7 ms·

And one last story regarding the Glass. Google engineers came to us for a public demonstration. Now, our network has a secure component (WPA2-enterprise) and a

by kefka 12y ago

And one last story regarding the Glass. Google engineers came to us for a public demonstration. Now, our network has a secure component (WPA2-enterprise) and a non-secure component. However to use either, you need to register the MAC address with our system. Simple. No. For a company that made Android, and focuses oh so much on security, they dont support WPA2-enterprise. Just doesn't work. So, we were relegated to the unencrypted network. Except, we needed the MAC addresses. So, how do you get a MAC address on a Glass? You go in to settings and.... Just kidding! You don't get to see what the MAC address is on a Glass. You have to associate it to a AP and then look in the configs to see what MAC it has. So... Google Engineers gave us a list of their GG mac addresses. Except, they got it wrong. But of course, they gave us this list 30 minutes before the demo. Eventually, our network didn't work with GG. They ended up buying Aircards from some cell vendor. That's what I call "Google Quality". No support. Worse than Alpha, except you paid retail 'production quality' for it. Google Project Tango is also another turd, in the similar light of the GG. Except the 3d driver crashes regularly (every 3-10 minutes of use).

dublinben 12y ago
This is obviously an issue with Google Glass, but MAC address filtering is a waste of time. It offers absolutely no protection against a determined adversary. It is a perfect example of security theater.
- kefka 12y ago
  You're assuming that it is the only defense. It isn't. We look at security as one would look at an onion.
  - lfowles 12y ago
    It makes you cry when you chop it wrong? Brittle outer layers?
  - rdtsc 12y ago
    OP is right though. As far as the onion is concerned you better add more characters to the security pass-phrase, also make sure WPS is disabled on all routers etc. Once someone has determined to break in, even minimally sophisticated they will spoof the mac address. It is good that you want to add extra security, but even as your story shows it just creates confusion, and make using the system harder.
    - kefka 12y ago
      Those decisions come the people in the glass room in the security office. Not much I can do to change global security policy.
      - rdtsc 12y ago
        I understand, it was more of a comment in general, or maybe the glass room people would stop by and read too ;-)
- abhigupta 12y ago
  Do you also never use Padlock or Combination Lock or basic door lock because they also offer "no protection against a determined adversary" ?
  - snowwrestler 12y ago
    Using MAC address filtering on unsecured WiFi is literally like locking your door and then hanging the key on a nice hook outside the door, where anyone can grab it.
- drivingmenuts 12y ago
  The larger point is that if a device is going to work with multiple unknown future security systems (theater or not) it needs to be convenient to do so. Expecting me to change my security to suit your needs is the height of hubris, when your device is not a necessity.
  - nothrabannosir 12y ago
    Nobody is expecting you to change anything. He agrees: your story highlights a problem with GG. But mac filtering is a pet peeve for many of us. It is worth mentioning, as often as necessary: it's bollocks. Don't do it. Let everyone know that it's useless. Read that post as if prefaced with: "On a tangent: ..."
- motoboi 12y ago
  Please remember that with, say, a macbook, one can easily monitor traffic between your access points and authorized clients of your wireless network. From that, is simple to extract the mac address of an authorized client, configure your macbook wireless card with that mac address and join your unencrypted network. This is why mac filtering is useless on wifi networks.
snowwrestler 12y ago
Why do people need to manually give you their MAC address for a non-secure network? Any "bad actor" could just sniff and copy an approved MAC address, so it does nothing for security. And while it's possible to look up the MAC address on some devices, it's not simple on any of them. This seems more like your shortcoming, not Google's.
- nucleardog 12y ago
  Well, for one it would stop employees accidentally connecting to the 'public' wifi and generating support calls when applications which relied on being on the secure/internal network failed to work. Or from devices automatically switching over to the public wifi when they had connection issues with the secured network. Anyone clever enough to spoof their MAC address is clever enough to not generate a support call in these cases.
deleted 12y ago
[deleted]

by kefka 12y ago

dublinben 12y ago

This is obviously an issue with Google Glass, but MAC address filtering is a waste of time. It offers absolutely no protection against a determined adversary. It is a perfect example of security theater.

kefka 12y ago
You're assuming that it is the only defense. It isn't. We look at security as one would look at an onion.
- lfowles 12y ago
  It makes you cry when you chop it wrong? Brittle outer layers?
- rdtsc 12y ago
  OP is right though. As far as the onion is concerned you better add more characters to the security pass-phrase, also make sure WPS is disabled on all routers etc. Once someone has determined to break in, even minimally sophisticated they will spoof the mac address. It is good that you want to add extra security, but even as your story shows it just creates confusion, and make using the system harder.
  - kefka 12y ago
    Those decisions come the people in the glass room in the security office. Not much I can do to change global security policy.
    - rdtsc 12y ago
      I understand, it was more of a comment in general, or maybe the glass room people would stop by and read too ;-)
abhigupta 12y ago
Do you also never use Padlock or Combination Lock or basic door lock because they also offer "no protection against a determined adversary" ?
- snowwrestler 12y ago
  Using MAC address filtering on unsecured WiFi is literally like locking your door and then hanging the key on a nice hook outside the door, where anyone can grab it.
drivingmenuts 12y ago
The larger point is that if a device is going to work with multiple unknown future security systems (theater or not) it needs to be convenient to do so. Expecting me to change my security to suit your needs is the height of hubris, when your device is not a necessity.
- nothrabannosir 12y ago
  Nobody is expecting you to change anything. He agrees: your story highlights a problem with GG. But mac filtering is a pet peeve for many of us. It is worth mentioning, as often as necessary: it's bollocks. Don't do it. Let everyone know that it's useless. Read that post as if prefaced with: "On a tangent: ..."
motoboi 12y ago
Please remember that with, say, a macbook, one can easily monitor traffic between your access points and authorized clients of your wireless network. From that, is simple to extract the mac address of an authorized client, configure your macbook wireless card with that mac address and join your unencrypted network. This is why mac filtering is useless on wifi networks.

snowwrestler 12y ago

Why do people need to manually give you their MAC address for a non-secure network? Any "bad actor" could just sniff and copy an approved MAC address, so it does nothing for security. And while it's possible to look up the MAC address on some devices, it's not simple on any of them. This seems more like your shortcoming, not Google's.

nucleardog 12y ago
Well, for one it would stop employees accidentally connecting to the 'public' wifi and generating support calls when applications which relied on being on the secure/internal network failed to work. Or from devices automatically switching over to the public wifi when they had connection issues with the secured network. Anyone clever enough to spoof their MAC address is clever enough to not generate a support call in these cases.

deleted 12y ago

[deleted]