Network Connections Question

[AceC]

This might be a stupid question, but here it goes..

If I log onto an account on a site like Google, can the website tell what wireless networks my device has previously connected to?

Say if I'm using my iPad that was connected to my friend's wireless network before (but no longer is), and she has logged into Google on another device on her network, will using my Google account on my iPad on my network connect the two?

Essentially, what can said website tell from my login? Only the IP address, network history, or what?

 

[throAU]

That's a somewhat open ended question and depends on the browser and any maybe-unpublished security vulnerabilities in the platform.

But (i'm a network admin) as far as I am aware, assuming what we currently know today, iOS (and most other browsers if up to date with security updates) probably WON'T directly give that info up to a website.

Google, however may be able to infer that data via your browser/OSs location services if the browser is permitted to use that. Google did drive-by wireless network plotting in years gone by, not sure if they are still doing that or not, but indirectly via location services Google may know what wifi networks are in your area, but not necessarily whether you connected to them.

 

[AceC]

That's a somewhat open ended question and depends on the browser and any maybe-unpublished security vulnerabilities in the platform.

But (i'm a network admin) as far as I am aware, assuming what we currently know today, iOS (and most other browsers if up to date with security updates) probably WON'T directly give that info up to a website.

Google, however may be able to infer that data via your browser/OSs location services if the browser is permitted to use that. Google did drive-by wireless network plotting in years gone by, not sure if they are still doing that or not, but indirectly via location services Google may know what wifi networks are in your area, but not necessarily whether you connected to them.

Thanks for your answer. I'm clearly not an expert, but I appreciate your input.

So in the case of a Google account, it more than likely wouldn't connect the two since they weren't on the same network at the same time?

 

[2984839]

That's a somewhat open ended question and depends on the browser and any maybe-unpublished security vulnerabilities in the platform.

But (i'm a network admin) as far as I am aware, assuming what we currently know today, iOS (and most other browsers if up to date with security updates) probably WON'T directly give that info up to a website.

Google, however may be able to infer that data via your browser/OSs location services if the browser is permitted to use that. Google did drive-by wireless network plotting in years gone by, not sure if they are still doing that or not, but indirectly via location services Google may know what wifi networks are in your area, but not necessarily whether you connected to them.

The Google Locations Services thing is interesting. It would seem that they can know which wifi network you are currently on, with a high degree of probability.

The Chrome terms of service do say that Chrome will send info about nearby wifi routers to Google if Location Services are used (they are on by default on mobile): https://www.google.com/chrome/privacy/

Google correlates those nearby networks with their GPS coordinates, which it has been collecting via its Street View cars: https://www.maketecheasier.com/google-know-where-wifi-router/

By itself this doesn't let Google see your saved wifi networks, but each time you use Chrome's Location Services, they can track that event, and thus get a history of both your location and the likely wifi network that you were on.

 

[throAU]

^ yup.

if you care about that sort of thing, turn location services OFF unless you need them. WIFI/Cell assisted GPS is pretty accurate, and there's a high likelihood that if you live in a house there is only 1-2 options for wifi network in that exact location and its probably the strongest/closest one that you are on

 

[2984839]

Thanks for your answer. I'm clearly not an expert, but I appreciate your input.

So in the case of a Google account, it more than likely wouldn't connect the two since they weren't on the same network at the same time?

They could connect the two if they want to, but I don't know if they record those sorts of correlations.

Regarding your other question "Essentially, what can said website tell from my login? Only the IP address, network history, or what?", here's an actual entry out of my web server's log:

www.notmyactualwebsite.com 13.21.23.210 - - [08/Apr/2020:04:17:54 +0000] "GET / HTTP/1.1" 200 16629 "www.google.com" "Mozilla/5.0 (X11; OpenBSD amd64; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"

So, the first part of the log entry is the domain name of my website (I put in a fake one here). The next part is the IP address of the visitor (since I visited my own website, this was my own IP so I edited it to be a random one). The date and time follows, along with the actual request by the browser (GET / HTTP/1.1). The server's response (200 means ok) and the amount of data (16629 bytes) transferred follows that. Next we have the referer. If you click a link to get to a site, your browser will send that referring site to the website you are now visiting. In this case, I clicked a link from Google to get here, so the referring site shows up as www.google.com. Lastly, we have the user agent of the browser. This can be used to track people, especially if used in combination with other data such as timestamps of regular visits, installed fonts, window size, language settings, and even your battery level, none of which I do, but is all possible.

 

[AceC]

They could connect the two if they want to, but I don't know if they record those sorts of correlations.

Regarding your other question "Essentially, what can said website tell from my login? Only the IP address, network history, or what?", here's an actual entry out of my web server's log:

www.notmyactualwebsite.com 13.21.23.210 - - [08/Apr/2020:04:17:54 +0000] "GET / HTTP/1.1" 200 16629 "www.google.com" "Mozilla/5.0 (X11; OpenBSD amd64; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"

So, the first part of the log entry is the domain name of my website (I put in a fake one here). The next part is the IP address of the visitor (since I visited my own website, this was my own IP so I edited it to be a random one). The date and time follows, along with the actual request by the browser (GET / HTTP/1.1). The server's response (200 means ok) and the amount of data (16629 bytes) transferred follows that. Next we have the referer. If you click a link to get to a site, your browser will send that referring site to the website you are now visiting. In this case, I clicked a link from Google to get here, so the referring site shows up as www.google.com. Lastly, we have the user agent of the browser. This can be used to track people, especially if used in combination with other data such as timestamps of regular visits, installed fonts, window size, language settings, and even your battery level, none of which I do, but is all possible.

Wow, you are incredibly smart. Thank you though for your answer.

That helps for sure. I'm just trying to figure out some of the connection stuff. Say I'm using my iPad as a hotspot and I'm on cellular data. If my MacBook is connected to that iPad network (since it's acting as WiFi), would any networks that the iPad had visited previously be known to Google or any site visited? I realize that it would catch the location of local networks like you had mentioned before, but I just didn't know how connected that would be to other networks.

 

[hobowankenobi]

How much network/browser/machine info is captured and held in tracking cookies? I suspect a fair amount, but don't really know.

 

[2984839]

How much network/browser/machine info is captured and held in tracking cookies? I suspect a fair amount, but don't really know.

I don't know either, but it shouldn't even be necessary to store that sort of data in the cookie itself. All you need in the cookie is to have a unique identifier, then you just correlate that with the browser and network info you can get from that user via other means. Since that data by itself is usually enough to be a fingerprint, and the cookie ties that browser to a registered user, it could be possible to track a user of a site even when they are not logged in.

 

[hobowankenobi]

Thanks for the insight.

...Is your avatar General Ripper?

 

[satcomer]

Thanks for your answer. I'm clearly not an expert, but I appreciate your input.

So in the case of a Google account, it more than likely wouldn't connect the two since they weren't on the same network at the same time?

Then if you that paranoid then you should be using DuckDuckGo.com and use the BraveBrowser! Using that browser will block cookies if you want to and is considered the safest browser today!

 

[satcomer]

Thanks for your answer. I'm clearly not an expert, but I appreciate your input.

So in the case of a Google account, it more than likely wouldn't connect the two since they weren't on the same network at the same time?

Learn about Cookie Tracking in your browser! So this tells me you use some Google Service and do your searches trough Google!

I say stay away from the ad agency called Google because they track everything you do in Android smart phone and everywhere where you go. So you have to ask yourself if you want an add agency to constantly tracking you then go Android!

Do yourself and use a smart phone not running Android and use DuckDuckGo to do your searching from now on!