🚀 go-pugleaf

On Sat, 19 Jun 2010 08:22:43 -0700, JC Dill <jcdill.lists@gmail.com>
wrote:

>Malcolm Hoar wrote:
>> In article <ec4o165c3s0ac1n3u4ifmv5unffkholfuf@4ax.com>, John Navas <jncl1@navasgroup.com> wrote:
>> 
>>> "However, we can already state that [...] Google did indeed record
>>> e-mail access passwords [and] extracts of the content of email
>>> messages."
>> 
>> That's not good but if folks are using cleartext passwords
>> over a wireless connection, they really shouldn't have a
>> "reasonable expectation of privacy".
>
>Not just using cleartext passwords over wifi, using cleartext passwords 
>over UNPROTECTED wifi.  (If they had any protection on their wifi, then 
>Google wouldn't have connected or recorded anything.)  In that case they 
>absolutely have no expectation of privacy.  It's like shouting your 
>password to your friend across the street.
>jc

Not all parts of wi-fi transmissions are encrypted.  The headers,
source and destination MAC addresses, system management packets,
control packets, and some broadcast packets are not encrypted.  One
could easily map a network by simply collecting the source and
destination MAC addresses.  I have not seen anything from Google
indicating exactly what data they were collecting, but my guess(tm) is
that it was MAC addresses, SSID names, and possibly sniffing
broadcasts to determine the type of connectivity.  They were
apparently only logging uncrypted data, but from the vague wording,
could include payload data.  From the unencrypted data, they'll get a
user count, network map, equipment type, and a good guess as to the
backhaul type.  If that data was NOT encrypted, they would get IP
addresses, payload type, service number, and RIP broadcasts, which
would reveal considerably more information about the system and its
topology.


-- 
Jeff Liebermann     jeffl@cruzio.com
150 Felker St #D    http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann     AE6KS    831-336-2558