3 ms·
I still don't understand it, TCP/IP doesn't transmit MAC addresses. Your knowledge of it ends at the next router... Therefore you definitely can't authenticate/
by chopin 8y ago
I still don't understand it, TCP/IP doesn't transmit MAC addresses. Your knowledge of it ends at the next router... Therefore you definitely can't authenticate/authorize by MAC address.
- paranoidrobot 8y ago> Therefore you definitely can't authenticate/authorize by MAC address. I would be entirely unsurprised to see that the device is calling out to the API with it's MAC address as some kind of authenticator. eg: http://foo.example.com/api/prizes?id=xx:xx:xx:xx:xx http://foo.example.com/api/prizes?id=xx:xx:xx:xx:xx
- stephenhill 8y agoI've used quite a few systems where the MAC address is used as a secondary password to verify that someone didn't just steal the hard drive out of a kiosk.
- chopin 8y agoI thought of this. But the OP stated that the traffic is unprotected making this security measure moot.
- bashinator 8y agoExactly, and then the stored MAC is exposed in its un/or-poorly-authenticated API