3 ms·

What would be the benefit of changing your MAC address?

api 10y ago
MACs are a unique hardware ID and there are various ways they can leak over L3, such as software that uses your MAC to compute its own ID that can be reversed.
- sigjuice 10y ago
  Can you point me at a concrete example of an application or protocol that does this? Thanks!
  - walrus01 10y ago
    I have heard of HTML5/WebRTC API browser fingerprinting that can expose a user's RFC1918 private IP address (10.x.x.x whatever...) on their client device, but not MAC address. https://network23.org/inputisevil/2015/09/06/how-html5-apis-can-fingerprint-users/ https://network23.org/inputisevil/2015/09/06/how-html5-apis-...
  - robocat 10y ago
    Many applications where a GUID is exposed. "In the OSF-specified algorithm for generating new (V1) GUIDs, the user's network card MAC address is used as a base for the last group of GUID digits, which means, for example, that a document can be tracked back to the computer that created it. This privacy hole was used when locating the creator of the Melissa virus." from https://en.m.wikipedia.org/wiki/Globally_unique_identifier https://en.m.wikipedia.org/wiki/Globally_unique_identifier
  - gcr 10y ago
    iOS randomizes MAC addresses when not connected to wireless networks. The stated goal is to lower the probability of being tracked by third parties in, e.g., convenience stores. http://www.imore.com/closer-look-ios-8s-mac-randomization http://www.imore.com/closer-look-ios-8s-mac-randomization Apple device uDIDs are generated by concatenating the serial number, the MAC address, and some other things, then running the result through a hash function. (I don't have a source at the moment, sorry).
  - zrm 10y ago
    IPv6 auto-configuration can encode the ethernet hardware address into the IPv6 address. Then anything that advertises that IPv6 address is advertising your hardware address. Even if you don't use IPv6 -- or especially then since that's when auto-config most commonly happens.

api 10y ago

MACs are a unique hardware ID and there are various ways they can leak over L3, such as software that uses your MAC to compute its own ID that can be reversed.

sigjuice 10y ago
Can you point me at a concrete example of an application or protocol that does this? Thanks!
- walrus01 10y ago
  I have heard of HTML5/WebRTC API browser fingerprinting that can expose a user's RFC1918 private IP address (10.x.x.x whatever...) on their client device, but not MAC address. https://network23.org/inputisevil/2015/09/06/how-html5-apis-can-fingerprint-users/ https://network23.org/inputisevil/2015/09/06/how-html5-apis-...
- robocat 10y ago
  Many applications where a GUID is exposed. "In the OSF-specified algorithm for generating new (V1) GUIDs, the user's network card MAC address is used as a base for the last group of GUID digits, which means, for example, that a document can be tracked back to the computer that created it. This privacy hole was used when locating the creator of the Melissa virus." from https://en.m.wikipedia.org/wiki/Globally_unique_identifier https://en.m.wikipedia.org/wiki/Globally_unique_identifier
- gcr 10y ago
  iOS randomizes MAC addresses when not connected to wireless networks. The stated goal is to lower the probability of being tracked by third parties in, e.g., convenience stores. http://www.imore.com/closer-look-ios-8s-mac-randomization http://www.imore.com/closer-look-ios-8s-mac-randomization Apple device uDIDs are generated by concatenating the serial number, the MAC address, and some other things, then running the result through a hash function. (I don't have a source at the moment, sorry).
- zrm 10y ago
  IPv6 auto-configuration can encode the ethernet hardware address into the IPv6 address. Then anything that advertises that IPv6 address is advertising your hardware address. Even if you don't use IPv6 -- or especially then since that's when auto-config most commonly happens.