4 ms·

Large retailers were doing this a decade ago. Doesn't MAC randomization used by both Apple and Android devices make this redundant?

by Narkov 3y ago

cma 3y ago
Don't some people turn off randomization so that their router can assign a fixed internal IP address?
- teaearlgraycold 3y ago
  If by some people you mean a small proportion of a small community like Hacker News then yes.
- rootusrootus 3y ago
  Yes, but that setting is per network (at least on iOS). I only turn it off for my home network.
  - gruez 3y ago
    Same on android. It defaults to per-network and the only way to change it is per network.
Simulacra 3y ago
Longer! Since the early 2000s.
justinclift 3y ago
Were they only using the data externally, or were they also selling/sharing it with third parties?
linkjuice4all 3y ago
I'm no legal expert but it seems like this data might be subject to FOIA requests - or at least should be anyway. If it is truly anonymized (yeah, right) then it could be released publicly. I'm not really sure what the general public would actually do with this data - but they paid for it so they should have access. Even better would be to not collect it at all. Is there some way to increase the cost of collecting/storing data like this so that more municipalities/organizations will just consider stuff like this "not worth it"? Even in cases where courts have found that the government (or their agents e.g. a police officer) didn't have the authority to surveil the public without a warrant they were able to purchase private data and construct a parallel chain of evidence that didn't involve the warrant-less surveillance.
- internetter 3y ago
  I've already submitted a FOIA – request 2024-0103[0]. I requested all raw data made available to the town since this feature was made available in 2021. If this is successful, I will submit one to neighbouring towns as well, and will release it on my blog (here[1]). Edit: I have mixed feelings on this initiative as a whole. "Bike Counters" are frequently used by cyclists, for instance, to argue areas need better infrastructure. The question is how can it be done in a non-invasive way, and this data should absolutely be public if it's being collected [0]: https://townforms.com/FOIADirect-BrooklineMACitizens/Public/Request/PublicRequestDetails.aspx https://townforms.com/FOIADirect-BrooklineMACitizens/Public/... [1]: https://boehs.org/node/soofa-foia https://boehs.org/node/soofa-foia
- deleted 3y ago
  [deleted]
- lxgr 3y ago
  Who would you FOIA? iOS and Android randomly and locally select a 47 bit number and change it every now and then. I don't think it's ever sent off-device.
  - linkjuice4all 3y ago
    The town of Brookline itself. They contracted with Soofa and would likely have responsive records in the form of contracts at the very least. It's not obvious who owns some/all of the data so you might not get the actual MAC addresses - or as others have mentioned you'd get a lot of "random" hits so it would be more difficult to track returning individuals. Regardless - these are elected officials and their departs using public money for what some might consider surveillance. What's the issue with a little sunshine on how this all works?
    - lxgr 3y ago
      Ah, got it, I was thinking you were referring to the mobile OSes and the details of their MAC randomization implementations.
gumby 3y ago
My understanding is that apple's MAC randomization tries to give each SSID a different MAC but records the mapping so that the next time you connecct to a known SSID you get the same MAC. I can see why they would choose to do this -- it provides some privacy while not confusing most users (who might have to reauthenticate, or might no longer be in an allow list). I'd prefer to get a new one each time I connected to an SSID but I'm sure I'm in the minority.* I wouldn't be surprised if every one of these devices had the same SSID. Why not? * 99.999% of the population wouldn't know a MAC if it bit them on the nose, and I'm sure prefer it that way. Not an unreasonable position to take, TBH.
- gruez 3y ago
  > My understanding is that apple's MAC randomization tries to give each SSID a different MAC but records the mapping so that the next time you connecct to a known SSID you get the same MAC. And that's if you actually joined the network (who joins a billboard's wifi network these days? Celluar data is plentiful even for cheap plans). If not, the only MAC that's sent is a random phone that's reset every scan/15 minutes (forgot which one it was).
  - jbverschoor 3y ago
    It keeps the max address when connected. Overall the whole this doesn’t work anymore since any 10 years. It’s false information to a certain degree.. It will work for people just passing by. What does work is sending out btle beacon signals, putting a sdr 5G cell. The whole market for this kind of tracking is filled with fake data..
    - gruez 3y ago
      >putting a sdr 5G cell. That sounds super illegal because the spectrum 5G operates on requires a license to use. You can partner with cell carriers to use their licenses, but why would they partner with you? They'll be quite happy to use their existing infrastructure and hoard the data for themselves.

Large retailers were doing this a decade ago. Doesn't MAC randomization used by both Apple and Android devices make this redundant?

by Narkov 3y ago

Large retailers were doing this a decade ago. Doesn't MAC randomization used by both Apple and Android devices make this redundant?

cma 3y ago

Don't some people turn off randomization so that their router can assign a fixed internal IP address?

teaearlgraycold 3y ago
If by some people you mean a small proportion of a small community like Hacker News then yes.
rootusrootus 3y ago
Yes, but that setting is per network (at least on iOS). I only turn it off for my home network.
- gruez 3y ago
  Same on android. It defaults to per-network and the only way to change it is per network.

Simulacra 3y ago

Longer! Since the early 2000s.

justinclift 3y ago

Were they only using the data externally, or were they also selling/sharing it with third parties?

linkjuice4all 3y ago

I'm no legal expert but it seems like this data might be subject to FOIA requests - or at least should be anyway. If it is truly anonymized (yeah, right) then it could be released publicly. I'm not really sure what the general public would actually do with this data - but they paid for it so they should have access. Even better would be to not collect it at all. Is there some way to increase the cost of collecting/storing data like this so that more municipalities/organizations will just consider stuff like this "not worth it"? Even in cases where courts have found that the government (or their agents e.g. a police officer) didn't have the authority to surveil the public without a warrant they were able to purchase private data and construct a parallel chain of evidence that didn't involve the warrant-less surveillance.

internetter 3y ago
I've already submitted a FOIA – request 2024-0103[0]. I requested all raw data made available to the town since this feature was made available in 2021. If this is successful, I will submit one to neighbouring towns as well, and will release it on my blog (here[1]). Edit: I have mixed feelings on this initiative as a whole. "Bike Counters" are frequently used by cyclists, for instance, to argue areas need better infrastructure. The question is how can it be done in a non-invasive way, and this data should absolutely be public if it's being collected [0]: https://townforms.com/FOIADirect-BrooklineMACitizens/Public/Request/PublicRequestDetails.aspx https://townforms.com/FOIADirect-BrooklineMACitizens/Public/... [1]: https://boehs.org/node/soofa-foia https://boehs.org/node/soofa-foia
deleted 3y ago
[deleted]
lxgr 3y ago
Who would you FOIA? iOS and Android randomly and locally select a 47 bit number and change it every now and then. I don't think it's ever sent off-device.
- linkjuice4all 3y ago
  The town of Brookline itself. They contracted with Soofa and would likely have responsive records in the form of contracts at the very least. It's not obvious who owns some/all of the data so you might not get the actual MAC addresses - or as others have mentioned you'd get a lot of "random" hits so it would be more difficult to track returning individuals. Regardless - these are elected officials and their departs using public money for what some might consider surveillance. What's the issue with a little sunshine on how this all works?
  - lxgr 3y ago
    Ah, got it, I was thinking you were referring to the mobile OSes and the details of their MAC randomization implementations.

gumby 3y ago

My understanding is that apple's MAC randomization tries to give each SSID a different MAC but records the mapping so that the next time you connecct to a known SSID you get the same MAC. I can see why they would choose to do this -- it provides some privacy while not confusing most users (who might have to reauthenticate, or might no longer be in an allow list). I'd prefer to get a new one each time I connected to an SSID but I'm sure I'm in the minority.* I wouldn't be surprised if every one of these devices had the same SSID. Why not? * 99.999% of the population wouldn't know a MAC if it bit them on the nose, and I'm sure prefer it that way. Not an unreasonable position to take, TBH.

gruez 3y ago
> My understanding is that apple's MAC randomization tries to give each SSID a different MAC but records the mapping so that the next time you connecct to a known SSID you get the same MAC. And that's if you actually joined the network (who joins a billboard's wifi network these days? Celluar data is plentiful even for cheap plans). If not, the only MAC that's sent is a random phone that's reset every scan/15 minutes (forgot which one it was).
- jbverschoor 3y ago
  It keeps the max address when connected. Overall the whole this doesn’t work anymore since any 10 years. It’s false information to a certain degree.. It will work for people just passing by. What does work is sending out btle beacon signals, putting a sdr 5G cell. The whole market for this kind of tracking is filled with fake data..
  - gruez 3y ago
    >putting a sdr 5G cell. That sounds super illegal because the spectrum 5G operates on requires a license to use. You can partner with cell carriers to use their licenses, but why would they partner with you? They'll be quite happy to use their existing infrastructure and hoard the data for themselves.