3 ms·

Are you bypassing a security mechanism by changing your MAC address? This question seriously calls into question your profile description of "security guy". A

by ynniv 14y ago

Are you bypassing a security mechanism by changing your MAC address? This question seriously calls into question your profile description of "security guy". A security mechanism based on MAC is as effective as a security mechanism based on asking a stranger whether their name is Aaron Swartz, because Aaron Swartz isn't allowed on this network. Please stop.

rayiner 14y ago
The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. That's why the strength of the security measure isn't relevant. If I don't want Bob Dylan walking on my lawn, and I post guards who simply ask "are you Bob Dylan?" that shouldn't be any different than if I put up retinal and finger print scanners. Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn.
- ynniv 14y ago
  Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn. Agreed, which is one reason it is important in this conversation to separate false identity from trespassing. The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. Ah! Exactly! Which is why this conversation is important. The OP has said that he effectively always says no when asked if he is "Insert Name". My example is also poor, because asking someone if they are Bob Dylan also informs them that Bob Dylan is restricted from entry, which means something to the law. A better example would be a security system based on something fleeting and baseless, like your favorite color. You might have always liked the same color, or you might change favorite colors every year, or you might just tell people a different color because no one really knows what your favorite color is but you anyway. If the security call box asked you what your favorite color was, you told them something random, and they let you in, is that illegal? The security guard never said that people whose favorite color is X are not allowed, he just asked what your favorite color was, and then he let you in.
  - rayiner 14y ago
    You're going to all sorts of gyrations to avoid the obvious. The fundamental question is still: do you know that you are being singled out? Favorite colors are non-specific enough that you might reasonably not know. But MAC addresses aren't like favorite colors. Every Ethernet device has a unique one. If you find your MAC address banned, I think you can reasonably conclude that you're being singled out.
    - ynniv 14y ago
      You're going to all sorts of gyrations to avoid the obvious. The fundamental question is still: do you know that you're not allowed? I agree that I'm darting around, but it's in the interest of truth. Here's the problem: if Aaron was running an automated MAC randomization system for the purpose of personal privacy, he would never have known that his MAC was blocked. The details of his case show that he was aware, but this OP describes a situation in which there is no awareness. If the law is primarily concerned with the knowledge aspect, this can be attended to on a case by case basis. However, much of the discussion has suggested that a MAC is an identifier, and any alteration of this identifier is criminal. This should not be the case.
      - rayiner 14y ago
        I'm not an expert in the law, but I don't think it's the case that "any alteration of the identifier is criminal." Now, is it the case that if you habitually use MAC address randomization and try to access a network repeatedly without permission, your randomization of MAC address might be interpreted as a way of trying to get around blocks? This is quite possible, and will be handled by a jury that probably doesn't understand why anyone would randomize their MAC address any more than they would understand why anyone would habitually walk around wearing a ski mask. I think that's a legitimate concern.
        ynniv 14y ago
        This is quite possible, and will be handled by a jury that probably doesn't understand why anyone would randomize their MAC address any more than they would understand why anyone would habitually walk around wearing a ski mask. I would hope that someone would realize that wearing a ski mask for no reason has considerable downsides, while changing you MAC address for no reason has none. What if someone uses different devices instead of changing the identifier of one device? A policy that very explicitly says you can only take so much food on a plate, but that anyone can take a new plate, doesn't suggest that the server is too concerned about how much food is served.
danielweber 14y ago
Oh, good, insults. The fact that something is easy to bypass doesn't mean it's legal to bypass. In fact, that "Aaron Swartz isn't allowed on the network" example is perfect. If I have a sign saying "Bob isn't allowed on my property" and Bob comes on my property, that's trespassing.
snowwrestler 14y ago
The legal status of a security mechanism does not depend on its engineering efficacy. For example even though many deadbolts can be easily defeated with a bump key, using a bump key to gain entry to a house you're not legally entitled to enter would still be considered a crime.
- ynniv 14y ago
  Security based on MAC blocking is not remotely like a deadbolt. A deadbolt denies anyone who doesn't have a key, whereas a block list allows anyone who doesn't look like someone on the list. Security based on a MAC whitelist (where only certain people are allowed) is closer, but that isn't what MIT was using.
  - snowwrestler 14y ago
    You're continuing to miss the point. If I leave my door wide open and put up a sign that says "Private Property, Do Not Enter", it is legally the same as a deadbolt, despite the complete engineering uselessness of a sign in preventing physical access. You can't answer legal questions with engineering. They are different fields with different goals.
    - ynniv 14y ago
      If I leave my door wide open and put up a sign that says "Private Property, Do Not Enter", it is legally the same as a deadbolt Yes, and it's not the same as MAC blocking. You can't answer legal questions with engineering Technology changes the subtleties upon which laws are based, so you necessarily have to answer a legal question with certain aspects of engineering. A network that is protected by MAC identification cannot be directly compared to a room protected by a lock and key. In the case of Aaron, you can point to his modification of the MAC as an awareness that his is skirting network policy. Whether breach of network policy should be a felony is another discussion. However, someone who maintains privacy by randomizing his MAC is in a very different situation that looks strikingly similar to the case at hand. Will the courts understand the difference? We can only hope.
    - 14y ago

by ynniv 14y ago

rayiner 14y ago

The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. That's why the strength of the security measure isn't relevant. If I don't want Bob Dylan walking on my lawn, and I post guards who simply ask "are you Bob Dylan?" that shouldn't be any different than if I put up retinal and finger print scanners. Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn.

ynniv 14y ago
Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn. Agreed, which is one reason it is important in this conversation to separate false identity from trespassing. The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. Ah! Exactly! Which is why this conversation is important. The OP has said that he effectively always says no when asked if he is "Insert Name". My example is also poor, because asking someone if they are Bob Dylan also informs them that Bob Dylan is restricted from entry, which means something to the law. A better example would be a security system based on something fleeting and baseless, like your favorite color. You might have always liked the same color, or you might change favorite colors every year, or you might just tell people a different color because no one really knows what your favorite color is but you anyway. If the security call box asked you what your favorite color was, you told them something random, and they let you in, is that illegal? The security guard never said that people whose favorite color is X are not allowed, he just asked what your favorite color was, and then he let you in.
- rayiner 14y ago
  You're going to all sorts of gyrations to avoid the obvious. The fundamental question is still: do you know that you are being singled out? Favorite colors are non-specific enough that you might reasonably not know. But MAC addresses aren't like favorite colors. Every Ethernet device has a unique one. If you find your MAC address banned, I think you can reasonably conclude that you're being singled out.
  - ynniv 14y ago
    You're going to all sorts of gyrations to avoid the obvious. The fundamental question is still: do you know that you're not allowed? I agree that I'm darting around, but it's in the interest of truth. Here's the problem: if Aaron was running an automated MAC randomization system for the purpose of personal privacy, he would never have known that his MAC was blocked. The details of his case show that he was aware, but this OP describes a situation in which there is no awareness. If the law is primarily concerned with the knowledge aspect, this can be attended to on a case by case basis. However, much of the discussion has suggested that a MAC is an identifier, and any alteration of this identifier is criminal. This should not be the case.
    - rayiner 14y ago
      I'm not an expert in the law, but I don't think it's the case that "any alteration of the identifier is criminal." Now, is it the case that if you habitually use MAC address randomization and try to access a network repeatedly without permission, your randomization of MAC address might be interpreted as a way of trying to get around blocks? This is quite possible, and will be handled by a jury that probably doesn't understand why anyone would randomize their MAC address any more than they would understand why anyone would habitually walk around wearing a ski mask. I think that's a legitimate concern.
      - ynniv 14y ago
        This is quite possible, and will be handled by a jury that probably doesn't understand why anyone would randomize their MAC address any more than they would understand why anyone would habitually walk around wearing a ski mask. I would hope that someone would realize that wearing a ski mask for no reason has considerable downsides, while changing you MAC address for no reason has none. What if someone uses different devices instead of changing the identifier of one device? A policy that very explicitly says you can only take so much food on a plate, but that anyone can take a new plate, doesn't suggest that the server is too concerned about how much food is served.

danielweber 14y ago

Oh, good, insults. The fact that something is easy to bypass doesn't mean it's legal to bypass. In fact, that "Aaron Swartz isn't allowed on the network" example is perfect. If I have a sign saying "Bob isn't allowed on my property" and Bob comes on my property, that's trespassing.

snowwrestler 14y ago

The legal status of a security mechanism does not depend on its engineering efficacy. For example even though many deadbolts can be easily defeated with a bump key, using a bump key to gain entry to a house you're not legally entitled to enter would still be considered a crime.

ynniv 14y ago
Security based on MAC blocking is not remotely like a deadbolt. A deadbolt denies anyone who doesn't have a key, whereas a block list allows anyone who doesn't look like someone on the list. Security based on a MAC whitelist (where only certain people are allowed) is closer, but that isn't what MIT was using.
- snowwrestler 14y ago
  You're continuing to miss the point. If I leave my door wide open and put up a sign that says "Private Property, Do Not Enter", it is legally the same as a deadbolt, despite the complete engineering uselessness of a sign in preventing physical access. You can't answer legal questions with engineering. They are different fields with different goals.
  - ynniv 14y ago
    If I leave my door wide open and put up a sign that says "Private Property, Do Not Enter", it is legally the same as a deadbolt Yes, and it's not the same as MAC blocking. You can't answer legal questions with engineering Technology changes the subtleties upon which laws are based, so you necessarily have to answer a legal question with certain aspects of engineering. A network that is protected by MAC identification cannot be directly compared to a room protected by a lock and key. In the case of Aaron, you can point to his modification of the MAC as an awareness that his is skirting network policy. Whether breach of network policy should be a felony is another discussion. However, someone who maintains privacy by randomizing his MAC is in a very different situation that looks strikingly similar to the case at hand. Will the courts understand the difference? We can only hope.
  - 14y ago