A while ago I posted about the role of actor/inventor Hedy Lamarr in the development of the "frequency hopping" communication technology now used in cell phones, WiFi, Bluetooth and various military applications, among others. Now (well, since last year) there's a whole movie about it: Bombshell: The Hedy Lamarr Story. In fact, there's actually something of a cottage industry in Lamarr-related productions, including books, plays, magazine articles and not a few blog posts.
The movie goes into detail on Lamarr's life, from her childhood in Vienna to her Hollywood career, her relationship with aviation magnate Howard Hughes (who provided access to his company's chemists and engineers for her personal projects), her now-famous patent with George Antheil, her reclusive later days and her eventual recognition for her technical contributions. There are fresh interviews with friends, admirers, children and grandchildren along with archival interviews of Lamarr herself, altogether providing a well-rounded view of a lively mind.
Bombshell and the Hedy Lamarr revival in general have given long-overdue appreciation to someone who until recently was most recognized for her work in an industry concerned nearly exclusively with her looks, despite her efforts to find more challenging roles and her ultimately unsuccessful attempts to break into producing. My one quibble with the film concerns the impact of her patent. Because geek.
It is clear that US Navy contractors used the patent directly in the development of a communication system among ships, planes and sonobuoys and that a related system was used during the naval blockade in the Cuban missile crisis. At least some of that work was done before the patent expired, lending support to Lamarr's claim that she was due the customary payment for the use of her and Antheil's invention.
It's also clear that Antheil contributed significantly to the patent, particularly because he had experience in synchronizing player pianos. The scheme used 88 frequencies, one for each key on a piano, and needed the ship's radio and the torpedo's to stay in sync. Three guesses how this was accomplished. Nonetheless, the initial idea of frequency hopping was Lamarr's and it was she who actively recruited Antheil for assistance with the practical design.
This was a real, significant contribution to communications, and one that was put to practical use, albeit not as originally designed, including in one of the most critical moments of the 20th century. Neither was it a fluke. Lamarr had a lifelong interest in what we now call STEM and this was not her only invention, just the most successful. From what I've seen I have no doubt at all of her geek cred.
However, we should be careful not to go too far, as least not without providing a bit of perspective. The film itself doesn't go so far as to say Lamarr invented WiFi. That would simply not be accurate, though that hasn't stopped the occasional web site from making just that claim. However, it does heavily imply that frequency hopping plays a major role in, for example, the security of military satellites, and it explicitly calls out WiFi, bluetooth and cell phones to claim that Lamarr's invention touches a huge swath of modern-day humanity.
Yes, but ... No one person invented WiFi, which includes everything from the use of the frequency spectrum to the handshaking and security protocols, an implementation of IP (internet protocol) and the specification of metadata such as the SSID. Likewise, Lamarr's is not the only patent or invention concerning frequency hopping. None other than Nikola Tesla filed an early patent describing it. Wikipedia has a summary of other developments of the concept, including use by the German military in World War I, well before Lamarr and Antheil's patent.
WiFi certainly doesn't use piano rolls to select frequencies. Technology has marched on in the decades since then. If we're going to credit the general concept of frequency hopping, we should recognize its full history, not just Lamarr's contribution. Likewise for frequency hopping in the context of Bluetooth and CDMA in cell phones.
As to security, while the patent was originally filed for a "secret communication system", frequency hopping doesn't provide meaningful security against modern attackers. Any real security is provided by encryption systems built on usual suspects like DES and RSA, which operate on completely different principles and were of course developed completely separately. To see this, look no further than WiFi, whose original security was notoriously weak, even though it included both frequency hopping and an encryption layer on top of that. Neither that layer nor the later improvements have anything to do with frequency hopping.
On the other hand, another of Lamarr's original motivations was to circumvent jamming -- flooding a frequency with enough noise to drown out any real communication. Frequency hopping with a shared key -- the gist of the patent -- is still effective for that. If you don't know which of several dozen frequencies the actual signal is on, you have jam all of them, which requires proportionately more power and might not even be practical in some situations. That's very much alive, and important in military applications, but it's not a form of secrecy and it has little to do with WiFi or bluetooth, except that switching WiFi or Bluetooth frequencies can avoid accidental interference from other devices.
By all accounts Hedy Lamarr was an impressive person: talented, highly intelligent, diligent, creative and in many respects ahead of her times. Bombshell does a fine job conveying this, and, probably more importantly, the often tragic tension between who she was and who most of the world wanted her to be. It is also forthright about her flaws and failings and it even does a decent job with the technical details, even considering the critiques above. All this is well worth recognizing and celebrating. Putting Lamarr and Antheil's patent in proper perspective does nothing to diminish this, even if it takes away the easy narrative of Lamarr the unsung hero of the mobile revolution.
Showing posts with label WiFi. Show all posts
Showing posts with label WiFi. Show all posts
Friday, May 18, 2018
Wednesday, March 30, 2011
Just how much should one be unsettled by all this unsettling stuff?
Sitting here as I type this, I can't see you reading it. With a couple of exceptions, I have little idea who you might be, and you may well know me only through my profile and posts here. In the absence of face-to-face interaction, it's easy to think oneself anonymous. For all you know, I could be a dog.
It's easy to think oneself anonymous on the web, but there are significant ways in which this just isn't so. As I've mentioned in a few recent posts, for example, a web server can find out if you're logged in to various sites, your browser quite likely has a unique fingerprint, and the location of your WiFi router is probably in several databases which can be used to locate people who aren't even connected to it (on a recent road trip, I helped install a brand-new wifi router, and did a double-take when Apple's location service knew where I was -- because of the half-dozen other WiFi routers in range).
Which brings us to the question: To what extent are these just somewhat unsettling facts of web.life and to what extent are they cause for real concern? And of course, the answer is "it depends".
Fine. What kinds of things does it depend on?
For such things to be more than theoretical concerns, someone has to do something harmful with the information that they wouldn't have been able to do anyway, or at least, the likelihood of someone doing harm has to increase (or if you really want to be technical, the expected harm has to be outweigh any expected benefits, using "expected" in the probability sense). The downside will depend on what kinds of bad things can happen, which depends on the particular unsettling fact, and how likely they are to happen, which can depend on all sorts of things.
For example, there's probably not a lot of harm in most cases if a server can tell that you're logged into FaceSpace, but if your employer has a strict policy against that and someone decides to install a FaceSpace login detector in your company's internal homepage, the consequences could be serious. It's up to you to weigh how likely that is and how much you need the job (and how important it really is to browse FaceSpace at work).
If you live under a regime that bans unauthorized WiFi routers, the odds of something bad happening if you put one up anyway are pretty high. It's almost certainly not worth it. In most places, however, it shouldn't pose a problem. If your security is set up properly, most likely all that someone can determine is that there's a WiFi device with some particular SSID near some particular location. Given that it's easy to determine that there is, say, a house with a mailbox and electricity at a given location, that doesn't seem so dangerous, once you get past the creep-out factor of someone being able to detect something inside your home that they can't see.
To a large extent then, such things are just a part of conducting business on the web. There's nothing wrong with being concerned about privacy, or taking reasonable steps to try to protect one's privacy, but it's a mistake to expect one's online life to be perfectly private.
But the same can be said of one's offline life. Ultimately, issues of privacy are not technical, but social and legal. Expectations of privacy have always been around. So have breaches of those expectations, and so have various ways of trying to cope with such breaches. Which is worse: having your Awful Secret shouted in the town square of your medieval village, or to the whole tribal group around the prehistoric campfire, or having it posted to millions of people on the modern web? I don't see much difference. All three cases are serious. What matters isn't how many people find out, but how many people that you care about find out. I'm not convinced that technology changes that picture much.
It's easy to think oneself anonymous on the web, but there are significant ways in which this just isn't so. As I've mentioned in a few recent posts, for example, a web server can find out if you're logged in to various sites, your browser quite likely has a unique fingerprint, and the location of your WiFi router is probably in several databases which can be used to locate people who aren't even connected to it (on a recent road trip, I helped install a brand-new wifi router, and did a double-take when Apple's location service knew where I was -- because of the half-dozen other WiFi routers in range).
Which brings us to the question: To what extent are these just somewhat unsettling facts of web.life and to what extent are they cause for real concern? And of course, the answer is "it depends".
Fine. What kinds of things does it depend on?
For such things to be more than theoretical concerns, someone has to do something harmful with the information that they wouldn't have been able to do anyway, or at least, the likelihood of someone doing harm has to increase (or if you really want to be technical, the expected harm has to be outweigh any expected benefits, using "expected" in the probability sense). The downside will depend on what kinds of bad things can happen, which depends on the particular unsettling fact, and how likely they are to happen, which can depend on all sorts of things.
For example, there's probably not a lot of harm in most cases if a server can tell that you're logged into FaceSpace, but if your employer has a strict policy against that and someone decides to install a FaceSpace login detector in your company's internal homepage, the consequences could be serious. It's up to you to weigh how likely that is and how much you need the job (and how important it really is to browse FaceSpace at work).
If you live under a regime that bans unauthorized WiFi routers, the odds of something bad happening if you put one up anyway are pretty high. It's almost certainly not worth it. In most places, however, it shouldn't pose a problem. If your security is set up properly, most likely all that someone can determine is that there's a WiFi device with some particular SSID near some particular location. Given that it's easy to determine that there is, say, a house with a mailbox and electricity at a given location, that doesn't seem so dangerous, once you get past the creep-out factor of someone being able to detect something inside your home that they can't see.
To a large extent then, such things are just a part of conducting business on the web. There's nothing wrong with being concerned about privacy, or taking reasonable steps to try to protect one's privacy, but it's a mistake to expect one's online life to be perfectly private.
But the same can be said of one's offline life. Ultimately, issues of privacy are not technical, but social and legal. Expectations of privacy have always been around. So have breaches of those expectations, and so have various ways of trying to cope with such breaches. Which is worse: having your Awful Secret shouted in the town square of your medieval village, or to the whole tribal group around the prehistoric campfire, or having it posted to millions of people on the modern web? I don't see much difference. All three cases are serious. What matters isn't how many people find out, but how many people that you care about find out. I'm not convinced that technology changes that picture much.
Tuesday, March 8, 2011
Wardriving Spartacus
[For those joining recently, "Spartacus" here is a byword for anonymity issues. See this post, or the anonymity label for more background.]
I was going to respond directly to a comment on the previous post, but thought I'd do a proper post since it ties in to one of the main themes here.
An anonymous comment (of course) signed "Anli" says:
The twist here is that it's very easy to tell if a router at some particular location has the particular MAC address. By contrast, in the similar-but-different scenario of using an an anonymizer and trying to hide what IP address you're connecting from, we can assume that The Man can tell who's connecting to nodes that are also providing anonymity, but that takes a bit of work -- packet sniffing, etc., and then all they have is a circumstantial case, though perhaps a fairly strong one, that you're participating in or using an anonymizer.
In the case of a wireless router, anyone with $100 worth of parts -- probably quite a bit less, I haven't looked lately -- can tell for sure that there is a router with a given MAC address at a given location. If The Man in your part of the world has made it a crime to spoof someone's MAC address, then you can probably expect a knock on the door.
But then, in such a case you probably don't have location services enabled anyway, so why would you be spoofing someone's MAC address? Likewise, your MAC is unlikely to be in, say, Apple's database, though it will most assuredly be in The Man's.
It's also worth noting that a laptop or phone that's trying to establish its location doesn't need to actually connect to a given wireless router. It just has to detect packets from it, that is, be within range. As mentioned previously, the MAC address has to be in the clear for the protocols to work [meaning that you can use WiFi routers to establish your own location without announcing that you're doing it --D.H. Sep 2015].
Summary: If you own a wireless router, expect its location to be known and widely available. That's not theory. People do it.
How much of a concern is this, really? Next post ...
I was going to respond directly to a comment on the previous post, but thought I'd do a proper post since it ties in to one of the main themes here.
An anonymous comment (of course) signed "Anli" says:
I like the "Use your router's "MAC cloning" feature". Wouldn't it be nice to have the database of MAC addresses per location? [This would be analogous to a reverse phone directory. Databases of location per address are widely available. Inverting one is left as an exercise. -- D.H.]I started to reply:
Oh, well random 48 bits are fine...
It should be less than 48 if you want to narrow it to a suitable manufacturer...
Random bits will be fine until the next time the car comes by. The system will then say, "hmm, don't know this one, let's add it at this location."
All this on a per-database basis. Skyhook might add you at a different time from Apple, etc. So yeah, what you want is a database of ...And then I realized what you really want is a MAC address that's known to be associated with a lot of locations, all over the world, because this is a basic anonymity problem, though with a twist. It's a basic anonymity problem because the more different locations are associated with your MAC address, that is, the more places you could be, that is, the larger your anonymity set, the less you can be pinned down.
The twist here is that it's very easy to tell if a router at some particular location has the particular MAC address. By contrast, in the similar-but-different scenario of using an an anonymizer and trying to hide what IP address you're connecting from, we can assume that The Man can tell who's connecting to nodes that are also providing anonymity, but that takes a bit of work -- packet sniffing, etc., and then all they have is a circumstantial case, though perhaps a fairly strong one, that you're participating in or using an anonymizer.
In the case of a wireless router, anyone with $100 worth of parts -- probably quite a bit less, I haven't looked lately -- can tell for sure that there is a router with a given MAC address at a given location. If The Man in your part of the world has made it a crime to spoof someone's MAC address, then you can probably expect a knock on the door.
But then, in such a case you probably don't have location services enabled anyway, so why would you be spoofing someone's MAC address? Likewise, your MAC is unlikely to be in, say, Apple's database, though it will most assuredly be in The Man's.
It's also worth noting that a laptop or phone that's trying to establish its location doesn't need to actually connect to a given wireless router. It just has to detect packets from it, that is, be within range. As mentioned previously, the MAC address has to be in the clear for the protocols to work [meaning that you can use WiFi routers to establish your own location without announcing that you're doing it --D.H. Sep 2015].
Summary: If you own a wireless router, expect its location to be known and widely available. That's not theory. People do it.
How much of a concern is this, really? Next post ...
Thursday, March 3, 2011
Now I remember why I don't pay much attention to this kind of stuff
Recently I enabled location services on my MacBook. That couldn't do too much, right? The MacBook doesn't have a GPS attached. A quick check from whatsmyip (go there, then do the "IP Address Lookup") gave a location several miles from my actual one. Clearly that's as close as it can get.
Well, actually, it was accurate to within a hundred yards or so.
After double-checking that I really, really didn't have a GPS, I dug up what was really happening: Like many of us, I'm connected to the internet through a wireless router. That router has a unique MAC address by default. The MacBook's networking layer knows this (otherwise it can't function), so when I'm on my home network, I'm associated with a particular MAC address.
Several parties, including Apple, keep a database of locations of wireless routers. They get these locations by "wardriving" -- driving along looking for WiFi signals and using old-school radio techniques to pinpoint roughly where the signal is coming from. Location services simply contacts the mothership with the MAC address of the router to get the physical location out of the database. This has all been around a while. I'm just slow on the uptake.
Assuming everything's working as intended, this doesn't mean that any random person on the internet can find out your location. You decide whether to share that information, just like you decide whether to share a particular file (caveat: I'm not sure how secure a MacBook's default settings are). Still, it's another for the growing list of unsettling privacy issues (maybe I'll create a new tag).
As I understand it, there's not a whole lot you can do about this form of information gathering, though I didn't delve deep enough into the IEEE standards docs to be sure I had a definitive answer. From what I can make out, though, the source and destination MAC addresses have to be on every packet, unencrypted. Otherwise your router would have to try to decode every encrypted packet it received against the session keys for every active connection in order to see if it was the intended recipient.
Given that, turning off broadcasting of your SSID, using WPA2, whitelisting MAC addresses and so forth is not going to make a difference. The wardriver just has to sniff for packets and note the MAC addresses. That's not to say you shouldn't use WPA2 -- you absolutely should, as it provides decent protection against eavesdropping and unauthorized connections -- just that it won't prevent someone from knowing that a router with a given MAC address is in a given location.
There are some countermeasures you can take:
Well, actually, it was accurate to within a hundred yards or so.
After double-checking that I really, really didn't have a GPS, I dug up what was really happening: Like many of us, I'm connected to the internet through a wireless router. That router has a unique MAC address by default. The MacBook's networking layer knows this (otherwise it can't function), so when I'm on my home network, I'm associated with a particular MAC address.
Several parties, including Apple, keep a database of locations of wireless routers. They get these locations by "wardriving" -- driving along looking for WiFi signals and using old-school radio techniques to pinpoint roughly where the signal is coming from. Location services simply contacts the mothership with the MAC address of the router to get the physical location out of the database. This has all been around a while. I'm just slow on the uptake.
Assuming everything's working as intended, this doesn't mean that any random person on the internet can find out your location. You decide whether to share that information, just like you decide whether to share a particular file (caveat: I'm not sure how secure a MacBook's default settings are). Still, it's another for the growing list of unsettling privacy issues (maybe I'll create a new tag).
As I understand it, there's not a whole lot you can do about this form of information gathering, though I didn't delve deep enough into the IEEE standards docs to be sure I had a definitive answer. From what I can make out, though, the source and destination MAC addresses have to be on every packet, unencrypted. Otherwise your router would have to try to decode every encrypted packet it received against the session keys for every active connection in order to see if it was the intended recipient.
Given that, turning off broadcasting of your SSID, using WPA2, whitelisting MAC addresses and so forth is not going to make a difference. The wardriver just has to sniff for packets and note the MAC addresses. That's not to say you shouldn't use WPA2 -- you absolutely should, as it provides decent protection against eavesdropping and unauthorized connections -- just that it won't prevent someone from knowing that a router with a given MAC address is in a given location.
There are some countermeasures you can take:
- Use your router's "MAC cloning" feature to set its MAC to something already in the database (if you choose a MAC not in the database, it will get added with your location next time the car comes by). Your friends and foes will then think you're in sunny Tahiti or wherever.
- Don't use WiFi
- String a bunch of Cat 5 cable and give up the convenience of wirelessness
- Use a smart phone as a tether -- this has its own set of privacy issues, but I'm not familiar with them and ignorance is bliss [I doubt this helps that much. A tethering phone looks like any other WiFi router to a wardriver, including having a MAC address. If you only use the tethering in one place, say your home, there's no real difference from using any other WiFi router. If you move around, there will be a record that your MAC address was seen at several places, which is probably not what you want --D.H. Sep 2015].
- Disable location services. The world will know that there's a wireless router at a given location, but won't be able to associate it with you or your computer (or at least, not quite as easily)
- Build a suitable Faraday cage around your network.
- Don't worry, be happy.
Please understand I'm not recommending any of these, except possibly the last.
Sunday, May 23, 2010
Hey, it works!
I'm writing this at 30,000+ feet, thanks to onboard WiFi and, surprisingly enough, it's pretty good. I haven't tried streaming a movie, but for just browsing the web as I try to bring the blog back into real time* it seems to work as well as anywhere else. Given that not so long ago there was some controversy as to whether you could even bring a WiFi-enabled device onto a plane without causing it to spiral into the ground, that's a pretty quick about-face. I'd have said "pretty quick progress" but I'm still making up my mind on the "progress" part.
If, bless your heart, you're actually following this blog, check for posts from early May, which will be appearing now. Blogger dates posts by the time of first edit, not by time of completion.
Friday, May 21, 2010
Ok, this is a bit annoying
I'm at an airport (a lot of it going around lately) and they offer free wi-fi. I connect and bring up a web page. As usual, there's a page to accept the terms and conditions. Fine, par for the course.
Then there's a brief 30-second ad before my actual web page loads. OK, fine, an airport has to make a buck.
Then my web page loads. With a frame full of ads at the top. Oh come on.
Come to find out there's a banner full of ads at the top of every page that loads. Now that's just annoying.
Funny how my eye seems to have tuned out the top part of the page ...
Friday, April 23, 2010
Security and the appearance thereof
I'm traveling at the moment, which means I'm currently blogging at you courtesy of a hotel WiFi system. The WiFi is the usual hotel setup: you connect to an unsecured network and the system then intercepts your first web page request and replaces it with a login screen. At first blush, this may give the impression that the system is secure, except that the username/password are put together from the name of the hotel, its street number and the word "internet". They are the same for all guests.
An insecure network is not necessarily a security problem. Rather than expect the network itself, wired or wireless, to be secure, it's better to use some sort of end-to-end scheme which will be essentially equally secure whether or not the network is. The problem comes when a component that you think is secure actually isn't.
Is that the case with a hotel WiFi? It depends. If you take the login page as an indication of security, you've got a security problem waiting to happen. If you take the totally insecure user name and password as an indication of insecurity, then no problem. Unfortunately, it's perfectly reasonable for the non-technical user -- that is to say, almost any user -- to associate passwords with security. That's what they're supposed to be there for, after all.
Tuesday, December 15, 2009
Surfing up and down the east coast
In a previous life, I made a couple of long-haul bus trips across the American southwest. It was an option worth considering for someone with more time than money -- an undergraduate, say -- provided the traveler was someone -- an undergraduate, say -- who didn't mind sitting and occasionally half-sleeping in cramped quarters in the company all manner of interesting people. On the one hand it's slow, something over 40 hours of nearly continuous driving to get about halfway across the continent. On the other hand, you see all sorts of things you'll completely miss in flyover mode. That cuts both ways.
Here in the 21st century it's a whole different game, at least in the Boston-DC corridor. Two carriers, BoltBus and megabus.com, are offering service between major cities aimed not only at scruffy undergrads but also at business travelers. What makes it work?
How does it work? I wasn't able to track down the exact mechanism, but I would have to guess a series of WiMax towers along the route feeding the on-board WiFi.
How well does it work? Well, BoltBus's FAQ cautions that "This technology is new, and there are spots on the trip where the service may be unavailable. We also do not advise downloading large files, as the speed will be relatively slow [...] Plug in and Wi-Fi disclaimer: BoltBus makes every effort to provide these services free of charge to every passenger. However, if, for whatever reason, the service is unavailable we are unable to supply a refund."
Well, whaddya want for a nickel?
I'm not sure which company's transparent attempt to sound like Bus 2.0 works better. You'd think that either CamelCaseNames or domainname.com would be about to fall out of fashion any day now, so I'll give the edge to BoltBus for not using mega.
[Looks like both of these outfits are still in business --D.H. Dec 2015]
Here in the 21st century it's a whole different game, at least in the Boston-DC corridor. Two carriers, BoltBus and megabus.com, are offering service between major cities aimed not only at scruffy undergrads but also at business travelers. What makes it work?
- Speed is not such a problem in the target market. Flying will still be considerably faster for the longer routes, even counting time to and from airports, but DC - New York is nowhere near as long a haul as LA - Albuquerque.
- The bus is still way cheaper.
- These new busses are spiffy, new, less cramped than Ye Olde Greyhound and ... you knew there it had to be in here somewhere ... webby.
How does it work? I wasn't able to track down the exact mechanism, but I would have to guess a series of WiMax towers along the route feeding the on-board WiFi.
How well does it work? Well, BoltBus's FAQ cautions that "This technology is new, and there are spots on the trip where the service may be unavailable. We also do not advise downloading large files, as the speed will be relatively slow [...] Plug in and Wi-Fi disclaimer: BoltBus makes every effort to provide these services free of charge to every passenger. However, if, for whatever reason, the service is unavailable we are unable to supply a refund."
Well, whaddya want for a nickel?
I'm not sure which company's transparent attempt to sound like Bus 2.0 works better. You'd think that either CamelCaseNames or domainname.com would be about to fall out of fashion any day now, so I'll give the edge to BoltBus for not using mega.
[Looks like both of these outfits are still in business --D.H. Dec 2015]
Wednesday, August 29, 2007
WiFi vs. WiMax in Chicago
According to this CNN article [no longer available], Chicago has shelved its plans to blanket the entire city with WiFi because it would cost too much. They are, however, looking at using WiMax for the same purpose.
WiMax clearly wins on range. I haven't run the numbers, but I'm curious as to how it performs when you have thousands (or more?) users all trying to use the same access point.
WiMax clearly wins on range. I haven't run the numbers, but I'm curious as to how it performs when you have thousands (or more?) users all trying to use the same access point.
Subscribe to:
Posts (Atom)
