Haunts

What the wireless networks your computer remembers say about where you have been.

    [TELLS  ] 2 networks your device asks for out loud, everywhere
               C**a M******z
               O*****a P****a 3

             These are saved as hidden. A hidden network does not announce
             itself, so your device cannot find it by listening: it has to
             ask for it by name, and it asks in every room it walks into.

    [TELLS  ] 7 networks that name a place you were standing in
               A********o B*N F**e              an airport
               B********a C*****l               a library
               C*****g L*s P***s                a campsite
               H***l I**s B*******a             a hotel
               R***e W**i                       the Spanish railway

    [NARROWS] 3 names unusual enough to be one router in particular
               M***********A
               E* R****n d*l V**o 5*

Your laptop keeps every network it has ever joined. Home, work, the hotel from that trip, the airport, the cafe downstairs, your mother's house.

That is not a list of networks. It is a list of places, in plain text, and some of it your device announces out loud wherever it goes.

The two things nobody tells you

Hiding your home network makes it worse. A hidden network does not announce itself, so a device looking for one cannot wait and listen. It has to ask, by name, in every room it enters. Hiding a network moves the broadcasting from the router, which stays in your house, to every device you carry out of it. Haunts finds the ones saved that way and says so first.

A name that means nothing to you means everything to a database. Wardriving databases hold billions of network names with the coordinates they were seen at. MOVISTAR_4F2A tells a person nothing; it matches exactly one router on earth, and looking it up takes a search box and no permission at all.

What it reads

Windows	the wireless API, so the profile detail comes back the same in every language
Linux	NetworkManager, iwd and wpa_supplicant, all three, merged
macOS	the system's own networksetup

For each saved network it works out whether the name is a place, a person's home, a phone, a router's factory default, or one of the handful of names that are the same worldwide. Then it says whether the network is hidden, whether it has no encryption, and whether your machine rejoins it without asking.

Every reading comes with the reason behind it, because some of them will be wrong on somebody's machine and a verdict with no reasoning is one nobody can argue with.

A gap is not a pass

The machine this was written on has no wireless card at all. That turned out to be useful, because it forced the question early: what should a tool like this say when there is nothing to read?

Not "0 saved networks". A desktop on a cable is told it has no wireless card. A laptop whose wireless service is switched off is told the list is unread, not empty. On Linux, NetworkManager locks its files because they hold passwords, so without sudo the networks are read by file name alone; Haunts reports the names it got and says plainly that whether they are hidden or open is not known.

Exit code is 1 when the list places you, 3 when part of it could not be read, 0 when there is nothing to say.

What it never does

• It never asks for your wireless password. On Windows that is a flag on a single call, and it is not passed. A test names the flag so that turning it on cannot happen quietly.
• It never writes anything. A test reads the source and fails the build if a call that writes a file appears in it.
• It never opens a socket. No lookups, no uploads, no checking your network names against anything. The point that the databases exist is made in words rather than by sending them your list.
• It masks what it finds by default. A report you paste into a chat should not be the list of places you go. --reveal when you mean it.

Running it

haunts

haunts --reveal

Windows marks anything that came from the internet, so the first run may bring up a blue "Windows protected your PC" box. Right click the zip, Properties, tick Unblock at the bottom, and then extract it. Building it yourself avoids the question entirely.

Building

Needs Go and nothing else. No dependencies at all.

go build -o haunts .

go test ./...

The file formats live apart from the code that goes and finds the files, so every format is tested on every system against samples of what the real thing looks like. The Linux reader is tested against a filesystem built for the purpose, including the case where the files are locked and only their names can be read.

What you can do about it

Delete the ones you will not use again. Every system lets you forget a network, and a network you have forgotten is one you no longer announce.

Do not hide your home network. It does not help and it makes every device you own carry the name around.

Turn on address randomisation if your machine is not already using it.

There is a VPN that ships a button to wipe the whole list at once. That works, and it also throws away your home and your office along with the hotel. Knowing what each one costs you is the part this does instead.

Licence

MIT. Do what you like with it.