cross-posted from: https://infosec.pub/post/50218987

Karcher DAB radios are broadcasting an SSID for open Wi-Fi access. It doubles as an Internet radio, but AFAICT from the manual it’s only expected to act as a client.

So WTF is going on?

It seems like a really bad idea for consumers to connect this radio to their LANs to use to play Internet radio and podcasts when there is an always available Wi-Fi AP that enables anyone in proxity to connect to the radio. What’s the point? There is no way to disable the SSID broadcasting and it remains on even when the radio is “off” (but plugged in).

The manual shows that there is a remote control. Is the remote using wi-fi? I don’t have the remote so I have no way of verifying. In any case, this design seems like a recipe for disaster. Karcher should perhaps just stick to making pressure washers.

Google and Apple use Wi-Fi SSIDs for navigation. I boycott both companies. As such, I prefer not to have any wi-fi APs. And when I decide to run an AP, I ensure the SSID ends in _optout_nomap to opt-out of giving uncompensated help to the nav systems of Apple and Google.

Does this violate the GDPR? I cannot change the SSID, so it’s like I am being forced to share with the general public the fact that there is a Karcher radio in my home. That does not respect data minimisation.

  • one_old_coder@piefed.socialEnglish
    11·
    18 天前

    Only 4 of them have a reognisable name attached

    Actually according to the GDPR, it would be useful IF the serial number and SSID of the device was attached to the name of the person who bought the device. And I severely doubt OP gave his name to the Karcher company along the serial number of that speaker after he bought it.

    I like GDPR because it gives more power to the customers, but I don’t think his case is valid.

    • daveyOsborn@infosec.pubOP
      11·
      17 天前

      And I severely doubt OP gave his name to the Karcher company along the serial number of that speaker after he bought it.

      It’s profoundly naive to assume that product registration is the only way to collect data. Data brokers and surveillance advertisers are smarter than that.

      I like GDPR because it gives more power to the customers, but I don’t think his case is valid.

      You could benefit from reading Art.5-1©. Data minimisation is obligatory.

      • one_old_coder@piefed.socialEnglish
        1·
        17 天前

        You could benefit from reading Art.5-1©.

        Once again “personal data.” You haven’t told us how Karcher knows that the device belongs to you. Everything else is irrelevant.

        Local storage is subject to GDPR if: The organization maintains control … The data is personal

        Did you log on the device using an email or any personal data? You have to consult a lawyer for that because I doubt you fall in that case.

        A MAC address is unique

        Absolutely not, and it can be changed.

        And again, are you European?

        • daveyOsborn@infosec.pubOP
          11·
          17 天前

          Once again “personal data.” You haven’t told us how Karcher knows that the device belongs to you. Everything else is irrelevant.

          Nonsense. Karcher doesn’t need to know /who/ the personal data belongs to in order to be accountable for designs that violate Art.25.

          Local storage is subject to GDPR if: The organization maintains control … The data is personal

          Did you log on the device using an email or any personal data? You have to consult a lawyer for that because I doubt you fall in that case.

          wtf, stop making up quotes.

          A MAC address is unique

          Absolutely not, and it can be changed.

          Citation needed. Karcher does not even allow users basic access to change the SSID. Please point to the page in the Karcher user guide showing how to change the MAC address on their appliance.