4 ms·

This is a privacy nightmare. Perhaps wifi devices should no longer provide constant MAC addresses....

by albertsun 13y ago

chrisfarms 13y ago
Or rename "Airplane mode" to "Shopping mode"
- teleclimber 13y ago
  Seriously. I'm thinking it's time I set up my phone to turn off wifi whenever I am away from home. But would that even be the end of it? With Wifi off the phone is still broadcasting on cellular channels. Could a device be built that listened to those signals and uniquely identify them?
paulgb 13y ago
What's the advantage to a constant MAC address anyway? There must be a reason for it, but my first reaction to this article was to see if I could change mine.
- aroch 13y ago
  Network's that whitelist devices by MAC and device registration/provisioning by MAC. And debugging network is theoretically easier when every device has a unique MAC. There are several applications for OSX and various *nix distros that run at boot and randomize MACs. SpoofMac is probably the most well known: https://github.com/feross/SpoofMAC https://github.com/feross/SpoofMAC
  - MAGZine 13y ago
    This is perfect--I'm definitely going to set this up. I'd just like a background service for my Android device that would also randomize my MAC address... (perhaps it's time to investigate android development :P)
    - paulgb 13y ago
      I'd buy that app :) Unfortunately (from the apps that I've seen) it looks like only a rooted Android could support it.
      - RyanZAG 13y ago
        Yes, definitely rooted only - Linux will block any attempt to change the MAC without root access. That said, I've got a rooted android and change my mac all the time. Especially useful for coffee shops and airports.
- jcampbell1 13y ago
  You often get reassigned the same ip address. This is nice for things like port forwarding. I am not sure this is enough of a reason.
- hobbes300 13y ago
  Collision avoidance mostly.
  - rikkus 13y ago
    If an unique identifier is needed, it can still be generated on a short term basis. Make it a GUID and we have generators ready that can do this without risk of collisions.
    - Robin_Message 13y ago
      Not in less than 46 bits, which is all history has given you.
- jws 13y ago
  At the link level, your MAC is your unique address. First: You do not want a MAC collision. I have worked with hardware that sometimes picked a non-unique MAC and your life gets really weird and sucks away a lot of debugging time to find out why impossible things are happening. Continuing – It made ethernet easy to implement. They could have added some complicated address negotiation protocol and then handled address collisions when partitioned networks healed, but it was "olden times" and something that complicated would not have gained traction. Fast forward to Wi-Fi. The reason you have Wi-Fi instead of any number of other wireless ideas that died is because it looks like ethernet so people didn't have to think much about it, so you inherit that baggage. If you really want to change your MAC address then you will want to make sure you aren't going to collide with anyone else. The odds are tiny, but it would be rude to ruin their day. Fortunately, there is a locally administered range of MAC addresses. If your first octet's last digit is 2, 6, a, or e then you are a locally administered unicast address. Assuming your network segment doesn't have an administrator actively handing out local addresses, drop 56 random bits in the remaining octets, cross your fingers, and bring up your network stacks.
  - nwh 13y ago
    > First: You do not want a MAC collision. I have worked with hardware that sometimes picked a non-unique MAC and your life gets really weird and sucks away a lot of debugging time to find out why impossible things are happening. I can confirm. Working with a bunch of Chinese hardware with non-unique MAC addresses is painful. It was easier to buy new NICs with real serial numbers than to work out how to fix them.
  - skywhopper 13y ago
    Wifi drivers could easily deal with this risk by providing specific MAC addresses only to specific networks. So you lock in your home network and work network, but randomize other unknown WAPs. Or better yet, just turn off wifi when you're away from trusted WAPs and use your cellular data.
huhtenberg 13y ago
And how do you feel about Google Analytics?
- albertsun 13y ago
  How do you feel about metaphors with obvious flaws?
  - huhtenberg 13y ago
    I can't see any obvious flaws. In fact, in order to make Density to GA comparison fair former needs to report all its tracking activity to a single source. Then they will be the same both in intent and implementation. Except, of course, for GA being free. I asked original question assuming that you realize direct resemblance between Density and GA. But since you don't, I honestly don't understand how you cannot see it.
    - albertsun 13y ago
      I can see the direct resemblance between tracking the two... What I really don't understand is how you can't see the difference between tracking someone's online activities that they engage in through a web browser and tracking someone's physical location. Those are very different things and they mean very different things in people's lives.
xauronx 13y ago
I'm confused why it's a privacy nightmare. They could just as easily sit someone there and count how many people are in a store and write it down. Your face is an identifier. I don't get why people think that anything technological anymore is instantly privacy nightmare. For an often technological website there is so much technophobia.
- zaroth 13y ago
  The difference is one of precision, scale, and duration. Also in terms of cost, there's a difference between tracking which imposes a marginal human cost of production versus tracking which can be fully automated by machine, even if there is still a per-machine cost. A relevant example is the Supreme Court ruling on needing a warrant for using a GPS tracker on a car versus just tailing them.
- fudged71 13y ago
  The difference is that this is equivalent to having that person follow you to the next business you shop at... and the one after that... and the one after that...

This is a privacy nightmare. Perhaps wifi devices should no longer provide constant MAC addresses....

chrisfarms 13y ago

Or rename "Airplane mode" to "Shopping mode"

teleclimber 13y ago
Seriously. I'm thinking it's time I set up my phone to turn off wifi whenever I am away from home. But would that even be the end of it? With Wifi off the phone is still broadcasting on cellular channels. Could a device be built that listened to those signals and uniquely identify them?

paulgb 13y ago

What's the advantage to a constant MAC address anyway? There must be a reason for it, but my first reaction to this article was to see if I could change mine.

aroch 13y ago
Network's that whitelist devices by MAC and device registration/provisioning by MAC. And debugging network is theoretically easier when every device has a unique MAC. There are several applications for OSX and various *nix distros that run at boot and randomize MACs. SpoofMac is probably the most well known: https://github.com/feross/SpoofMAC https://github.com/feross/SpoofMAC
- MAGZine 13y ago
  This is perfect--I'm definitely going to set this up. I'd just like a background service for my Android device that would also randomize my MAC address... (perhaps it's time to investigate android development :P)
  - paulgb 13y ago
    I'd buy that app :) Unfortunately (from the apps that I've seen) it looks like only a rooted Android could support it.
    - RyanZAG 13y ago
      Yes, definitely rooted only - Linux will block any attempt to change the MAC without root access. That said, I've got a rooted android and change my mac all the time. Especially useful for coffee shops and airports.
jcampbell1 13y ago
You often get reassigned the same ip address. This is nice for things like port forwarding. I am not sure this is enough of a reason.
hobbes300 13y ago
Collision avoidance mostly.
- rikkus 13y ago
  If an unique identifier is needed, it can still be generated on a short term basis. Make it a GUID and we have generators ready that can do this without risk of collisions.
  - Robin_Message 13y ago
    Not in less than 46 bits, which is all history has given you.
jws 13y ago
At the link level, your MAC is your unique address. First: You do not want a MAC collision. I have worked with hardware that sometimes picked a non-unique MAC and your life gets really weird and sucks away a lot of debugging time to find out why impossible things are happening. Continuing – It made ethernet easy to implement. They could have added some complicated address negotiation protocol and then handled address collisions when partitioned networks healed, but it was "olden times" and something that complicated would not have gained traction. Fast forward to Wi-Fi. The reason you have Wi-Fi instead of any number of other wireless ideas that died is because it looks like ethernet so people didn't have to think much about it, so you inherit that baggage. If you really want to change your MAC address then you will want to make sure you aren't going to collide with anyone else. The odds are tiny, but it would be rude to ruin their day. Fortunately, there is a locally administered range of MAC addresses. If your first octet's last digit is 2, 6, a, or e then you are a locally administered unicast address. Assuming your network segment doesn't have an administrator actively handing out local addresses, drop 56 random bits in the remaining octets, cross your fingers, and bring up your network stacks.
- nwh 13y ago
  > First: You do not want a MAC collision. I have worked with hardware that sometimes picked a non-unique MAC and your life gets really weird and sucks away a lot of debugging time to find out why impossible things are happening. I can confirm. Working with a bunch of Chinese hardware with non-unique MAC addresses is painful. It was easier to buy new NICs with real serial numbers than to work out how to fix them.
- skywhopper 13y ago
  Wifi drivers could easily deal with this risk by providing specific MAC addresses only to specific networks. So you lock in your home network and work network, but randomize other unknown WAPs. Or better yet, just turn off wifi when you're away from trusted WAPs and use your cellular data.

huhtenberg 13y ago

And how do you feel about Google Analytics?

albertsun 13y ago
How do you feel about metaphors with obvious flaws?
- huhtenberg 13y ago
  I can't see any obvious flaws. In fact, in order to make Density to GA comparison fair former needs to report all its tracking activity to a single source. Then they will be the same both in intent and implementation. Except, of course, for GA being free. I asked original question assuming that you realize direct resemblance between Density and GA. But since you don't, I honestly don't understand how you cannot see it.
  - albertsun 13y ago
    I can see the direct resemblance between tracking the two... What I really don't understand is how you can't see the difference between tracking someone's online activities that they engage in through a web browser and tracking someone's physical location. Those are very different things and they mean very different things in people's lives.

xauronx 13y ago

I'm confused why it's a privacy nightmare. They could just as easily sit someone there and count how many people are in a store and write it down. Your face is an identifier. I don't get why people think that anything technological anymore is instantly privacy nightmare. For an often technological website there is so much technophobia.

zaroth 13y ago
The difference is one of precision, scale, and duration. Also in terms of cost, there's a difference between tracking which imposes a marginal human cost of production versus tracking which can be fully automated by machine, even if there is still a per-machine cost. A relevant example is the Supreme Court ruling on needing a warrant for using a GPS tracker on a car versus just tailing them.
fudged71 13y ago
The difference is that this is equivalent to having that person follow you to the next business you shop at... and the one after that... and the one after that...