5 ms·

Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all. That

by ynniv 14y ago

Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all. That is exactly what the law says in this case. The government has declared that MAC randomization is the creation of fraudulent identities for the purposes of authentication, not unlike creating fraudulent photo identification. You can say that randomizing a MAC address is not a crime, just as one can say that creating a fake passport for a movie is not a crime. The crime is in using that fake identification for authentication, which is obvious when customs asks for your passport, but undetectable when a network is using MAC addresses to enforce policy. If subverting that network policy is a felony, then MAC randomization is, by law, sometimes an involuntary felony. While MAC addresses are obviously not a form of identification to technical folks, this stance would not be unprecedented as the US has also made it a felony to forge another trivially forged pseudo identify, Caller ID[1]. Enforcement of CNID spoofing is much easier given the nature of the phone system, since only a few providers bridge from VoIP to POTS. [ 1 https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation_in_the_United_States https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation... ]

Falling3 14y ago
I haven't given this all much chance, but the OP's argument is basically that the current legal view of MAC spoofing is flawed in two ways, which no one seems to be addressing here. It is not an actual means of identifying an individual and it is part of ensuring a reasonable amount of privacy for the user. It's more akin to wearing a fake mustache, than using a fake id.
- ynniv 14y ago
  It is not an actual means of identifying an individual and it is part of ensuring a reasonable amount of privacy for the user. Technically. Yes, I think that anyone who understands the technology agrees with this. The problem is that the courts are enforcing it as if it were the digital equivalent of a photo id, and this is not a small problem.
  - Falling3 14y ago
    Well yes we all know legislators and the judicial system do a horrific job of understanding these fundamental differences between the real world and the computer world. What really worries me is when someone on HN talks the same way.
danielweber 14y ago
Say I am not allowed on your premises, and I wear a fake mustache in order to get past a mechanism you put in place to stop me (such as guards with my picture), and I get charged with fraud for deceiving your guards because I gained access to something valuable. This doesn't mean "oh noes! fake mustaches are against the lawz!!!11 they are going to lock up all the actors!"
- jlgreco 14y ago
  In this hypothetical moustache example, is the "gained access to something valuable" the sticking point, or is it the "deceiving guards"? I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass... Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? Was Aaron's curl script A-okay right up until the point that he deceived?
  - danielweber 14y ago
    Aaron's initial script may well have been illegal in and of itself, because it was bypassing JSTOR's limits on how many articles you can download. Aaron took so many more steps after that that it's hardly worth talking about his first action. Two questions you need to seriously answer to make changing your MAC address on Comcast's network to be the exact same thing as what Aaron did: 1. Are you bypassing a security mechanism by changing your MAC address? 2. Did you gain something and/or cause them losses exceeding $5,000?
    - jlgreco 14y ago
      At the risk of being mildly self-incriminating... > 1. Are you bypassing a security mechanism by changing your MAC address? As far as I can tell? Quite possibly. If I don't make my router use my laptop's MAC address then I get hit with a captive portal at random times. This appears to be a security measure, though in my unresearched opinion I believe it to be a mis-firing of a security measure. > 2. Did you gain something and/or cause them losses exceeding $5,000? Considering the cost of my bill, it won't take me all that long to cross that limit.

by ynniv 14y ago

Falling3 14y ago

I haven't given this all much chance, but the OP's argument is basically that the current legal view of MAC spoofing is flawed in two ways, which no one seems to be addressing here. It is not an actual means of identifying an individual and it is part of ensuring a reasonable amount of privacy for the user. It's more akin to wearing a fake mustache, than using a fake id.

ynniv 14y ago
It is not an actual means of identifying an individual and it is part of ensuring a reasonable amount of privacy for the user. Technically. Yes, I think that anyone who understands the technology agrees with this. The problem is that the courts are enforcing it as if it were the digital equivalent of a photo id, and this is not a small problem.
- Falling3 14y ago
  Well yes we all know legislators and the judicial system do a horrific job of understanding these fundamental differences between the real world and the computer world. What really worries me is when someone on HN talks the same way.

danielweber 14y ago

Say I am not allowed on your premises, and I wear a fake mustache in order to get past a mechanism you put in place to stop me (such as guards with my picture), and I get charged with fraud for deceiving your guards because I gained access to something valuable. This doesn't mean "oh noes! fake mustaches are against the lawz!!!11 they are going to lock up all the actors!"

jlgreco 14y ago
In this hypothetical moustache example, is the "gained access to something valuable" the sticking point, or is it the "deceiving guards"? I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass... Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? Was Aaron's curl script A-okay right up until the point that he deceived?
- danielweber 14y ago
  Aaron's initial script may well have been illegal in and of itself, because it was bypassing JSTOR's limits on how many articles you can download. Aaron took so many more steps after that that it's hardly worth talking about his first action. Two questions you need to seriously answer to make changing your MAC address on Comcast's network to be the exact same thing as what Aaron did: 1. Are you bypassing a security mechanism by changing your MAC address? 2. Did you gain something and/or cause them losses exceeding $5,000?
  - jlgreco 14y ago
    At the risk of being mildly self-incriminating... > 1. Are you bypassing a security mechanism by changing your MAC address? As far as I can tell? Quite possibly. If I don't make my router use my laptop's MAC address then I get hit with a captive portal at random times. This appears to be a security measure, though in my unresearched opinion I believe it to be a mis-firing of a security measure. > 2. Did you gain something and/or cause them losses exceeding $5,000? Considering the cost of my bill, it won't take me all that long to cross that limit.