1. Privacy and Security in the Location-enhanced World Wide Web UC Berkeley Intel / UW UW Intel UC Berkeley Jason Hong Gaetano Boriello James Landay David McDonald Bill Schilit Doug Tygar

2. Oct 12 20032 PlaceLab Overview Location-enhanced computing major ubicomp focus for over a decade, but few real apps out there – Need low-cost and convenient location finding tech – Need critical mass of useful location-based services – Need techniques to address privacy Goal of PlaceLab – Provide open software base and community building – Catalyze adoption of location-based services

3. Oct 12 20033 Key Ideas in PlaceLab Can use WiFi to determine rough location – Can use overlapping hotspots for better estimation A B C ~few meters ~city block

4. Oct 12 20034 Key Ideas in PlaceLab Can use WiFi to determine rough location Can cache directories of hotspots locally on devices – Continuously updated directories of hotspot locations Access point MAC address -> Location – Local computation, local storage – Only you know where you are

5. Oct 12 20035 Key Ideas in PlaceLab Can use WiFi to determine rough location Can cache directories of hotspots locally on devices Can cache location-enhanced content as well – Occasionally connected computing – Ex. Zagat restaurant guide – Location-enhanced web content – Local computation, local storage

6. Oct 12 20036 Key Ideas in PlaceLab Can use WiFi to determine rough location Can cache directories of hotspots locally on devices Can cache location-enhanced content as well Can choose when to share location data with others

7. Oct 12 20037 Privacy of Stakeholders in PlaceLab End-Users – Network service providers, Web service providers – Anonymizers, mixes, pre-fetching, etc (see workshop paper) Access point owners – Co-opted for new purpose in PlaceLab – Turn off broadcasting of Access Point (opt out) – Encrypt cached directories Make location of AP visible only if person actually nearby

8. Oct 12 20038 Discussion PlaceBar is a kind of privacy widget, other kinds? PlaceLab is decentralized, starts with data at edge of network to drive adoption. Applicable elsewhere? Privacy cuts across HW, OS, networking, UI. What mechanisms and support are needed in these layers? – Ex. How to build plausible deniability into systems? What are actual privacy concerns for location? – Spatial Granularity, ex. City -> zip -> street – Temporal Granularity, ex. At Tahoe “last month” vs “July 1” – Freshness, ex. “You can have my location if over week old”

9. Oct 12 20039 Backup

10. Oct 12 200310 Privacy of Stakeholders in PlaceLab End-Users – Disconnected mode is relatively safe – Connected mode managed via PlaceBar – Spoofing of personal device’s MAC address – WiFi range ~150 meters, some plausible deniability

11. Oct 12 200311 Privacy of Stakeholders in PlaceLab End-Users Access point owners Network Service Providers and End-Users – Can use mixes to aggregate and redirect traffic – Access points tend to dynamically assign IP addresses – Overall, hard for network service provides to identify individuals

12. Oct 12 200312 Privacy of Stakeholders in PlaceLab End-Users Access point owners Network Service Providers and End-Users Web Service Providers and End-Users – Can correlate past IP addresses with locations Use anonymizers Web service provides might not be able to link to identifiable info – P3P extensions? – Pre-fetch chunks of data at a time