From the article: "The good news for the paranoid is that TfL appears to have gone out of its way to make sure everything is above board. In the documents that

From the article: "The good news for the paranoid is that TfL appears to have gone out of its way to make sure everything is above board. In the documents that Giz UK has seen, it makes clear that it is only MAC data that’s collected (ie: they’re not monitoring the websites you visit) - and that this data is stored as encrypted hashes - so even if hackers could somehow break in and obtain the collected data, they wouldn’t be able to get any MAC address data." "Encrypted hashes" isn't totally specific given the vague language used when talking to general audiences, but assuming it means a cryptographic hash, then that doesn't really give much (any) privacy. There are only so many possible MAC addresses, and it's pretty easy to try them all in minutes. I was going to do the math, but Threatpost already has an article about this.[1] There's also a stub Wikipedia article.[2] Unique salts don't work if you still want to be able to compare MAC addresses, which is sort of the point. You can have a single salt for all hashes, or alternatively encrypt with a single key, but then it's just a matter of that single salt or key being leaked. +1 for randomized MAC addresses. [1] https://threatpost.com/research-finds-mac-address-hashing-not-a-fix-for-privacy-problems/104893/ https://threatpost.com/research-finds-mac-address-hashing-no... [2] https://en.wikipedia.org/wiki/MAC_Address_Anonymization https://en.wikipedia.org/wiki/MAC_Address_Anonymization