BT Smarthub3 Router Privacy Issue

flaneurs_lobster

It's not that accurate unless the google vehicle has been around lately scanning the WIFI.

Not just the Google cars, anyone using an Android phone with "Improve Location Accuracy" set, who detects your Wi-Fi, will report it (with its location) to Google's geolocation database. Apple does similar.

Re the phone knowing your name, do you have your 'real' name held on your Google/Samsung accounts? When I hover on the Google button top-right in Chrome it shows my FirstName.

monious

Are there some members here who have a BT Smarthub3 and would be prepared to try some tests?

monious

https://forums.moneysavingexpert.com/discussion/comment/82103192#Comment_82103192

Thanks for your reply Vitor

I am absolutely sure because BT Confirmed it with me, it is NOT my router that is sharing my location VIA my router, it is kit at their exchange.

BT told me that the only solution they can recommend is to use a 3rd party router to replace the BT SmartHub3 and it will not pick up that data and my location will not be shared.

The call was escalated and 4 BT Techs came into a group call, I can't pretend to understand all the tech stuff they said but they seemed to be suggested someone someone had screwed up when installing kit at the Exchange.

There was nothing confused about it, you were not there and have no basis to make such an assertion except it seems to try to discredit me or make yourself look clever.

It is not me forming assumptions, I used 3 different network connections for the same phone, laptop and iPad, this was done with BT on the phone. We were at this for over an hour, I was following their instructions.

Anyone can find out where Google things they are by typing in a local search keyword such as restaurants and even before Google displays results it will show locations, if it does not know the location it defaults to Greater London and will show other big towns like Manchester

If you do not choose a location but just Restaurants Near Me it will show results in Central London

If it does know the location it will list the town where the yellow arrow is in the pic above and it will list the postcode if it knows it and in my case it displays the postcode of the BT Exchange.

I had hope that there was someone competent in Network Security on these forums, perhaps that was a big ask as none have chipped in yet as far as I know.

flaneurs_lobster

https://forums.moneysavingexpert.com/discussion/comment/82104500#Comment_82104500

I have the EE Smart Hub 7 Plus which I'm told has the same internals as the BT Smart Hub 3.

Was misinformed, bit more research says they are different kit - eg EE has Wi-Fi 7 vs 6 on BT.

Not supplied by EE (or BT) so no idea if your assertion about an exchange problem is relevant.

What are you trying to demonstrate by such tests?

monious

https://forums.moneysavingexpert.com/discussion/comment/82103541#Comment_82103541

That is exactly how it SHOULD be working, i.e. that the IP location given does not identify you because they do not have your explicit consent to share your location.

BT have given me a solution, am I am going to hold them responsible for paying for a new 3rd party router that has the same advanced functionality OR they can go edit the database where they have inadvertently listed the address of the IP as being my town.

I am trying to determine how widespread this is, I have no idea whether Plusnet have their own kit after all these years being owned by BT, I imagine that they use the same kit.

I have been on BT at relatives house and got them to record their location and like yours it revolves and turning off the router for 15m often gets a new IP at a different location.

I can't speak to how your data was reconciled to your real name, I know the tools I use that show they do not know or pretend they do not know. I spoofed my Ring Doorbell to hundreds of miles away, but I would not be surprised if Amazon's mesh network could figure out where it was by the other devices in it's mesh network. Most of those cookie messages completely ignore your stated preferences, some allow you to drill down and show you that they are ignoring you, others give you an option to object to their alleged "legitimate interest" to ignore your stated preferences. Of course if they ignore your preferences why would one believe they would suddenly respect your objection to legit interest.

I am not naive, I know the data agencies (partners) listed in these cookie messages have their data reconciled and so there is very little real privacy, but my concern is that they are openly sharing my location which means they do not consider it secure data and any old app can store it and assign it to your device.

monious

https://forums.moneysavingexpert.com/discussion/comment/82103198#Comment_82103198

BT have confirmed it IS the router which is getting the data from kit at the exchange, from what I have been able to establish from their chat on a group call was that they think that someone mistakenly put in more data in kit at the exchange or in a database like RIPE where IP's some IP's are registered.

I am trying to ascertain how widespread this "mistake" is.

The tests done were from virgin sessions with no websites visited except Google.

monious

https://forums.moneysavingexpert.com/discussion/comment/82103626#Comment_82103626

I think you have take a bit of a leap there, because improving location accuracy might see the SSID but unless that person was allowed to connect to that SSID they would not have been given the IP address. BT have confirmed that it is from the BT Exchange and they seemed to know the device they think is culpable and it's registration, another said data that granular should not be in the database as it would be a security risk.

You are right that my security is only as good as the settings on the mobile phone of any guest, which is why I do not share my wifi.

Also this is a brand new install and Google only update around every 90 days. My kit is new but the IP address pool is not, it is stored online for anyone who is prepared to drill down a WHOIS search. However, none of those that I have seen provide the IP address location, that would be a massive security risk.

booneruk

I am absolutely sure because BT Confirmed it with me, it is NOT my router that is sharing my location VIA my router, it is kit at their exchange.

BT told me that the only solution they can recommend is to use a 3rd party router to replace the BT SmartHub3 and it will not pick up that data and my location will not be shared.

These two assertions contradict. It's either the router (it isn't! it really isn't) or it is the router?! I suspect you had a cluster of confused people on this call

monious

https://forums.moneysavingexpert.com/discussion/comment/82104527#Comment_82104527

What you don't say is whether on a virgin session with all cookies nuked what IP location does Google say you are in if you do a "local search" as described in posts above.

First of all I am trying to determine how widespread the issue is, it could be only at my exchange, or it could be part of a new standard configuration that BT Openreach is rolling out.

The ICO asked me to try and find out so they can determine whether they will only pursue BT for my particular case because they think it is wrong to share or whether they go on to investigate BT for a bigger breach.

Secondly I am trying to mitigate BT's loss and find an appropriate router that does not share my location.

I am not seeking the latest and greatest but one that has the specs BT say their device has.

flaneurs_lobster

I think you have take a bit of a leap there, because improving location accuracy might see the SSID but unless that person was allowed to connect to that SSID they would not have been given the IP address. 

Didn't say that the IP address was supplied, what they collect is the SSID and the BSSID (basically the MAC address) of the router. The BSSID is still broadcast even if you turn off the SSID, otherwise Wi-Fi connections wouldn't work.