information. Don't throw away things which have your social security number on it, or anything else that could impact you financially (because that's what identity theft is about: money)

As for property theft, I can tell you what a thief is looking for: 1) do you have a nice car? 2) do you have a nice house? 3) are you away often? 4) do you have active neighbors? 5) do you have a security system? 6) is there an easy way into the house? Notice how none of those have anything to do with what could be considered personal information.

We can, obviously, create a case where the information published by Google aids a criminal in some way, but the question is what's in it for the criminal? He sets up a site, which you visit, and now he has your address. What crime is he going to commit? Identity theft? Sure, he'll have to go to your house and dig through your trash or try to steal your mail, which is all stuff he would have done to someone anyway, totally at random. So all you did by visiting his site was give him a target, which he didn't really need the site for anyway.

People have this illusion that if they somehow remove their personal information from the public space, nothing bad will ever happen to them, to which I can only say: how many victims did you know about before they became victims?

Demaestro is right; the only reason someone would care so much about protecting that information is out of fear, so what are you afraid of that you could actually prevent by keeping this information safe? I'm legitimately curious.


EDIT:
Here's an important question: why would someone target you? Why are you important? Why would someone seek you out to perpetrate a crime against you?

[Demaestro]

There seems to be a school of thought that collecting, collating and publishing vast quantities of publicly available information is always ok because it is "publicly available information". Well, it's a point of view but it's a dumb point of view and it's one that is generally not recognised(sic) by law.

There is another school of thought that people are somehow in "danger" and they must protect the location of their home, work and so on. Well that is a point of view but it's a paranoid point of view.

Example:

However, doubtless my address is held on some publicly available list somewhere (even if I don't want it to be) so if some bright spark decided to collect, collate and publish all the available information on who lives where and if someone wanted to find me badly, all they would have to do is subscribe to that list.

Who is this someone that people with this point of view are scared of? What are you doing in your life that you live in fear of someone

Here is a fact for you. If someone wants to find you they will. A list may make it easier, but if this someone has been properly motivated to find you then they won't let the absence of a list stop them.

I guess if I was in fear of someone then I would be moved by your school of thought but instead I am left to wonder what has so many people looking over their shoulder?

I still haven't heard one argument that wasn't born from paranoia that gives reason to not have publicly available information stored and made available to the public.

[kaled]

I still haven't heard one argument that wasn't born from paranoia that gives reason to not have publicly available information stored and made available to the public.

Yes you have, however, you have simply dismissed it as paranoid.

Generally, holding personal information (even if it's publicly available) requires a license. I think it's time the authorities laid down a marker or two with prosecutions.

Kaled.

[fauxsoup]

Yes you have, however, you have simply dismissed it as paranoid.

No, we haven't, you're simply paranoid.

You fail to address Demaestro's question and mine. Who would target you? Why would someone be after your information explicitly? Why would someone want to find you badly? Because most criminals don't care who they're targeting, just so long as they have a target.

EDIT:

And because you're going to jump on semantics if I let you, the ones who do care who they're targeting aren't targeting you, they're targeting someone they know.

[wheel]

I still haven't heard one argument that wasn't born from paranoia that gives reason to not have publicly available information stored and made available to the public.

Because it's none of your d*** business. That's not paranoid, I just want your nose out of my face.

[Demaestro]

Generally, holding personal information (even if it's publicly available) requires a license

Where? Germany? China?

I have never heard of such a thing. What public info do you need a license to hold? I would love even 1 or 2 examples from a free world country. I can say that in Canada there is no general rule saying you need a license to hold public info. That sounds made up to me.

I don't doubt they exist but I am curious what an example of 1 would be cause I can't think of any PUBLIC info you need a license to hold. Hard to consider info public under those circumstances, could it even be considered public info if you need a license to hold it?

Yes you have, however, you have simply dismissed it as paranoid.

Kaled, humor me and add the reason to this thread, I seem to be reading over it.

What reason is there to not allow someone to record publicly available information?

I still haven't heard one argument that wasn't born from paranoia that gives reason to not have publicly available information stored and made available to the public.

Because it's none of your d*** business. That's not paranoid, I just want your nose out of my face.

So you are saying that publicly available information is none of my d*** business? Well now I understand why we disagree, because I am the public, and like it or not publicly available information is in fact my business. It is the beauty of a free society.

[kaled]

Where? Germany? China?

Well, the UK for a start and, let's be clear about this, we we late to the party!

The reason why collecting, collating and publishing public data can be a bad thing is that it makes life easier for nutcases to find people. And since I'm being accused of being paranoid, you obviously accept that nutcases do exist (because you are accusing me of being one) thereby at least partially defeating your own argument... DOH!

There have been a number of cases where security experts have tracked people down from various snippets of information posted on websites. If all the necessary information is collected into one place, it will become easier to find people and, like it or not, there are some people out there who don't want to be found. Thousands of people go missing in the UK every year to start new lives because they simply hate their current life. So many go missing that the Salvation Army actually runs a service to try to reunite families.

There, you've had the reason spelled out very simply in black and white. If you wish to admit that you don't understand then fine but that's your problem not mine.

Kaled.

[Demaestro]

you obviously accept that nutcases do exist (because you are accusing me of being one) thereby at least partially defeating your own argument... DOH!

Firstly I never accused you of being a nut. Please don't spread misinformation. We have enough of it to deal with on this planet. Secondly I never suggested there aren't nut jobs. I am suggesting that a nut job having your address doesn't make you a target of said nut job.

The reason why collecting, collating and publishing public data can be a bad thing is that it makes life easier for nutcases to find people

Ok I get that, but try to understand my counter to your point.

The same can be said about a phone book. Should they be outlawed because someone can up another person in the phone book and have their address? Would they target that person simply because they have their address?

If having info on a person is enough to target them, then all these nut jobs have to do is go outside, look at a house, and they have someone's address. That would be much easier than setting up a trap website hoping to acquire an address close enough to you so that you can target it and it would ensure that your target lived close by.

Criminals don't open to a page in the phone book and point to a name and decide to go attack that person. Just like if you go to a website and it records your area, that isn't going to create a situation where a nut job decides to show up at your house.

There is as much chance of some nut job following you home from a mall as there is them following you home from a website.

What I am trying to convey is that anything can make you a target of a nut job. You could flash your lights at someone to let them know their lights are off and they could shoot you for it. That doesn't mean we need a law stopping people from flashing people with their headlights if that person's headlights are off.

There are a million scenarios where things can make a criminals life easier to find you... none of these justify a society loosing rights to free access to public info just in the off change some mystery nut job may or may not target me becuase they got my address from somewhere.



Curious... what law(s) in the UK make it illegal to hold public info?

[kaled]

I said "find" not pick a target at random!

Suppose a police officer takes all the usual precautions about keeping his address private but some loony decides to make it readily available just because it's found on some obscure public list somewhere. Who knows what the consequences might be! There have also been cases of would-be Muslim terrorists looking for any soldier to kill.

If someone is thinking of writing something like "my brother in law is a police officer and he's in the phone book" - I don't want to hear it.

Incidentally it's worth pointing out again that publishing such information without permission would almost certainly be a breach of the data protection act in the UK.

Kaled.

[lostdreamer]

There is a website here in my country which is in a grey area.

They publicize the address info of people being accused for pedofelia.

These people have not been arrested for it, nor did a judge rule in this, they where just accused once. (even people that have relationships / friendships with them could get their addresses listed on that website).

The owner of the website then says: Hey, all I did was copy the address info from other parts of the internet to my website where it's all in 1 place.


Now think of what that single website did to the people's lives.....

People have been making their lives a living hell, because they think they **might** be pedofiles.


You can say: That info was allready in the yellow pages etc. or Everone who wanted to could have found out that info.
And you would be right saying so, BUT.... a lot of people wouldnt have.

If you see a little piece in the paper saying: "marc d. is on trial for ......" Do you actually go out and find out who Marc D is and where he lives? Do you think the 90% of the idiots on this earth would go through all that trouble? I think not.

But then you have a website with 100% alledged pedofiles,
and the idiots come running out, breaking in to their homes, harrassing them daily etc.


Same goes for a few months ago: The southpark show about mohammed.
Do you think that so many moslims would go out of their way to try and find out where the makers live so they can sent them threats?
Or do you think many of the people who happend to read the address info on the muslim sites would not have done anything if they hadnt had it that easy?


For the average Joe, privacy isnt a big concern, but when someone points a finger at you it's a different thing.

Just my 2 cents though....

[john_k]

What exactly is the benefit of publishing a list of router mac numbers of private residences? The only benefit that I can see is to serve as a cover for having been caught in the act of collecting them in the first place.

Whatever benefit you can think of it seems that the potential for misuse and resulting damage is far greater. This is not the behavior of a publicly responsible corporation.

It can rightfully be argued that any techno-crook could cruise around and collect similar information. However, a very large capital investment is required to collect that information on a global scale. Individual criminals or even organized criminals could not easily garner large lists of such data on homes in distant countries. Google has made it easy for these types. They should admit this whole path is a mistake and do what they can to remedy the situation.

[fauxsoup]

I said "find" not pick a target at random!

Then that still begs the question, why would a nutjob be trying to find you? Furthermore, the nutjobs we're talking about aren't out to "find" any particular person, they're looking to "find" people who fit certain criteria.

A serial killer might target white women in their mid-30s, of which there are an exceedingly large number. Fact of the matter is he doesn't have to set up a website or look online to find people meeting his criteria.

A thief, as I already mentioned, is looking for people who appear to be relatively wealthy, amongst other criteria. You cannot determine this from their MAC Address. Google Street View? You can infer somewhat based on their house and vehicle, but you still have to fit those other criteria.

A mugger wants someone who just walked away from an ATM.

The one thing, the one important pattern which you should be noticing is that the criteria do not include "Full Name" or "Street Address." Sure, identity thieves need those tidbits, but they also need a lot more information that's much more difficult to get.

but some loony decides to make it readily available

Exactly. Some loony. We cannot legislate to the loonies, because if we did we would have no freedoms left.

Who knows what the consequences might be!

Exactly. You apparently don't. I will give you a hint: the consequences will be the exact same whether the information is available or not. A nutjob A) doesn't care about who, only what and B) isn't going to stop just because it's difficult to find his target.

There have also been cases of would-be Muslim terrorists looking for any soldier to kill

I'm sure. There's a whole ton of soldiers AND would-be Muslim terrorists in Afghanistan and Iraq playing this little game out as we speak. I'm sure the soldiers would love it if someone told them the location of every Terrorist, and I'm sure the Terrorists would love to know the same about the soldiers. Wanna know what's funny, though? Neither group stops, even though they don't have that info!

I'm going to go through the key points of the Data Protection Act according to Wikipedia as a nutjob. Just for posterity's sake.

Data may only be used for the specific purposes for which it was collected.

Okay. I will not do anything besides murder the person whom I'm targeting.

Data must not be disclosed to other parties without the consent of the individual whom it is about...It is an offence for Other Parties to obtain this personal data without authorisation

Okay. I will not tell the police what information I have on you.

Individuals have a right of access to the information held about them...

Okay. If you want to know what I know about you, I will tell you.

Personal information may be kept for no longer than is necessary and must be kept up to date

Okay, I will discard the information immediately after the murder, and in the meantime keep tabs on you so I know the information is accurate.

Personal information may not be sent outside the European Economic Area...

Okay, I will not send your information to my friends outside of Europe.

Subject to some exceptions for organisations that only do very simple processing, and for domestic use, all entities that process personal information must register with the Information Commissioner's Office

Murder is an exceedingly simple process.

Entities holding personal information are required to have adequate security measures in place...

I will never maintain a hard copy of your personal information.

Subjects have the right to have factually incorrect information corrected

Alright, if I have the wrong address and you want to make sure I have the right one, please do tell me.


The Data Protection Act doesn't afford you the protection you allege that it does. It regulates what an organization does with personally identifiable information it collects.

I have the right to collect information from you at any point in time which you may enter into business with me. This includes if you visit my website. If I happen to pull your MAC address and use it for the purposes of geolocation, I have every right to do so. I may not share your information without your permission, but I can collect my own, because you visited my website.

Note, of course, that a MAC Address cannot be personally identifiable, even though it's unique, as numerous individuals may be using the same router. The same goes for a Geolocation: it points to longitude/latitude coordinates, which can in some cases be translated into a street address, but any street address may house any number of individuals, and you cannot possibly determine which person based purely on those coordinates or street address.

[fauxsoup]

@john_k

What exactly is the benefit of publishing a list of router mac numbers of private residences?

Targeting advertisements. Suppose you're looking for Pizza: I know what town you live in, I can tell you the best options in town. If I have your geolocation I can take it a step further and tell you which one is closest to you.

Now, consider someone who's in a town he doesn't know and he gets bit by a snake! It's a fast acting poison, so he can't wait for an ambulance. Where's the nearest hospital?

Whatever benefit you can think of it seems that the potential for misuse and resulting damage is far greater

That's a bold statement. Find me case where someone used a geolocation to perpetrate a crime.

Individual criminals or even organized criminals could not easily garner large lists of such data on homes in distant countries

What information? Their physical location? Because I'm looking across the street and I can tell you a building is there. I've got no other information on that building besides where it is, and anyone with working eyes could tell you the same.

I can also go to the town hall and copy a map of the city, probably get a list of residents by address, and pull individual blueprints for each of the buildings at those addresses.

I fail to see how giving a criminal the physical location of a building helps him at all.

[kaled]

fauxsoup,
That has to be just about the most pointless, crass, stupid, irrelevant, and factually incorrect rant I have ever seen.

Furthermore, the nutjobs we're talking about aren't out to "find" any particular person, they're looking to "find" people who fit certain criteria.

Unbelievable! What kind of person tells another what "we" are talking about? I (that means me) I really am talking about searching for specific individuals. You may be talking about something else but I know what I'm taking about.

The Data Protection Act doesn't afford you the protection you allege that it does. It regulates what an organization does with personally identifiable information it collects.

<snip> The Data Protection Act regulates the collection and storage of personally identifiable information and what can be done with it. In particular, there is a requirement to keep such data securely - publishing it on the internet hardly fits the bill does it?

Kaled.

[edited by: lawman at 11:30 pm (utc) on Aug 10, 2010]

[wheel]

So you are saying that publicly available information is none of my d*** business? Well now I understand why we disagree, because I am the public, and like it or not publicly available information is in fact my business. It is the beauty of a free society.

Oh horsehsit. It's not the beauty of a free society for you to be able to access my personal information. Just because you can take it doesn't make it yours. As has already been noted in this thread, this level of privacy invasion is specifically illegal in many countries, which is why they're being investigated by numerous governments. Does 'illegal' have any bearing in your beautiful world?

[arieng]

I've been standing on the sidelines on this one up until now, but I gotta weigh in.

Kaled and Wheel are spot on. Just because personal information is publicly available right now, doesn't make it right to use that information for your own personal gain, whatever that gain may be. It may be legal, but it isn't right. I have faith that the US legal system will come to the same conclusion in the long run.

[fauxsoup]

What kind of person tells another what "we" are talking about?

Who says you were included in "we?" "We" stands for the people who are on the other side of the argument from you. If you disagree with me, don't include yourself in "we."

I really am talking about searching for specific individuals

And the reason I address that the way I do is because IT IS NOT HOW CRIMINALS OPERATE.

Do you want to know who DOES look for specific people? Employers you've applied to, police investigators, friends of yours, and most notably not the people who are going to misuse your personal information. 99.9% of the time, any person who is looking for information specifically about you is someone you know, and, as has already been stated, if you want to legislate based the on the incredibly unlikely and ultimately unpreventable we will have no freedoms left, corporate or personal.

For proper illustration of this point, consider that 0.1% of the time, a Tuba might be used as a murder weapon. Clearly we should outlaw tubas.

2% of the time someone is stabbed by a steak knife. All public silverware should be plastic. Oh, wait, I'm sorry: plastic can be sharp too. Use your hands.

Arsonists use lighters or matches to start fires frequently. Clearly they should be outlawed.

You (and yes, I mean you) are talking about outlawing a Tool which has numerous legitimate uses because a few nutjobs might misuse it. My (and this does not include you) point is that these nutjobs are going to do what they were going to do with or without that tool; so, if it's useful, why get rid of the tool?

The Data Protection Act regulates the collection and storage of personally identifiable information

Which I am 93.7% positive includes neither your MAC Address nor the geolocation of your wifi network.

In particular, there is a requirement to keep such data securely - publishing it on the internet hardly fits the bill does it?

Right, it doesn't, but Google isn't publishing personally identifiable information. It gives you the geolocation of a wifi network, probably the point at which the street view car identified the network (in the middle of the street) within a range of ~9 meters (or 27 feet). So, if you're the only person within 27 feet of a point on the street with a router, it could technically be personally identifiable, except you still have that one-to-many relationship between routers (one) and people (many)

That's not personally identifiable information.

And you still haven't answered the question as to why anyone would be seeking you out. Or that police officer. Or that soldier (for the record, that Muslim terrorist would probably be just as happy to blow up a bus full of civilians as a bus full of soldiers).

[Demaestro]

It's not the beauty of a free society for you to be able to access my personal information

You are right, it is the beauty of a free society that I am able to access your public information, not your personal information.

I think you are taking my points the wrong way. I am not arguing that bad can't be done with this info, clearly it can.

Conceded this point I will play devil's advocate and say why stop there? Bad can be done with most seemingly 'good' tools as well as info. Why not make them illegal too? Knifes, baseball bats, cars.... etc. In a free society the fact that something COULD be used for bad has rarely been a good enough reason to make something that isn't inherently bad, illegal.

There is a website here in my country which is in a grey area.

They publicize the address info of people being accused for pedofelia.

These people have not been arrested for it, nor did a judge rule in this, they where just accused once. (even people that have relationships / friendships with them could get their addresses listed on that website).

The owner of the website then says: Hey, all I did was copy the address info from other parts of the internet to my website where it's all in 1 place.

See this is a perfect example of what I am talking about. This is a person who isn't using the information available to him responsibly. Should the 'parts of the Internet' that he got the info from be charged with a crime? Should they not be allowed to have the info that he gathered?

I assume that where he got much of the information was from the public documentation in regards to upcoming cases. Information which is PUBLIC and is rightfully PUBLIC. To make it illegal for a citizen to look up, record, and even make public information available to other citizens a crime is a slippery slope that I am against.

That is my point. Not that Google was morally correct, not that others should do the same as Google in this case. My point is that Google has the right to access and record public info.

I think our right to access and use public info is greater than our right to withhold what rights the public has with public info.

In my view, and in the view of the law the airways are public. There are rules that need to be followed when using the public airwaves, just like using any public entity, but the airwaves are public and I feel it is our right to record this info.

Kaled I appreciate that if someone publishes the id of a police officer and his address then that is stupid and I don't think that is right. If someone did that and someone else hurt the officer or his family then I am sure most places would rightfully consider the person who made the info available an accomplice. That would be akin to drawing a map of your ex husbands house and giving it to a crack head and saying "Here is the address of a house with a nice tv and a map of the inside."

That scenario shouldn't make drawing maps of people's houses illegal, just like posting a cop's info shouldn't make record public info illegal, just like stabbing someone with a knife shouldn't make knives illegal. But a person doing that should be punished.

Bad people do bad things and use good things to do them all the time. In all my scenarios the perpetrators should be punished, but their tools shouldn't be outlawed.

[kaled]

Bad people do bad things and use good things to do them all the time.

A knife is useful and has legitimate uses. A nationwide list of router mac addresses may possibly have legitimate uses but, in any case, it was created without the necessary permissions.

Which I am 93.7% positive includes neither your MAC Address nor the geolocation of your wifi network.

I'm sorry, I didn't realise you're a visitor from Vulcan - <snip> but for the record, for anyone living in a remote area, a mac address and a reasonably accurate geolocation would undoubtedly constitute personal information because it would mean that a person could be identified by the geolocation and therefore by the mac address.

<snip>

Kaled.

[edited by: lawman at 11:32 pm (utc) on Aug 10, 2010]