3 ms·
> Therefore you definitely can't authenticate/authorize by MAC address. I would be entirely unsurprised to see that the device is calling out to the API with i
by paranoidrobot 8y ago
> Therefore you definitely can't authenticate/authorize by MAC address.
I would be entirely unsurprised to see that the device is calling out to the API with it's MAC address as some kind of authenticator.
eg: http://foo.example.com/api/prizes?id=xx:xx:xx:xx:xx http://foo.example.com/api/prizes?id=xx:xx:xx:xx:xx
- stephenhill 8y agoI've used quite a few systems where the MAC address is used as a secondary password to verify that someone didn't just steal the hard drive out of a kiosk.
- chopin 8y agoI thought of this. But the OP stated that the traffic is unprotected making this security measure moot.
- bashinator 8y agoExactly, and then the stored MAC is exposed in its un/or-poorly-authenticated API