5 ms·

From http://www.blipsystems.com/indoor-sensor/ http://www.blipsystems.com/indoor-sensor/: > When a device passes the sensors, its non-personal unique ID, calle

From http://www.blipsystems.com/indoor-sensor/ http://www.blipsystems.com/indoor-sensor/: > When a device passes the sensors, its non-personal unique ID, called a MAC address, is recorded, encrypted and time-stamped. By re-identifying the device from multiple sensors, travel times, average speeds, dwell times and movement patterns become available. Aren't MAC addresses spoofed on most phones now?! I didn't expect a system like that to still be usable.

pyre 11y ago
It just needs the MAC to stay consistent for the duration of your travel through the airport.
digi_owl 11y ago
Even if spoofed, a MAC has to be (locally) unique or else you run into all kinds of network issues. As for spoofed on phones, maybe if you have root. But i doubt it comes spoofed out of the box (at least i have never heard of such a thing).
- deleted 11y ago
  [deleted]
- macNchz 11y ago
  As of last year iOS devices do randomize their MAC address when polling for nearby WiFi, specifically to foil this kind of tracking. Here's an interesting breakdown of what is actually happening: http://blog.airtightnetworks.com/ios8-mac-randomization-analyzed/ http://blog.airtightnetworks.com/ios8-mac-randomization-anal...
  - digi_owl 11y ago
    Huh, i guess they got a fire lit under their ass. After having their products found shouting to anyone nearby what previous networks the product had been in contact with, that is.
  - mikeash 11y ago
    Nice link! From what it describes, I don't think this will be too much of a problem for a tracking system like this. The randomized MAC is only changed when the phone is put to sleep for at least 120 seconds. It stays constant while sleeping, or while active. So if you're on your phone from start to finish (as a lot of people do) or if you leave it in your pocket from start to finish, you'll be tracked fine. Only if you use your phone, put it to sleep, and leave it asleep for at least two minutes all while in the line will you defeat this. And while that's certainly something people will do, plenty of people won't, so the tracking can use those. This all sounds pretty good to me. Short-term tracking like this is useful and not very invasive. The randomization will still defeat long-term invasive tracking, like a store recognizing you from past visits and building up a database of your individual activity from that.
eli 11y ago
Nope, definitely not "most" phones. iOS 8 randomizes MAC addresses, but probably not often enough to stop this from working: http://blog.airtightnetworks.com/ios8-mac-randomgate/ http://blog.airtightnetworks.com/ios8-mac-randomgate/ And of course you would only need a sample of passengers with static MACs for this to work.
codeaken 11y ago
> "non-personal unique ID" Isn't that quite contradictionary?
- fluxquanta 11y ago
  Personal to the device, not personal to its owner. Then again, most of us consider our devices extensions of ourselves nowadays anyway.
- forgottenpass 11y ago
  Isn't that quite contradictionary? Yep. It sure is. Know how spammers that don't run afoul of the CAN-SPAM act get really salty when you call their spam spam? The is the same sort of wordsmithing. By arguing that this identifiable information doesn't fall into the the "personal" bucket, they want the public to think what they're doing is A-OK. They use weasel language to suggest following a standard of what "personal" data is means everything on the "not-personal" side is perfectly normal operation the consumer doesn't have to worry about. All while trying to derive as much personal information as possible from the not-technically-personal data.

pyre 11y ago

It just needs the MAC to stay consistent for the duration of your travel through the airport.

digi_owl 11y ago

Even if spoofed, a MAC has to be (locally) unique or else you run into all kinds of network issues. As for spoofed on phones, maybe if you have root. But i doubt it comes spoofed out of the box (at least i have never heard of such a thing).

deleted 11y ago
[deleted]
macNchz 11y ago
As of last year iOS devices do randomize their MAC address when polling for nearby WiFi, specifically to foil this kind of tracking. Here's an interesting breakdown of what is actually happening: http://blog.airtightnetworks.com/ios8-mac-randomization-analyzed/ http://blog.airtightnetworks.com/ios8-mac-randomization-anal...
- digi_owl 11y ago
  Huh, i guess they got a fire lit under their ass. After having their products found shouting to anyone nearby what previous networks the product had been in contact with, that is.
- mikeash 11y ago
  Nice link! From what it describes, I don't think this will be too much of a problem for a tracking system like this. The randomized MAC is only changed when the phone is put to sleep for at least 120 seconds. It stays constant while sleeping, or while active. So if you're on your phone from start to finish (as a lot of people do) or if you leave it in your pocket from start to finish, you'll be tracked fine. Only if you use your phone, put it to sleep, and leave it asleep for at least two minutes all while in the line will you defeat this. And while that's certainly something people will do, plenty of people won't, so the tracking can use those. This all sounds pretty good to me. Short-term tracking like this is useful and not very invasive. The randomization will still defeat long-term invasive tracking, like a store recognizing you from past visits and building up a database of your individual activity from that.

eli 11y ago

Nope, definitely not "most" phones. iOS 8 randomizes MAC addresses, but probably not often enough to stop this from working: http://blog.airtightnetworks.com/ios8-mac-randomgate/ http://blog.airtightnetworks.com/ios8-mac-randomgate/ And of course you would only need a sample of passengers with static MACs for this to work.

codeaken 11y ago

> "non-personal unique ID" Isn't that quite contradictionary?

fluxquanta 11y ago
Personal to the device, not personal to its owner. Then again, most of us consider our devices extensions of ourselves nowadays anyway.
forgottenpass 11y ago
Isn't that quite contradictionary? Yep. It sure is. Know how spammers that don't run afoul of the CAN-SPAM act get really salty when you call their spam spam? The is the same sort of wordsmithing. By arguing that this identifiable information doesn't fall into the the "personal" bucket, they want the public to think what they're doing is A-OK. They use weasel language to suggest following a standard of what "personal" data is means everything on the "not-personal" side is perfectly normal operation the consumer doesn't have to worry about. All while trying to derive as much personal information as possible from the not-technically-personal data.