9 ms·

You have completely and absolutely missed the point. Changing MAC addresses (upon every restart) is something I do too. It is an extremely easy thing to do. Th

by clicks 14y ago

You have completely and absolutely missed the point. Changing MAC addresses (upon every restart) is something I do too. It is an extremely easy thing to do. That such an obvious thing will effortlessly add to a list of charges, amplifying the prosecutor's case for no good reason, is what the issue is. The most frustrating thing about your comment is your condescending attitude. It's exactly this kind of behavior that is sliding us down a path of draconian laws that will in the end harm us all. Please think before going off like this.

ajross 14y ago
I think you're completely and absolutely talking past the argument. In the law as it exists, doing something "anonymously" for the purpose of committing a crime is itself a crime. It's not the act of changing the MAC address that is illegal by itself. That was the point. Your point, I think, is that that "extra" crime is a silly law. Which I think many of us agree with. But it's still the law, and it's not unreasonable for a prosecutor to enforce it. In fact, they have a duty to do so. Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all.
- ynniv 14y ago
  Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all. That is exactly what the law says in this case. The government has declared that MAC randomization is the creation of fraudulent identities for the purposes of authentication, not unlike creating fraudulent photo identification. You can say that randomizing a MAC address is not a crime, just as one can say that creating a fake passport for a movie is not a crime. The crime is in using that fake identification for authentication, which is obvious when customs asks for your passport, but undetectable when a network is using MAC addresses to enforce policy. If subverting that network policy is a felony, then MAC randomization is, by law, sometimes an involuntary felony. While MAC addresses are obviously not a form of identification to technical folks, this stance would not be unprecedented as the US has also made it a felony to forge another trivially forged pseudo identify, Caller ID[1]. Enforcement of CNID spoofing is much easier given the nature of the phone system, since only a few providers bridge from VoIP to POTS. [ 1 https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation_in_the_United_States https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation... ]
  - Falling3 14y ago
    I haven't given this all much chance, but the OP's argument is basically that the current legal view of MAC spoofing is flawed in two ways, which no one seems to be addressing here. It is not an actual means of identifying an individual and it is part of ensuring a reasonable amount of privacy for the user. It's more akin to wearing a fake mustache, than using a fake id.
    - ynniv 14y ago
      It is not an actual means of identifying an individual and it is part of ensuring a reasonable amount of privacy for the user. Technically. Yes, I think that anyone who understands the technology agrees with this. The problem is that the courts are enforcing it as if it were the digital equivalent of a photo id, and this is not a small problem.
      - Falling3 14y ago
        Well yes we all know legislators and the judicial system do a horrific job of understanding these fundamental differences between the real world and the computer world. What really worries me is when someone on HN talks the same way.
  - danielweber 14y ago
    Say I am not allowed on your premises, and I wear a fake mustache in order to get past a mechanism you put in place to stop me (such as guards with my picture), and I get charged with fraud for deceiving your guards because I gained access to something valuable. This doesn't mean "oh noes! fake mustaches are against the lawz!!!11 they are going to lock up all the actors!"
    - jlgreco 14y ago
      In this hypothetical moustache example, is the "gained access to something valuable" the sticking point, or is it the "deceiving guards"? I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass... Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? Was Aaron's curl script A-okay right up until the point that he deceived?
- AnthonyMouse 14y ago
  >In the law as it exists, doing something "anonymously" for the purpose of committing a crime is itself a crime. It's not the act of changing the MAC address that is illegal by itself. What, then, was the underlying crime, if not this unauthorized access nonsense where access was allegedly unauthorized only because he was supposedly hiding his identity? Keep in mind that it wasn't copyright infringement (which normally isn't criminal anyway), because it wasn't JSTOR pressing charges, it was MIT. >Your point, I think, is that that "extra" crime is a silly law. Which I think many of us agree with. But it's still the law, and it's not unreasonable for a prosecutor to enforce it. But there are two issues here: There is what prosecutors did, and what the law allowed them to do. Even if you don't have a problem with the prosecutors, we can still have a problem with the law and work to have it changed. >In fact, they have a duty to do so. No they don't. They have prosecutorial discretion. If the application of the law in a particular case is ridiculous, they have no legal or professional obligation to press those charges.
  - ajross 14y ago
    I don't think I disagree with anything you said. I still don't see what it has to do with locking up MAC randomizers.
  - bad_user 14y ago
    > No they don't. They have prosecutorial discretion. If the application of the law in a particular case is ridiculous, they have no legal or professional obligation to press those charges. You either break the law, or you don't. The law should be the same for everybody and should NOT be applied selectively. It's actually outrageous that you imply otherwise. Because this happens it's precisely the reason for why we have ridiculous laws in the first place. If this goes on pretty soon everybody will be a criminal, but the world will still turn for you, until you manage to upset somebody you shouldn't have. And since we are on the subject, that's how the law works in totalitarian states.
    - erichocean 14y ago
      You either break the law, or you don't. This viewpoint is incredibly naive, and also wrong. The law is not black or white, it is selectively enforced all the time, and context does matter in its application.
- jlgreco 14y ago
  Had Aaron not been changing his MAC address, and not used a fake email, would his curl script have been illegal? If changing your MAC is not itself an issue, how do we determine what (normally legal) things you cannot do after (legally) changing your MAC?
  - FireBeyond 14y ago
    In this context, yes. It would just have been easier for MIT to prevent access.
    - jlgreco 14y ago
      So the next time someone recursively wget's my website in violation of my TOS, I can expect to get the feds interested?
      - FireBeyond 14y ago
        If you can show "damages" to their satisfaction/threshold, yes (bear in mind that, as should be no surprise to anyone here, definitions of damage and the measurability thereof may significantly vary).
- pfortuny 14y ago
  Just to point out that if a law is unjust, the prosecutor may have a duty qua prosecutor but qua human being he has a stronger duty to stand against that law. Yes, it may be dangerous but the slippery slope is exactly that: 'as it is my legal duty, I shall try to make as much harm as possible'. Conscience does exist...
- genwin 14y ago
  > But it's still the law, and it's not unreasonable for a prosecutor to enforce it. Orders to do something obviously wrong should be followed, because the law is the law. Nice thinking there.
jtanderson 14y ago
I agree with ajross' reply. The changing of MAC address wasn't the "capital offense" so to speak. You don't get pulled over for not wearing a seatbelt, but if they _do_ pull you over and you _happen_ to not be wearing a seatbelt, they can hit you with extra fines, etc. Besides, arguing against a comment for it's attitude isn't an argument at all. The original comment was essentially a (valid) "so what?" to the article; it wasn't a refutation of fact, but expressing a frustration at the non sequitur implied by this, and allegedly, many other articles on HN.
- SoftwareMaven 14y ago
  I've heard from several police officers that if they follow you for 60 seconds, they can find a reason to pull you over. If the seatbelt instigated that following, isn't it exactly the same thing the OP is saying? The issue the OP has is that changing your MAC address is synonymous with walking around in the dark, something law abiding citizens do regularly, but police better frown upon because that's when the bad guys sneak around. Personally, I played lots of tag after dark and had more than one negative interaction with the police as a result. Kids after dark can't be up to good, and hackers spoofing MACs can't be either!
  - snowwrestler 14y ago
    It's not illegal to sit in a parked car without a buckled seat belt, it's only illegal to drive a car on a public street without a buckled seat belt. Likewise, it's not illegal to change your MAC address, it's only illegal to change your MAC address in the course of bypassing a security mechanism. Context matters.
watty 14y ago
Well it doesn't matter how "easy" it is to do. It also doesn't matter if the password was just "password" or if the door he broke into had 1 lock or 500 locks. Also the prosecutor is typically going to overstate the charges and the defendant will understate them. In this case the prosecutor went for 35 years and the defendant went for zero years (not guilty). This is where the judge comes into play. If Aaron shows that he changes his MAC address every morning then that charge will likely be dropped. If it's found that he only changed his MAC to bypass a restriction, it could be seen as concealing.
- uncoder0 14y ago
  Well then is is probably a good idea to go on record about changing your mac address on boot. Otherwise I imagine you would have a hard time proving it in court. I too randomize my MAC address at boot on all of my machines except my work desktop.
stfu 14y ago
Unrelated question: How to change MAC adresses the most convenient way on every restart?
- tedunangst 14y ago
  For openbsd: ifconfig lladdr random

by clicks 14y ago

ajross 14y ago

I think you're completely and absolutely talking past the argument. In the law as it exists, doing something "anonymously" for the purpose of committing a crime is itself a crime. It's not the act of changing the MAC address that is illegal by itself. That was the point. Your point, I think, is that that "extra" crime is a silly law. Which I think many of us agree with. But it's still the law, and it's not unreasonable for a prosecutor to enforce it. In fact, they have a duty to do so. Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all.

ynniv 14y ago
Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all. That is exactly what the law says in this case. The government has declared that MAC randomization is the creation of fraudulent identities for the purposes of authentication, not unlike creating fraudulent photo identification. You can say that randomizing a MAC address is not a crime, just as one can say that creating a fake passport for a movie is not a crime. The crime is in using that fake identification for authentication, which is obvious when customs asks for your passport, but undetectable when a network is using MAC addresses to enforce policy. If subverting that network policy is a felony, then MAC randomization is, by law, sometimes an involuntary felony. While MAC addresses are obviously not a form of identification to technical folks, this stance would not be unprecedented as the US has also made it a felony to forge another trivially forged pseudo identify, Caller ID[1]. Enforcement of CNID spoofing is much easier given the nature of the phone system, since only a few providers bridge from VoIP to POTS. [ 1 https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation_in_the_United_States https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation... ]
- Falling3 14y ago
  I haven't given this all much chance, but the OP's argument is basically that the current legal view of MAC spoofing is flawed in two ways, which no one seems to be addressing here. It is not an actual means of identifying an individual and it is part of ensuring a reasonable amount of privacy for the user. It's more akin to wearing a fake mustache, than using a fake id.
  - ynniv 14y ago
    It is not an actual means of identifying an individual and it is part of ensuring a reasonable amount of privacy for the user. Technically. Yes, I think that anyone who understands the technology agrees with this. The problem is that the courts are enforcing it as if it were the digital equivalent of a photo id, and this is not a small problem.
    - Falling3 14y ago
      Well yes we all know legislators and the judicial system do a horrific job of understanding these fundamental differences between the real world and the computer world. What really worries me is when someone on HN talks the same way.
- danielweber 14y ago
  Say I am not allowed on your premises, and I wear a fake mustache in order to get past a mechanism you put in place to stop me (such as guards with my picture), and I get charged with fraud for deceiving your guards because I gained access to something valuable. This doesn't mean "oh noes! fake mustaches are against the lawz!!!11 they are going to lock up all the actors!"
  - jlgreco 14y ago
    In this hypothetical moustache example, is the "gained access to something valuable" the sticking point, or is it the "deceiving guards"? I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass... Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? Was Aaron's curl script A-okay right up until the point that he deceived?
AnthonyMouse 14y ago
>In the law as it exists, doing something "anonymously" for the purpose of committing a crime is itself a crime. It's not the act of changing the MAC address that is illegal by itself. What, then, was the underlying crime, if not this unauthorized access nonsense where access was allegedly unauthorized only because he was supposedly hiding his identity? Keep in mind that it wasn't copyright infringement (which normally isn't criminal anyway), because it wasn't JSTOR pressing charges, it was MIT. >Your point, I think, is that that "extra" crime is a silly law. Which I think many of us agree with. But it's still the law, and it's not unreasonable for a prosecutor to enforce it. But there are two issues here: There is what prosecutors did, and what the law allowed them to do. Even if you don't have a problem with the prosecutors, we can still have a problem with the law and work to have it changed. >In fact, they have a duty to do so. No they don't. They have prosecutorial discretion. If the application of the law in a particular case is ridiculous, they have no legal or professional obligation to press those charges.
- ajross 14y ago
  I don't think I disagree with anything you said. I still don't see what it has to do with locking up MAC randomizers.
- bad_user 14y ago
  > No they don't. They have prosecutorial discretion. If the application of the law in a particular case is ridiculous, they have no legal or professional obligation to press those charges. You either break the law, or you don't. The law should be the same for everybody and should NOT be applied selectively. It's actually outrageous that you imply otherwise. Because this happens it's precisely the reason for why we have ridiculous laws in the first place. If this goes on pretty soon everybody will be a criminal, but the world will still turn for you, until you manage to upset somebody you shouldn't have. And since we are on the subject, that's how the law works in totalitarian states.
  - erichocean 14y ago
    You either break the law, or you don't. This viewpoint is incredibly naive, and also wrong. The law is not black or white, it is selectively enforced all the time, and context does matter in its application.
jlgreco 14y ago
Had Aaron not been changing his MAC address, and not used a fake email, would his curl script have been illegal? If changing your MAC is not itself an issue, how do we determine what (normally legal) things you cannot do after (legally) changing your MAC?
- FireBeyond 14y ago
  In this context, yes. It would just have been easier for MIT to prevent access.
  - jlgreco 14y ago
    So the next time someone recursively wget's my website in violation of my TOS, I can expect to get the feds interested?
    - FireBeyond 14y ago
      If you can show "damages" to their satisfaction/threshold, yes (bear in mind that, as should be no surprise to anyone here, definitions of damage and the measurability thereof may significantly vary).
pfortuny 14y ago
Just to point out that if a law is unjust, the prosecutor may have a duty qua prosecutor but qua human being he has a stronger duty to stand against that law. Yes, it may be dangerous but the slippery slope is exactly that: 'as it is my legal duty, I shall try to make as much harm as possible'. Conscience does exist...
genwin 14y ago
> But it's still the law, and it's not unreasonable for a prosecutor to enforce it. Orders to do something obviously wrong should be followed, because the law is the law. Nice thinking there.

jtanderson 14y ago

I agree with ajross' reply. The changing of MAC address wasn't the "capital offense" so to speak. You don't get pulled over for not wearing a seatbelt, but if they _do_ pull you over and you _happen_ to not be wearing a seatbelt, they can hit you with extra fines, etc. Besides, arguing against a comment for it's attitude isn't an argument at all. The original comment was essentially a (valid) "so what?" to the article; it wasn't a refutation of fact, but expressing a frustration at the non sequitur implied by this, and allegedly, many other articles on HN.

SoftwareMaven 14y ago
I've heard from several police officers that if they follow you for 60 seconds, they can find a reason to pull you over. If the seatbelt instigated that following, isn't it exactly the same thing the OP is saying? The issue the OP has is that changing your MAC address is synonymous with walking around in the dark, something law abiding citizens do regularly, but police better frown upon because that's when the bad guys sneak around. Personally, I played lots of tag after dark and had more than one negative interaction with the police as a result. Kids after dark can't be up to good, and hackers spoofing MACs can't be either!
- snowwrestler 14y ago
  It's not illegal to sit in a parked car without a buckled seat belt, it's only illegal to drive a car on a public street without a buckled seat belt. Likewise, it's not illegal to change your MAC address, it's only illegal to change your MAC address in the course of bypassing a security mechanism. Context matters.

watty 14y ago

Well it doesn't matter how "easy" it is to do. It also doesn't matter if the password was just "password" or if the door he broke into had 1 lock or 500 locks. Also the prosecutor is typically going to overstate the charges and the defendant will understate them. In this case the prosecutor went for 35 years and the defendant went for zero years (not guilty). This is where the judge comes into play. If Aaron shows that he changes his MAC address every morning then that charge will likely be dropped. If it's found that he only changed his MAC to bypass a restriction, it could be seen as concealing.

uncoder0 14y ago
Well then is is probably a good idea to go on record about changing your mac address on boot. Otherwise I imagine you would have a hard time proving it in court. I too randomize my MAC address at boot on all of my machines except my work desktop.

stfu 14y ago

Unrelated question: How to change MAC adresses the most convenient way on every restart?

tedunangst 14y ago
For openbsd: ifconfig lladdr random