Your Weather Is a Unique Fingerprint

Most people I know have in their phone a whole bunch of locations for weather data, often even 10 or more …

So lets say your first location is your hometown 200k inhabitions, next you have a bigger city you once traveled to, lets say new york. Who even has both cities in their weather app, the residents of your hometown and of new york, as well as a bunch of people who did a trip to either of these. Your hometown probably didnt get soo many visitors who added it, so lets be generous and say 1mio people have it, New York is sth else. Ig maybe 100mio have it. But the pools dont overlap really much, so basically 100mio are 1.25% of the world population. And your hometown pool doesnt have any higher odds to be in the same pool as the new york people.

So this reduces your pool to 100k * 0.0125, so 1250 people … Thats pretty bad.

Now who has the same weather provider as you, lets say you’re even a total mainstream person using either Apple or Google’s OS on your phone -> ig both have probably 45% of weather request share on mobile. So lets take 45% of your pool again. ~560 people left …

Now add a third location, lets say a big city in your country, who has it in your pool, probabily not soo little actually. Since your pool already fullfills the condition of being in the same country, so lets assume 30% have -> ~170 ppl.

Now add a forth city, one you did a trip to once, e.g. Osaka, well the overlap this time isn’t as big, bigger than the default group though, as people who once traveled to another continent, have higher odds of having traveled to another one than the average …

But it wont exceed 20% …

So now you’re one out of 34 persons …

Now another smaller city again and you’re probably unique, or 2-3 bigger ones …

Even if you want to assume bigger numbers each time, higher overlap etc. with 10+ locations you’re unique (even less ig realistically)

Basically if you switch your IP or use a VPN, you end up exposing your identity. Like as talked above, only you make that exact connection pattern, so if it reappears one can basically be certain its you. So basically your ISP saw you once connect to all 10 locations without vpn.

So basically your identity is bound to this pattern, now you turn on a vpn, dont login anywhere, browse the web, your weather app fetches its updates in the background. And tada, the unique pattern again, this time caught by the vpn’s exit points isp. They get matched via some automatic traffic analysis (and tbh i think we are in a world where this might very well be done …). Now they can correlate this new vpn request with your real ip, just ask who it is by your isp and have your clear name, associated with whatever request you made earlier …

I personally use the FOSS App Breezy Weather, it has the big advantage, that it fetches only one weather location periodically, and all other locations only on demand. So you can avoid making x periodic requests each time

Also delete the weather locations you dont need anymore …

Ig your apps might also form a unique fingerprint, or at least put you in a pretty small pool … Your RSS Feed is the same.