3 ms·

Apple has been obfuscating the bluetooth MAC for a while.

transpute 2y ago
From the article: > The current approach taken by smartphone companies to make the devices hard to track by their Bluetooth signals is to randomly change the phone’s identity, its MAC address. However, that doesn’t address the physical-layer fingerprints inherent in each device’s transmissions.. All wireless devices have small manufacturing imperfections in the hardware used to emit these beacons.. These imperfections in Bluetooth hardware result in unique distortions, which can be used as a fingerprint to track a specific device.
- ChrisMarshallNY 2y ago
  Fair 'nuff. I didn't read the article. Fair cop, Guv.
  - ChrisMarshallNY 2y ago
    Hey, I admitted it. I see a number of others that didn't. Looks like a number of folks didn't read it, and there's a number of others that are taking great glee in pointing it out. There's utility in promptly admitting when we're wrong.
    - swores 2y ago
      Maybe people downvoted you for choosing to attempt humour in your mea culpa while not bothering to either thank the person who took time to answer you nor apologise for wasting their time. Though I'm not a mind reader, maybe that's not why they felt downvotes were warranted and only I had that thought.
      - ChrisMarshallNY 2y ago
        Nah. I sincerely want to contribute, and deserved the downvotes. I could have deleted it, but didn't, because I think folks around here could probably use some object lessons, on what admitting error looks like. I didn't waste anyone's time. They were more than happy to ding me. In fact, there's few things that geeks like doing, more than telling other geeks, they are wrong, so I maybe did a public service. I'll do humor, and, if people want to get butthurt, they'll bang on the down button, just like they always have.
        swores 2y ago
        I'm not sure what you're saying "nah" to, you didn't seem happy that your (second) comment had been downvoted, I explained why people may have downvoted it (and why I agree with them, though it was already grey when I arrived). If you really don't care about the downvotes then that's good but you can skip commenting about them next time. If you do care about them, react by not posting comments that waste people's time rather than complaining about it. (Unless I was wrong to read "I don't know why people are downvoting my mea culpa" into this comment - https://news.ycombinator.com/item?id=40961512 https://news.ycombinator.com/item?id=40961512 - but I can't think what other meaning it could have in the context of replying to your own comment which had been downvoted). Regardless, I won't bother coming back to this thread as I've wasted enough time myself by choosing to comment to not care further.
sulandor 2y ago
just fired up airmon and cannot reproduce your observation
- ChrisMarshallNY 2y ago
  Maybe you're running an old version (or not BLE). It's been doing it for a long time. Same with a lot of other types of devices, I'm sure. It's standard security practice, these days. https://support.apple.com/guide/security/bluetooth-security-sec82597d97e/web https://support.apple.com/guide/security/bluetooth-security-...
  - sulandor 2y ago
    > old version (or not BLE) both actually, but i am seeing unrandomized normal bt beacons. how about your device?
    - ChrisMarshallNY 2y ago
      I've written BT software[0], and it always randomizes it. I don't think it randomizes for every transaction, but it does use different UUIDs, when I run the device at different times. You can't switch the UUID, after establishing a connection. [0] https://riftvalleysoftware.com/work/ios-apps/bluevanclef/ https://riftvalleysoftware.com/work/ios-apps/bluevanclef/
      - sulandor 2y ago
        impressive. did you have a chance to check what kind of beacons your iphone actually emits?
        ChrisMarshallNY 2y ago
        I did look, back when, but it’s been a few years, since I wrote that, and it hasn’t really been a priority. When I was writing it, I spent a lot of time with a sniffer and WireShark, so I was looking at the raw data. [EDITED TO ADD] Sniffers are of minimal use, with BLE, since everything gets encrypted, as soon as devices start talking to each other, but you can see the advertisements. I used one, because all the Apple devices seem to have a different opinion, on what's out there. I'd see a device with the Watch, but not the phone or TV, and vice-versa. I actually submitted a bug report on it, but I don't think Apple ever even looked at it. I'm sure they are well aware of this. I suspect the Apple engineers are probably some of the top BT people in the world.

From the article: > The current approach taken by smartphone companies to make the devices hard to track by their Bluetooth signals is to randomly change the phone’s identity, its MAC address. However, that doesn’t address the physical-layer fingerprints inherent in each device’s transmissions.. All wireless devices have small manufacturing imperfections in the hardware used to emit these beacons.. These imperfections in Bluetooth hardware result in unique distortions, which can be used as a fingerprint to track a specific device.

ChrisMarshallNY 2y ago
Fair 'nuff. I didn't read the article. Fair cop, Guv.
- ChrisMarshallNY 2y ago
  Hey, I admitted it. I see a number of others that didn't. Looks like a number of folks didn't read it, and there's a number of others that are taking great glee in pointing it out. There's utility in promptly admitting when we're wrong.
  - swores 2y ago
    Maybe people downvoted you for choosing to attempt humour in your mea culpa while not bothering to either thank the person who took time to answer you nor apologise for wasting their time. Though I'm not a mind reader, maybe that's not why they felt downvotes were warranted and only I had that thought.
    - ChrisMarshallNY 2y ago
      Nah. I sincerely want to contribute, and deserved the downvotes. I could have deleted it, but didn't, because I think folks around here could probably use some object lessons, on what admitting error looks like. I didn't waste anyone's time. They were more than happy to ding me. In fact, there's few things that geeks like doing, more than telling other geeks, they are wrong, so I maybe did a public service. I'll do humor, and, if people want to get butthurt, they'll bang on the down button, just like they always have.
      - swores 2y ago
        I'm not sure what you're saying "nah" to, you didn't seem happy that your (second) comment had been downvoted, I explained why people may have downvoted it (and why I agree with them, though it was already grey when I arrived). If you really don't care about the downvotes then that's good but you can skip commenting about them next time. If you do care about them, react by not posting comments that waste people's time rather than complaining about it. (Unless I was wrong to read "I don't know why people are downvoting my mea culpa" into this comment - https://news.ycombinator.com/item?id=40961512 https://news.ycombinator.com/item?id=40961512 - but I can't think what other meaning it could have in the context of replying to your own comment which had been downvoted). Regardless, I won't bother coming back to this thread as I've wasted enough time myself by choosing to comment to not care further.

sulandor 2y ago

just fired up airmon and cannot reproduce your observation

ChrisMarshallNY 2y ago
Maybe you're running an old version (or not BLE). It's been doing it for a long time. Same with a lot of other types of devices, I'm sure. It's standard security practice, these days. https://support.apple.com/guide/security/bluetooth-security-sec82597d97e/web https://support.apple.com/guide/security/bluetooth-security-...
- sulandor 2y ago
  > old version (or not BLE) both actually, but i am seeing unrandomized normal bt beacons. how about your device?
  - ChrisMarshallNY 2y ago
    I've written BT software[0], and it always randomizes it. I don't think it randomizes for every transaction, but it does use different UUIDs, when I run the device at different times. You can't switch the UUID, after establishing a connection. [0] https://riftvalleysoftware.com/work/ios-apps/bluevanclef/ https://riftvalleysoftware.com/work/ios-apps/bluevanclef/
    - sulandor 2y ago
      impressive. did you have a chance to check what kind of beacons your iphone actually emits?
      - ChrisMarshallNY 2y ago
        I did look, back when, but it’s been a few years, since I wrote that, and it hasn’t really been a priority. When I was writing it, I spent a lot of time with a sniffer and WireShark, so I was looking at the raw data. [EDITED TO ADD] Sniffers are of minimal use, with BLE, since everything gets encrypted, as soon as devices start talking to each other, but you can see the advertisements. I used one, because all the Apple devices seem to have a different opinion, on what's out there. I'd see a device with the Watch, but not the phone or TV, and vice-versa. I actually submitted a bug report on it, but I don't think Apple ever even looked at it. I'm sure they are well aware of this. I suspect the Apple engineers are probably some of the top BT people in the world.