How Much Can You Rely On the iPhone’s Google Maps Combination of Skyhook Wi-Fi and Cell Tower Data For Pseudo-GPS?

One of the (few) surprises from this month’s MacWorld was that the Google Maps application integrates location data not just from cell tower triangulation (using Google’s “My Location” technology) but also Wi-Fi visibility information, thanks to Skyhook. This combination of technologies piqued my interest, and it turns out that I was in a unique position to see just how these two data sources are integrated into the iPhone’s Google Maps application.

Although Mac Rumors reports that the Skyhook Wi-Fi data trumps the Google cell tower data, the reality is much more complicated, and thankfully more reliable, too! See, I used to live in Massachusetts (where Skyhook has data) and now live in Ohio (where they don’t). So I was able to test the priority of the location data used in the iPhone in a simple way – I compared different good data/bad data scenarios to determine just how Apple is deciding what your location is.

The short answer is, they’ve done a great job programming this and are falling back gracefully when fed bad data. When you tap the location button on an iPhone, you’ll almost always get at least a reasonable location from it, except where Skyhook has bad data and you’ve got no cell service, which is rare enough to be useful.

But if you are using an iPod Touch or iPhone with no cell service, your location data can be woefully incorrect, and even easily spoofed! Although Google Maps location is (probably) not a life and death piece of data, we can be pretty happy with what we’ve been given. But I can think of a whole lotta pranking that could happen once this tech gets more widespread use!

More details after the jump…

How Skyhook Works

Skyhook relies on MAC addresses of visible access points, and doesn’t care if you’re logged into them or not. So if you’re walking down Main Street, and your device can see any Wi-Fi access points (hotspots, home routers, etc), it can grab the MAC address for location purposes. Over the last few years, Skyhook drove a fleet of cars around many major cities, sniffing for MAC addresses and correlating them to GPS data. It stored this information in a database and can use it to pinpoint locations.

Some have speculated that Skyhook could expand their list of known hotspots by using the very query data sent to them. See one we know and one we don’t? Just add the new one at the old one’s location! It’s not clear whether or not they’re doing this at this point, though. One thing Skyhook does not do is allow ad hoc queries or (until recently) updates to their database. But yesterday, iPhone Central reported that a user was given instructions on how to add their own access point to Skyhook’s database, which kind of scares me (see below)!

One trouble is, MAC addresses aren’t as unique as they’re supposed to be. Although nearly all manufacturers assign a unique MAC address to each device they make, these can easily be changed in software. There are many legitimate reasons to change a MAC – I’ve done it myself when replacing a failed access point, since it saved me from having to worry about reconfigure my clients. Although it’s not a great idea, some corporations that run large networks of hotspots might presumably use the same MAC on multiple devices for simplicity or through negligence when setting up new hardware.

The other problem with using access point MAC addresses for location data is that they’re not nearly as geographically-fixed as one might presume. In my example, I up and moved from one state to another, taking my router with me. The same thing could easily happen with a second-hand unit sold on eBay or given to a friend or family member. Imaging the havoc that Freecycle and Craigslist can cause to the Skyhook database as people move older routers from one address to another! Add in the growing number of roving access points in busses (LimoLiner), rental cars (Avis), and even private use (Airport Express, Delphi/Autonet) and you could be seeing lots of spurious traveling Wi-Fi hotspots!

Pranking Skyhook

Of course, not all false location data will come about by accident. It would be trivially easy to spoof the MAC address of a known Skyhook location in order to prank all those Apple-toting hipsters out there. Take some old Wi-Fi router, program it with the address of a Starbucks shop across town, and watch them scratch their heads looking for that short cappuccino! More nefarious schemes are easy to imagine, but at the end of the day all you’re doing is confusing the tiny subset of people who will use the location data of their iPhone or iTouch within range of your access point.

Plus, in my (limited) testing, it looks as if Skyhook will reject MACs that seem totally out of place if more than two others are in range. So there is some sanity checking going on, and that’s a good thing.

Digging Into Google’s “My Location”

Google announced their “My Location” service back in November, which uses cell tower triangulation to locate clients. In apparently sends some unique identifier of in-range (and in-network) cell towers to a Google server and attempts to determine location based on the (known) location of those towers. Since they don’t have very precise data on the location of every tower, Google admits that their precision can vary from acceptable to just plain bad.

In my experience, urban towers are much more precise than rural ones, both in terms of accuracy and precision. In the rural Ohio county where I live, the towers seem to be centered on townships, so the results are not at all accurate. Plus, rural towers cover a greater area, so their precision is expressed in tens of miles. But in the cities I’ve tried my iPhone in, the tower location is much more accurate, often allowing me to play “spot the tower” based on the Google Maps crosshairs!

How the iPhone Uses Location Data

So how does Apple integrate Google’s cell tower data and Skyhook’s Wi-Fi data? When you press the Location button, the iPhone sends both cell tower and Wi-Fi data (via an encrypted HTTPS session) to a server with an Apple IP address. Something happens there (presumably involving queries to Google and Skyhook servers), and a response is sent to the iPhone, presumably containing a center and radius.

From my experience (see the table below), the iPhone/iTouch Google Maps location server uses the following logic:

1. If the cell location and the Wi-Fi location agree, use the Wi-Fi location
2. If the cell location and the Wi-Fi location disagree, use the cell location
3. If only one is available, use that

This is a nice bit of logic, since the accuracy of cell tower data is more reliable than Wi-Fi, but is far less precise. So someone (smartly) took the unreliability of Skyhook’s data into account when programming all this!

Sadly for iPod Touch users, though, they only have Skyhook data, so they are likely to get frequent head scratchers when pressing the location button! Expect a rash of comedic posts starting with “my iPod Touch thinks I’m in Topeka!”

It looks like Apple is only sending cell data to Google and Wi-Fi data to Skyhook, though, since Skyhook still has my Wi-Fi location totally wrong even after a week of experimenting. So even though this could have been a valuable way for Skyhook to update and expand their database, it doesn’t look like they are.

Test Details

See For Yourself!

Experimenting with YouTube, I decided to up a video of my location magically changing from Ohio to Massachusetts! See for yourself!