CloudServices/Location/Privacy - Revision history

Cpeterson at 19:39, 20 October 2014

2014-10-20T19:39:13Z

← Older revision		Revision as of 19:39, 20 October 2014
Line 1:		Line 1:
	~~#REDIRECT [~~[https://location.services.mozilla.com/privacy]]		[https://location.services.mozilla.com/privacy Mozilla Location Service Privacy Policy]

Cpeterson: redirect to https://location.services.mozilla.com/privacy

2014-10-20T19:37:28Z

redirect to https://location.services.mozilla.com/privacy

← Older revision		Revision as of 19:37, 20 October 2014
Line 1:		Line 1:
	~~This page is outdated~~.		#REDIRECT [[https://location.services.mozilla.com/privacy]]

Hannosch: Replaced content with "This page is outdated."

2014-01-30T17:58:05Z

Replaced content with "This page is outdated."

← Older revision		Revision as of 17:58, 30 January 2014
Line 1:		Line 1:
	~~==Privacy==~~		This page is outdated.

	~~Location information is a sensitive topic and there are many privacy concerns in this area.~~

	~~At the heart of a geo-location service lies it ability to report back the physical location of a user, based on public signal sources around the user.~~ This is an exchange of very private and sensitive data, so we must do our utmost to protect this exchange and minimize the risk of tracking users across multiple service requests or uniquely identifying users in any way.

	~~In addition to the service user, we need to protect the operators of public wifi networks, respect their privacy choices and enable them to opt-out of our service.~~

	~~Privacy concerns for specific technologies:~~

	~~===Cell towers===~~

	Cell towers are understood to be public radio signal sources, and there are no privacy concerns known to us. We'll only use metadata information about the available cell towers and networks and never any actual network traffic.

	~~===Wifi===~~

	~~While Wifi networks send radio signals into the public space, different countries have very different views on the privacy aspects of them.~~

	For the purposes of the geo-location service we are only interested in the public metadata about wifi networks, specifically the technology standard in-use, the frequency it's operated on, the signal strength and the technical network name (bssid). We'll never listen in or record actual network traffic.

	For the wifi operator to opt-out, we follow the industry standard of filtering out any wifi networks with a clear text name (ssid) ending in '_nomap' and ignore any ad-hoc wifi networks. Both of these filter actions happen on the client side, so our service never sees them.

	On the lookup side, we follow the best practice and require two co-located pieces of information to provide a location answer. This further minimizes the risk of someone being able to lookup the whereabouts of a single bssid over time.

	~~===IP addresses===~~

	In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll do a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.

Telliott: Telliott moved page Services/Location/Privacy to CloudServices/Location/Privacy

2013-11-19T20:24:33Z

Telliott moved page Services/Location/Privacy to CloudServices/Location/Privacy

← Older revision	Revision as of 20:24, 19 November 2013
(No difference)

Hannosch: /* Wifi */

2013-09-17T00:20:22Z

Wifi

← Older revision		Revision as of 00:20, 17 September 2013
Line 17:		Line 17:
	While Wifi networks send radio signals into the public space, different countries have very different views on the privacy aspects of them.		While Wifi networks send radio signals into the public space, different countries have very different views on the privacy aspects of them.

	For the purposes of the geo-location service we are only interested in the public metadata about wifi networks, specifically the technology standard in-use, the frequency it's operated on, the signal strength, the technical network name (bssid~~) and clear text network name (ssid~~). We'll never listen in or record actual network traffic.		For the purposes of the geo-location service we are only interested in the public metadata about wifi networks, specifically the technology standard in-use, the frequency it's operated on, the signal strength and the technical network name (bssid). We'll never listen in or record actual network traffic.

	For the wifi operator to opt-out, we follow the industry standard of filtering out any wifi networks with a clear text name (ssid) ending in '_nomap' and ignore any ad-hoc wifi networks. Both of these filter actions happen on the client side, so our service never sees them.		For the wifi operator to opt-out, we follow the industry standard of filtering out any wifi networks with a clear text name (ssid) ending in '_nomap' and ignore any ad-hoc wifi networks. Both of these filter actions happen on the client side, so our service never sees them.

	~~For all other wifi networks~~, ~~our client software creates a cryptographic hash out of~~ the ~~bssid~~ and ~~ssid and sends it~~ to ~~the service~~.		On the lookup side, we follow the best practice and require two co-located pieces of information to provide a location answer. This further minimizes the risk of someone being able to lookup the whereabouts of a single bssid over time.

	~~Using a hash which includes~~ the ~~SSID, allows anyone to change the SSID and thereby invalidating all our records relating to any specific wifi network, while still~~ being able to ~~contribute to the service in the future under the new hash key.~~

	~~We'll take additional measures to avoid~~ the ~~possibility~~ of ~~looking up any~~ single ~~hash. This avoids the scenario where someone can record the wifi hash for a users phone and use this to lookup that persons physical location~~ over time~~. Measures include only answering service requests for which at least two co-located wifi hashes are provided~~.

	===IP addresses===		===IP addresses===

	In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll do a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.		In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll do a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.

Hannosch: /* Wifi */

2013-06-24T10:55:47Z

Wifi

← Older revision		Revision as of 10:55, 24 June 2013
Line 25:		Line 25:
	Using a hash which includes the SSID, allows anyone to change the SSID and thereby invalidating all our records relating to any specific wifi network, while still being able to contribute to the service in the future under the new hash key.		Using a hash which includes the SSID, allows anyone to change the SSID and thereby invalidating all our records relating to any specific wifi network, while still being able to contribute to the service in the future under the new hash key.

	We'll take additional measures to avoid the possibility of looking up any single hash. This avoids the scenario where someone can record the wifi hash for a users phone and use this to lookup that persons physical location over time. Measures include only answering service requests for which at least two wifi hashes are provided.		We'll take additional measures to avoid the possibility of looking up any single hash. This avoids the scenario where someone can record the wifi hash for a users phone and use this to lookup that persons physical location over time. Measures include only answering service requests for which at least two co-located wifi hashes are provided.

	===IP addresses===		===IP addresses===

	In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll do a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.		In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll do a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.

Hannosch: /* Wifi */

2013-06-12T14:24:21Z

Wifi

← Older revision		Revision as of 14:24, 12 June 2013
Line 15:		Line 15:
	===Wifi===		===Wifi===

	While Wifi networks ~~sent~~ radio signals into the public space, different countries have very different views on the privacy aspects of them.		While Wifi networks send radio signals into the public space, different countries have very different views on the privacy aspects of them.

	For the purposes of the geo-location service we are only interested in the public metadata about wifi networks, specifically the technology standard in-use, the frequency it's operated on, the signal strength, the technical network name (bssid) and clear text network name (ssid). We'll never listen in or record actual network traffic.		For the purposes of the geo-location service we are only interested in the public metadata about wifi networks, specifically the technology standard in-use, the frequency it's operated on, the signal strength, the technical network name (bssid) and clear text network name (ssid). We'll never listen in or record actual network traffic.

Hannosch: /* Privacy */

2013-06-12T14:23:17Z

Privacy

← Older revision		Revision as of 14:23, 12 June 2013
Line 6:		Line 6:

	In addition to the service user, we need to protect the operators of public wifi networks, respect their privacy choices and enable them to opt-out of our service.		In addition to the service user, we need to protect the operators of public wifi networks, respect their privacy choices and enable them to opt-out of our service.

	~~Cell towers are understood to be public radio signal sources, and there are no privacy concerns known to us.~~

	In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll do a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.

	Privacy concerns for specific technologies:		Privacy concerns for specific technologies:

	===Cell towers===		===Cell towers===

			Cell towers are understood to be public radio signal sources, and there are no privacy concerns known to us. We'll only use metadata information about the available cell towers and networks and never any actual network traffic.

	===Wifi===		===Wifi===

			While Wifi networks sent radio signals into the public space, different countries have very different views on the privacy aspects of them.

			For the purposes of the geo-location service we are only interested in the public metadata about wifi networks, specifically the technology standard in-use, the frequency it's operated on, the signal strength, the technical network name (bssid) and clear text network name (ssid). We'll never listen in or record actual network traffic.

			For the wifi operator to opt-out, we follow the industry standard of filtering out any wifi networks with a clear text name (ssid) ending in '_nomap' and ignore any ad-hoc wifi networks. Both of these filter actions happen on the client side, so our service never sees them.

			For all other wifi networks, our client software creates a cryptographic hash out of the bssid and ssid and sends it to the service.

			Using a hash which includes the SSID, allows anyone to change the SSID and thereby invalidating all our records relating to any specific wifi network, while still being able to contribute to the service in the future under the new hash key.

			We'll take additional measures to avoid the possibility of looking up any single hash. This avoids the scenario where someone can record the wifi hash for a users phone and use this to lookup that persons physical location over time. Measures include only answering service requests for which at least two wifi hashes are provided.

	===IP addresses===		===IP addresses===

			In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll do a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.

Hannosch: /* Privacy */

2013-06-12T14:01:30Z

Privacy

← Older revision		Revision as of 14:01, 12 June 2013
Line 9:		Line 9:
	Cell towers are understood to be public radio signal sources, and there are no privacy concerns known to us.		Cell towers are understood to be public radio signal sources, and there are no privacy concerns known to us.

	In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll to a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.		In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll do a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.

	Privacy concerns for specific technologies:		Privacy concerns for specific technologies:

Hannosch at 14:00, 12 June 2013

2013-06-12T14:00:51Z

← Older revision		Revision as of 14:00, 12 June 2013
Line 2:		Line 2:

	Location information is a sensitive topic and there are many privacy concerns in this area.		Location information is a sensitive topic and there are many privacy concerns in this area.

			At the heart of a geo-location service lies it ability to report back the physical location of a user, based on public signal sources around the user. This is an exchange of very private and sensitive data, so we must do our utmost to protect this exchange and minimize the risk of tracking users across multiple service requests or uniquely identifying users in any way.

			In addition to the service user, we need to protect the operators of public wifi networks, respect their privacy choices and enable them to opt-out of our service.

			Cell towers are understood to be public radio signal sources, and there are no privacy concerns known to us.

			In the future we might want to use Geo-IP based lookups to enhance or provide coarse-grained fallback for the service. Before we do this, we'll to a thorough analysis of the involved risk, as the combination of IP address and time of service usage can uniquely identify users.

			Privacy concerns for specific technologies:

			===Cell towers===

			===Wifi===

			===IP addresses===