alt Hacker NewsI am really struggling to see the technical solution here. This isn’t a security question - security has already been lost. We’re talking about a device in a home that the owner doesn’t control, being able to monitor the presence of a person using either WiFi signals or device identifiers.
The obvious solution is to not use that device. But that’s not necessarily possible for a variety of reasons, not all of them controllable.
So, what is the technical solution to this? Anything that’s going to mask a persons RF signal is probably going to make WiFi difficult to use. Anything at the network level is already lost because we have a potentially hostile device in a critical point in the network path.
Am I missing a different solution?
>I am really struggling to see the technical solution here.
Are you? Comments are full of obvious solutions like using your own hardware, which you clearly understand.
>We’re talking about a device in a home that the owner doesn’t control
No, we definitely are not. As you yourself immediately acknowledge:
>The obvious solution is to not use that device. But that’s not necessarily possible for a variety of reasons, not all of them controllable.
...but then immediately try to do a fuzzy hand wave it away for reasons I don't really understand. Technical solutions don't have to be completely perfect, which is surely not a standard you're holding any social/legal solution to right? Since that would be ridiculous.
As I said, simultaneously pursuing multiple tracks in parallel is the correct approach, as hybrids can be more then the sum of their parts. A purely legal solution ("law against ISPs collecting this data"), if it's even possible to get passed at all, ends up depending heavily on the honor system with all sorts of perverse incentives, and is very challenging to verify. A purely technical solution ("use your own hardware", "route through another end point") could potentially be interfered with (though let's be clear: this isn't actually a thing basically ever). But we can easily imagine hybrid approaches, just as was done in the past with efforts like CableCARD. The law doesn't need to necessarily try to mandate and police hard to verify behavior like how non-property owner controlled hardware acts, but instead can mandate that ISPs must always allow direct dumb interfaces to their network via customer controlled hardware. That's something easy to verify, which enhances compliance, and easy to understand which enhances the politics.
But make no mistake: the technical aspect is an inseparable part of this approach. We need both.