Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS 8 randomises the MAC address while scanning for WiFi networks

twitter.com

Post reply on HN
Print view View original

71–80 of 264 posts

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#71

Post by i_am_ralpht »

Many Bluetooth LE devices (including iOS 7) do something similar -- otherwise you'd be able to track people by all of their BT LE devices which are constantly advertising their existence. They cycle their advertised MAC addresses every 15 minutes or so (and some provide a "random resolvable address" which you can use to find out the physical BT MAC address after pairing for easier reconnection).

From my office in downtown Los Altos, I can currently see a FitBit Flex, a FitBit One and a couple of phones -- the randomized MAC address is all that prevents someone bad from tracking them (BTLE scanners/phones are cheap!).

I guess you could still use the 15 minute MAC to track people through a train station or other semi-public space (to gather metrics on where people are coming from and going to). If you had a lot of antennas then you could circumvent the MAC cycling by linking devices in the same area with the same name and similar RSSI...

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#72

Post by abalone »

hatsix wrote: post #43
IBM wrote: post #37

It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple.

> It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple. Yes, Apple certainly wouldn't develop/release a product whose sole purpose is to track user's physical presence, with the primary use point being able to sell the…

No, you misunderstand iBeacon. The sole purpose of iBeacon is to let handsets detect it, not the other way around.

In order to for it to be used to track users, the user would have to run an app that detects the beacon and then communicates back to the business. In other words, the user has to opt in to tracking.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#73

Post by jmgrosen »

nitrogen wrote: post #62
wikyd wrote: post #58

Earlier quoted context omitted.

The difference is that for iBeacon to track devices the user has to download an app related to the beacons and give permission. MAC address tracking happens without the user giving consent.

Is it not possible to track devices based on their Bluetooth MAC?

If you have discoverable mode on, sure. But typically that's specifically user-activated and only lasts for a couple of minutes.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#74

Post by mstolpm »

shurcooL wrote: post #63
Spooky23 wrote: post #48

Earlier quoted context omitted.

Why should I have my movements tracked in a store when I'm not using the resources offered by them? They should feel lucky to have me in their store and provide service, not Orwellian surveillance. My other beef here is that this is just another way to further dumb down and make retail employment completely mindless.

> Why should I have my movements tracked in a store when I'm not using the resources offered by them? To answer your question directly, one of the advantages could be that they can optimize the store layout better so you don't have to walk as much to find what you want. (There are other disadvantages and advantages, by listing one of them I don't exclude the existence of others, but I can't cover everything.)

If the store owner has to choose between using the data to make more profit or to enhance customer value, he'll likely choose the first option. You're not supposed to find the cheapest product easily, but that which provides the best profit ratio for the store owner. So, store layout will change in a way to manipulate your buying decision and you will not even notice the reason for the gradual change.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#75

Post by 7952 »

mikeash wrote: post #54
praseodym wrote: post #32

Earlier quoted context omitted.

The MAC address is stable once a device is authenticated (connected) to the network. With the trend of providing 'free' wifi access within stores, making sure that users connect to that network is enough to continue tracking them.

How will you make sure of that, though? Only a tiny fraction of smartphone users will bother to connect to your wifi, and it'll be a skewed sample.

But the device is still visible on wifi even if it does not connect. Some phones tend will try to connect to known networks pro-actively and will leak the SSID of those networks.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#77

Post by JackC »

shaggyfrog wrote: post #19
pmorici wrote: post #7

Earlier quoted context omitted.

What stops them from switching to tracking via the hardware address of the cellular radio?

You can only get that kind of information (e.g. IMEI) if you use IOKit, and you can't submit to the App Store if your app uses IOKit if you're not a part of the MFi (Made for iOS) program, i.e. a hardware manufacturer. Edit: I'm really getting confused with downvoting on HN. How exactly is this comment poor?

I'm pretty sure the post you're replying to isn't talking about an iOS app, so IOKit doesn't have anything to do with it. They're saying that a store could install their own cell antenna to listen to nearby cell phones, record unique identifiers, and track customers that way. Apple is anonymizing MAC addresses to stop a similar form of tracking, but it won't work if there are other radio signals they can't anonymize.

Apologies if you knew that and I'm just not understanding your point.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#78

Post by AllenKids »

nitrogen wrote: post #62
wikyd wrote: post #58

Earlier quoted context omitted.

The difference is that for iBeacon to track devices the user has to download an app related to the beacons and give permission. MAC address tracking happens without the user giving consent.

Is it not possible to track devices based on their Bluetooth MAC?

if I recall correctly, Apple's Bluetooth BLE UUID is also randomized while in broadcasting mode.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#79

Post by jwr »

JumpCrisscross wrote: post #47
IBM wrote: post #37

It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple.

The FT brought up a similar contrast two weeks ago when discussing Apple and Google's smart home strategies. They speculated that Apple is likely "to emphasise the privacy protections built into its smart home system... Apple considers privacy a key advantage over Google...since Google relies on targeted advertising as its main source of income" [1]. This will be an interesting competition. Google, for openness and t…

> Google, for openness and transparency

I'm not entirely sure what you mean — that Google openly and transparently tracks user behaviors so that they can make money on targeted advertising?

If you try to compare the two companies, I'd say the difference is that Apple charges you a premium for their devices (thus making money), while Google gathers data about you so that it can be sold to advertisers (thus making money). Theoretically, each company could do both, but recently Apple started differentiating itself by actually emphasizing privacy and limiting access to data about users, in many places.

I do agree that it will be interesting, though.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#80

Post by eli »

brunnsbe wrote: post #6

If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.

Are retail stores actually using cell phones to track people at the individual level? I mean, I know the technology exists and all, but it just doesn't seem like it'd actually be all that useful to the stores.

My guess is that the stores that are using this tech are mostly concerned about how long the average person has to wait in the checkout line, not whether Joe Blow is was in the store.

Post reply on HN