3 ms·

MAC randomization prevents the local network from trivially tracking you based on access point logs. Of course, if your device runs software that broadcasts som

MAC randomization prevents the local network from trivially tracking you based on access point logs. Of course, if your device runs software that broadcasts some unique identifier, the network may deploy some collector service to query/capture these but that's already extra effort. On iOS I don't believe apps can run a persistent network server in the background, so background tracking would actually be quite tricky even if you had a cooperating app. Fingerprinting is absolutely an issue for device-based trackers (whether apps or websites), but from the perspective of a passive network observer they're usually quite airtight and don't leak the collected data over insecure channels.

wutwutwat 3y ago
Not just access point logs, this isn’t WiFi specific. It’s to make packet inspection harder to link to a device. But, if I run say an airport network and control dns for dhcp I can track your dns requests (non encrypted dns) and interface info across MAC addresses and maybe even tag packets somehow. Also, if every device that connects is routed through a dedicated vlan only containing that device, it can randomize itself all it wants, it’s on a network by itself so it can’t “hide in the crowd”. Those are just things off the top of my head and am not a network person. I’m sure it’s not preventing the motivated from tracking you if they want to.
- Nextgrid 3y ago
  I don't disagree that a motivated attacker can set up advanced infrastructure to collect network-related fingerprints, but this requires active effort. MAC address randomization is designed to at least prevent multiple unconnected networks from trivially tracking a user by making up a per-SSID MAC address. Ideally, Apple would randomize MACs within the same SSID too, but this would break a lot of "free wifi for X time, then pay up" schemes that rely on consistent MAC addresses, and despite the appearances Apple is still very much in bed with the establishment and doesn't want to rock the boat too much by giving that much control to the users.

wutwutwat 3y ago

Not just access point logs, this isn’t WiFi specific. It’s to make packet inspection harder to link to a device. But, if I run say an airport network and control dns for dhcp I can track your dns requests (non encrypted dns) and interface info across MAC addresses and maybe even tag packets somehow. Also, if every device that connects is routed through a dedicated vlan only containing that device, it can randomize itself all it wants, it’s on a network by itself so it can’t “hide in the crowd”. Those are just things off the top of my head and am not a network person. I’m sure it’s not preventing the motivated from tracking you if they want to.

Nextgrid 3y ago
I don't disagree that a motivated attacker can set up advanced infrastructure to collect network-related fingerprints, but this requires active effort. MAC address randomization is designed to at least prevent multiple unconnected networks from trivially tracking a user by making up a per-SSID MAC address. Ideally, Apple would randomize MACs within the same SSID too, but this would break a lot of "free wifi for X time, then pay up" schemes that rely on consistent MAC addresses, and despite the appearances Apple is still very much in bed with the establishment and doesn't want to rock the boat too much by giving that much control to the users.