[LINK] RFI: Accuracy of Geo-Location Based on IP-Address
adrian at creative.net.au
Wed Nov 28 15:38:36 AEDT 2007
Data mining is fun. Imagine if you will:
* You have an IP address at home thats static or dynamic; it doesn't
creatively to figure out you're you wherever you login;
(You do use your real name when registering for online services, no?)
* This "IP to person" data can be correlated against "Person to Home
address" data, which I believe is public (think Electoral roll);
* This "person to home address" data can be correlated against
"home address to proprty location" data (which again, I believe
is all public data);
On Wed, Nov 28, 2007, Roger Clarke wrote:
> Following recent discussions, I've become concerned about how
> IP-Address Look-Up works, and how accurate and how precise it is.
> Inaccuracy and imprecision lead to misunderstandings, and perhaps
> shortly to erroneous decision-making - with inevitable harm to the
> less powerful (e.g. consumers, citizens, employees).
> Accuracy and precision bring with them very substantial
> privacy-invasiveness and the risk of quite frightening power for the
> State and for corporations.
> I did some experimentation, and have drawn some inferences. Details below.
> I'd greatly appreciate review, corrections, enhancements, and
> pointers to authoritative materials.
> Summary of Results
> My assumption had been that IP-Location services depended on IANA
> tables, the regional NICs - in our case APNIC, and reverse-DNS
> entries. (Details on relevant URLs that I'm aware of are at the
> bottom of this message).
> That set only gets down to IAP level. The recent fracas about
> government departments amending Wikipedia entries showed how there
> was plenty of room for debate about which organisation was actually
> using which IP-addresses.
> I did a test using my own IP-address (details below). Two services
> produced nonsense, but two others are a matter of serious concern.
> They disclosed the Latitude and Longitude of my street-address
> accurately and at a level of precision of 3 decimals of Lat/Long
> (about 100 metres).
> By comparison, street-address lookup appears to use that 3-decimal
> data, but also 5 decimals of Lat/Long (about 1 metre precision).
> One apparent way in which those IP-Location Services could work are:
> (1) get access to the address of the customer's registration.
> A reasonable assumption would be the records held by my ADSL-
> provider (TPG) or by the telephone-line provider (Telstra); and
> (2) use the G-NAF scheme at http://www.psma.com.au/g-naf
> to extract Lat and Long that corresponds to the street-address
> Is that likely to be the mechanism?
> If that's the case, how do I frame a complaint about the divulging of
> the address by TPG or Telstra? (One is an overseas corporation, and
> the other an overseas company registered in Australia).
> Experimentation with my own IP-Address and Street-Address
> My SOHO router says it has the IP-address 220.127.116.11.
> The Reverse-DNS / arpa entry is:
> Service 1 got foxed by the TPG proxy, and doesn't seem to be sure
> where it is anyway: http://ip-lookup.net/
> Service 2 put me adjacent to Queanbeyan hospital (20km out):
> But Service 3 is chilling: http://www.ip2location.com/
> delivering -35.283 LATITUDE, 149.217 LONGITUDE
> And Service 4 is similar: http://www.geobytes.com/IpLocator.htm
> delivering -35.2830 and 149.2170
> I did more detailed testing using Service 3.
> http://www.ip2location.com/ gives:
> >IP Address: 18.104.22.168
> >Location: AUSTRALIA, AUSTRALIAN CAPITAL TERRITORY, CANBERRA
> >Latitude / Longitude: -35.283 LATITUDE, 149.217 LONGITUDE
> >Connecting through: TPG INTERNET PTY LTD
> >Time Zone: UTC +10:00
> >You're using proxy server in
> >Proxy IP Address:22.214.171.124
> >Location: AUSTRALIA, NEW SOUTH WALES, WEST WYALONG
> >Latitude / Longitude: -33.917 LATITUDE, 147.217 LONGITUDE
> >Connecting through: TPG INTERNET PTY LTD
> >Time Zone: UTC +10:00
> >Net Speed: DSL
> [The Time Zone is wrong (should be UT+11)
> [The proxy-server has me mystified, particularly in West Wyalong
> [This service also mistakes the proxy for the visitor, and (probably)
> mistakes the location of the proxy: http://freeipservices.com/
> Using Multimap.com.au on 78 Sidaway St, Chapman ACT 2611 delivers an
> accurate map, and the coordinates:
> So the Multimap lookup on street-address provides the identical
> coords to those delivered by IP-Address Look-up on that service.
> IP2Location.com is a subsidiary of Hexasoft Development Sdn. Bhd.
> ("HDSB"), an Internet R&D company based in Penang, Malaysia.
> The site appears to provide no street-address and no phone-number.
> The ARBN is shown as 091 652 961.
> The Business Entry Point look-up at http://www.abr.business.gov.au/ gives:
> Geobytes Inc. QLD 4503
> ASIC shows it as a registered foreign business since 18/02/2000, at
> Griffin QLD 4503. Griffin is in the Pine Rivers area on the northern
> outskirts of Brisbane (adjacent to Redcliffe).
> At first, I was mystified by the following:
> At my latitude, 1 degree = 111,000 metres; so 1/1000th of a degree
> is still 111 metres: http://www.mysundial.ca/tsp/lat_long.html.
> So how does the Lat and Long measure pin down a point on my property
> boundary, and distinguish my block from the other 20 or so within a
> 111m radius?
> I then saw that the Multimap data carries two sets of data. The
> additional set is loc=AU:-35.35577:149.03423:17
> That's Lat and Long in a form 100 times more precise, i.e. to c. 1
> metre. But the two differ:
> - -35.35577 : 149.03423:17
> - -35.283 : 149.217
> Interestingly, MapQuest using the 3-decimal coords first gave me a
> location on a rural property just north of Canberra Airport:
> Then on repeating the request it gave me identical results to the
> rather different location indicated by the more precise coordinates:
> [Do these services get flushed through the NSA en route, in order to
> deliver US Administration-approved false results??
> Maybe not:
> Using this value-added service over Google
> and keying the street-address, I get the coords:
> And using the 3-decimal coords, I get the property north of the airport.
> The difference between the two is 7km N-S and 18km E-W, and that
> cross-checks with my local knowledge of about 24km driving-distance.
> So the more precise measure also appears to be the accurate one.
> My original assumption had been that IP-Location services depended on:
> 1. IANA tables
> 2. the regional NICs - in our case APNIC:
> 3. reverse-DNS entries:
> See especially:
> Roger Clarke http://www.anu.edu.au/people/Roger.Clarke/
> Xamax Consultancy Pty Ltd 78 Sidaway St, Chapman ACT 2611 AUSTRALIA
> Tel: +61 2 6288 1472, and 6288 6916
> mailto:Roger.Clarke at xamax.com.au http://www.xamax.com.au/
> Visiting Professor in Info Science & Eng Australian National University
> Visiting Professor in the eCommerce Program University of Hong Kong
> Visiting Professor in the Cyberspace Law & Policy Centre Uni of NSW
> Link mailing list
> Link at mailman.anu.edu.au
- Xenion - http://www.xenion.com.au/ - VPS Hosting - Commercial Squid Support -
- $25/pm entry-level VPSes w/ capped bandwidth charges available in WA -
More information about the Link