6 ms·

How do they get mac address from HTTP requests?

by arthurcolle 4y ago

WookieRushing 4y ago
They can get it from your android phone or from chrome if you’re running it
- deleted 4y ago
  [deleted]
pxeboot 4y ago
They don't. But Chrome, Google Play Services and other popular apps likely share this data frequently.
gerdesj 4y ago
In a http request/response, mac address would be meta data. ARP is not a thing there. That would be an example of data snaffling.
- utsuro 4y ago
  Do you have any info on this? AFAIK, MAC is only distributed in datalink layer around local connections. I tried some quick packet sniffing browsing Google and did not see my MAC transmitted—as I’d expect (bc like you said, ARP not thing at this layer) also research on “MAC included in http metadata” turns up no results… If you have any more info on this I’d love to learn more—as I’m puzzled to know why this would happen?
  - md_ 4y ago
    I think the poster isn’t talking about the remote server seeing client MACs (because, as you say) but, rather, about the way mobile OSes use nearby wifi access point SSIDs to provide GPS-less geolocation. Samy Kamkar raised my awareness of this way back in 2010 or so, and this article about his DefCon talk provides a good quick explanation: https://www.bbc.com/news/technology-10850875 https://www.bbc.com/news/technology-10850875.
    - freitasm 4y ago
      Correct.
firecall 4y ago
They can get it if you log into your Android TV! I believe they also track and log other Wifi networks that you arnt even connected to. I'm sure they gather all sort of other metrics from any sensors and signals they can access.
freitasm 4y ago
Not from HTTP requests. Android has access to the network stack and location. Google grabs all visible APs around and correlate to your location. It is way before HTTP even happens. This data is collected while you are driving around, walking down the street, etc.
- brador 4y ago
  How can you block this?
  - mmebane 4y ago
    On Android, find Location Services in your system settings and look for Google Location Accuracy. The description for it on my Galaxy S21 reads: > Google's location service improves location accuracy > by using Wi-Fi, mobile networks, and sensors to help > estimate your location. Google may collect location > data periodically and use this data in an anonymous > way to improve location accuracy and location-based > services. > > Turning this off will result in your device only using GPS > for location. This may impact the accuracy of location > used by apps such as Maps and Find My Device. Based on that description, that should turn off the data collection, although it can also make GPS fixes take longer, and there may well be other apps collecting this data as well.
  - notpushkin 4y ago
    Disable “coarse location” option in settings. Might not work though. If you want coarse location to work but don't want Google to know it, try microG with a non-Google location provider (I use Apple and Mozilla and it's pretty good).
  - ThePowerOfFuet 4y ago
    www.GrapheneOS.org
  - infinitedata 4y ago
    Usa an iPhone?
deleted 4y ago
[deleted]
runjake 4y ago
It’s not the MAC address, it’s the BSSID of the wireless network you are connected to, and those around you. Software typically obtains BSSIDs from your mobile OS’s wi-fi frameworks. The BSSID looks like a MAC address, and in many but not all cases, a given AP’s wireless network BSSID is within a byte or two of its actual wi-if radio MAC. Google and Apple maintain their own massive geolocation databases of BSSIDs, signal strength, and latitude/longitude.

How do they get mac address from HTTP requests?

WookieRushing 4y ago

They can get it from your android phone or from chrome if you’re running it

deleted 4y ago
[deleted]

pxeboot 4y ago

They don't. But Chrome, Google Play Services and other popular apps likely share this data frequently.

gerdesj 4y ago

In a http request/response, mac address would be meta data. ARP is not a thing there. That would be an example of data snaffling.

utsuro 4y ago
Do you have any info on this? AFAIK, MAC is only distributed in datalink layer around local connections. I tried some quick packet sniffing browsing Google and did not see my MAC transmitted—as I’d expect (bc like you said, ARP not thing at this layer) also research on “MAC included in http metadata” turns up no results… If you have any more info on this I’d love to learn more—as I’m puzzled to know why this would happen?
- md_ 4y ago
  I think the poster isn’t talking about the remote server seeing client MACs (because, as you say) but, rather, about the way mobile OSes use nearby wifi access point SSIDs to provide GPS-less geolocation. Samy Kamkar raised my awareness of this way back in 2010 or so, and this article about his DefCon talk provides a good quick explanation: https://www.bbc.com/news/technology-10850875 https://www.bbc.com/news/technology-10850875.
  - freitasm 4y ago
    Correct.

firecall 4y ago

They can get it if you log into your Android TV! I believe they also track and log other Wifi networks that you arnt even connected to. I'm sure they gather all sort of other metrics from any sensors and signals they can access.

freitasm 4y ago

Not from HTTP requests. Android has access to the network stack and location. Google grabs all visible APs around and correlate to your location. It is way before HTTP even happens. This data is collected while you are driving around, walking down the street, etc.

brador 4y ago
How can you block this?
- mmebane 4y ago
  On Android, find Location Services in your system settings and look for Google Location Accuracy. The description for it on my Galaxy S21 reads: > Google's location service improves location accuracy > by using Wi-Fi, mobile networks, and sensors to help > estimate your location. Google may collect location > data periodically and use this data in an anonymous > way to improve location accuracy and location-based > services. > > Turning this off will result in your device only using GPS > for location. This may impact the accuracy of location > used by apps such as Maps and Find My Device. Based on that description, that should turn off the data collection, although it can also make GPS fixes take longer, and there may well be other apps collecting this data as well.
- notpushkin 4y ago
  Disable “coarse location” option in settings. Might not work though. If you want coarse location to work but don't want Google to know it, try microG with a non-Google location provider (I use Apple and Mozilla and it's pretty good).
- ThePowerOfFuet 4y ago
  www.GrapheneOS.org
- infinitedata 4y ago
  Usa an iPhone?

deleted 4y ago

[deleted]

runjake 4y ago

It’s not the MAC address, it’s the BSSID of the wireless network you are connected to, and those around you. Software typically obtains BSSIDs from your mobile OS’s wi-fi frameworks. The BSSID looks like a MAC address, and in many but not all cases, a given AP’s wireless network BSSID is within a byte or two of its actual wi-if radio MAC. Google and Apple maintain their own massive geolocation databases of BSSIDs, signal strength, and latitude/longitude.