3 ms·

No need to provide Internet, as most phones broadcast their WiFi MAC addresses to the world, even with the WiFi UI shown as "off".

by Sephr 9y ago

yunyu 9y ago
Recent Android and iOS versions randomize the MAC when scanning.
- matte_black 9y ago
  Not even “recent”, I believe this happened a long time ago
- ddeck 9y ago
  True, but in Android's case, the implementation seems to be flawed: In our lab environment we observed that in addition to periodic global MAC addressed probe requests, we were able to force the transmission of additional such probes for all Android devices. First, anytime the user simply turned on the screen, a set of global probe requests were transmitted. An active user, in effect, renders randomization moot, eliminating the privacy countermeasure all together. https://arstechnica.com/information-technology/2017/03/shielding-mac-addresses-from-stalkers-is-hard-android-is-failing-miserably/ https://arstechnica.com/information-technology/2017/03/shiel...
  - userbinator 9y ago
    The only model researchers found to do randomization correctly was the Cat S60 Amusingly enough, that's probably more because of an oversight by the manufacturer (who is probably just copying a reference design) --- they don't bother writing a "fixed MAC" and just leave the NVRAM blank, meaning the device doesn't actually have a MAC and generates a random one every time you turn WiFi on and off. That's how it works on the Mediatek platforms that I'm more familiar with, and you'll find this is the case for a lot of the cheap Chinese unbranded phones. It's irritating when you need to connect to networks using MAC filtering, but I'm almost tempted to respond to all the "my MAC keeps changing" threads on XDA with "that's a feature, not a bug." ;-)
hasdh 9y ago
>even with the WiFi UI shown as "off". By "off", do you mean when the iPhone WiFi setting is set to off (not green)? How does that work?
- tritium 9y ago
  Not green is disconnected from any access point. The radio is still active, and listens for SSID broadcast, and advertises a MAC address, for possible connection handshakes from access points that are listening and active, but do not advertise presence and require users to request by name. Not green AND CROSSED OUT means the radio is actually turned off, and is supposedly neither listening nor broadcasting, if state of the settings applet is somehow more trustworthy than the state of the control center’s slide-out drawer widget. Note that other non-apple handsets might just be doing whatever, unpredictably.

No need to provide Internet, as most phones broadcast their WiFi MAC addresses to the world, even with the WiFi UI shown as "off".

by Sephr 9y ago

No need to provide Internet, as most phones broadcast their WiFi MAC addresses to the world, even with the WiFi UI shown as "off".

yunyu 9y ago

Recent Android and iOS versions randomize the MAC when scanning.

matte_black 9y ago
Not even “recent”, I believe this happened a long time ago
ddeck 9y ago
True, but in Android's case, the implementation seems to be flawed: In our lab environment we observed that in addition to periodic global MAC addressed probe requests, we were able to force the transmission of additional such probes for all Android devices. First, anytime the user simply turned on the screen, a set of global probe requests were transmitted. An active user, in effect, renders randomization moot, eliminating the privacy countermeasure all together. https://arstechnica.com/information-technology/2017/03/shielding-mac-addresses-from-stalkers-is-hard-android-is-failing-miserably/ https://arstechnica.com/information-technology/2017/03/shiel...
- userbinator 9y ago
  The only model researchers found to do randomization correctly was the Cat S60 Amusingly enough, that's probably more because of an oversight by the manufacturer (who is probably just copying a reference design) --- they don't bother writing a "fixed MAC" and just leave the NVRAM blank, meaning the device doesn't actually have a MAC and generates a random one every time you turn WiFi on and off. That's how it works on the Mediatek platforms that I'm more familiar with, and you'll find this is the case for a lot of the cheap Chinese unbranded phones. It's irritating when you need to connect to networks using MAC filtering, but I'm almost tempted to respond to all the "my MAC keeps changing" threads on XDA with "that's a feature, not a bug." ;-)

hasdh 9y ago

>even with the WiFi UI shown as "off". By "off", do you mean when the iPhone WiFi setting is set to off (not green)? How does that work?

tritium 9y ago
Not green is disconnected from any access point. The radio is still active, and listens for SSID broadcast, and advertises a MAC address, for possible connection handshakes from access points that are listening and active, but do not advertise presence and require users to request by name. Not green AND CROSSED OUT means the radio is actually turned off, and is supposedly neither listening nor broadcasting, if state of the settings applet is somehow more trustworthy than the state of the control center’s slide-out drawer widget. Note that other non-apple handsets might just be doing whatever, unpredictably.