4

Computer World is reporting that Android devices phoning home have given Google a database with almost every wifi password in the world to it. Is this groundless hysteria, or a genuine concern?

If this is a legitimate report, short of banning android from my network is there a simple way to keep my password private?

Improve this question

1 Answer 1

Reset to default
12

The article is a huge amount of FUD and scaremongering, but even if you take the basic info outlined in it then there is only a small worry and it is very easy to protect yourself.

  • if you have your android device set to backup online then yes, it will back up known wifi passwords. This is the same as iPads and other devices that give this cloud backup option.
  • assume most people do these online backups- so there is a lot of this sort of data stored. The connection the article makes is that Google knows these passwords. This is not really true. It's like saying that Google knows all your data. It may store it, but that is very different to knowing it.
  • potentially, if this data is stored in the clear and Google is hacked then it could be a worry, but to be honest, there are far better ways to attack me than access my WiFi.

Solutions:

  • Use SSL or other encryption when using 3rd party networks, even on encrypted networks. This should be default behaviour anyway.
  • Turn off online backup on any device that uses your WiFi

And of course - as Joshua says: If you have something you don't want anyone else to see, never share it with anyone (this includes never putting it on someone else's servers)

Improve this answer
5
  • I agree with Rory, articles about this topic are very slanted. The truth is you have more to fear from compromised devices (laptops, iPhones, Androids) and malicious users than you do Google when it comes to your wifi network. If Google or Apple or Microsoft had a nefarious plan to use your WiFi they could do so using the software and devices you choose to allow on it but that isn't happening, and a large database of WiFi passwords is little more than a hassle if your site enforces an authorized mac list. End users have nothing to fear from Google, but more to fear from untrusted individuals.
    – Joshua Briefman
    Sep 15, 2013 at 2:43
  • 2
    I am not so concerned about Google as about bad actors who are in a position to force Google to act against our best interests. We've seen a lot of this in the news over the past couple of months, remember? As for me, I have this turned on, but my phone connects only to my guest network.
    – Michael Hampton
    Sep 15, 2013 at 3:37
  • @JoshuaBriefman spoofing mac addresses is trivial; enabling filtering wouldn't do any more good against an attacker who had your WPA password than it would against one who cracked your WEP password.
    – Dan Is Fiddling By Firelight
    Sep 15, 2013 at 3:55
  • @Dan-Neely I didn't say a mac address authorization list was perfect. What I said was you were better off using such an option rather than being afraid of Google connecting to your network via a master list of passwords. True it is trivial to perform, but it is also a good indication of an unauthorized device on the network and is really more of an alert that something is up. I really don't know too many hackers who try to spoof a "known good mac address" prior to connecting to a network for attack anyway, they would have to physically be near authorized equipment, if so your mole is in house.
    – Joshua Briefman
    Sep 15, 2013 at 4:01
  • 1
    @MichaelHampton Very true...What I tell everyone is if you don't want something known to the world, never put it on a third party site. Because yes, any government agency with the proper paperwork can usually coerce what they want out of a business. FBI, CIA, NSA, Red Army, KGB...if your working with a company (name a company who isn't affected by legal or perceived legal orders?, it is likely you don't do business with one unless it is illicit) then your best bet is to bet anything you share with them can and will be shared with the government and via NDA to other third party companies.
    – Joshua Briefman
    Sep 15, 2013 at 4:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .