Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS 8 randomises the MAC address while scanning for WiFi networks

twitter.com

Post reply on HN
Print view View original

151–160 of 264 posts

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#151

Post by MichaelGG »

cmelbye wrote: post #143
AnthonyMouse wrote: post #97

Earlier quoted context omitted.

> The MAC address is stable once a device is authenticated (connected) to the network. That is necessary to keep the gateway from having to issue a thousand ARP requests (one for every packet you send from a different MAC), but there is no reason why the MAC chosen to connect to the network couldn't change every time you disconnect and reconnect. That would at least prevent you from being tracked between visits to th…

MAC collisions?

It's a 48-bit space, so you'd need around 16M people connected with random IDs to have a high chance of collision.

Even by sticking to a certain subsets of OUIs, it's still probably fine. On top of that, listening to traffic (even after picking an in-use MAC) would allow you to determine if someone else is using that address.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#152

Post by yuubi »

maguirre wrote: post #130
yuubi wrote: post #23

Earlier quoted context omitted.

Globally administered MAC address ranges are assigned to manufacturers. The slide said "random, "locally* administered" addresses, which aren't assigned that way. There's a bit in the first octet to distinguish them; see https://en.wikipedia.org/wiki/Ethernet_address#Address_detai... .

excuse my ignorance but does that mean if one is to use a locally administered address a device is free to take whatever they please? What would be advantage of paying to the IEEE for a universally administered block?

> does that mean if one is to use a locally administered address a device is free to take whatever they please?

I think those have traditionally been set by network admins, not randomly chosen by devices, but pretty much: nobody apart from local admin coordinates addresses with the local bit set.

> What would be advantage of paying to the IEEE for a universally administered block?

The promise that no device built by other legit companies will have an address from that assigned block, so customers won't have to worry about MAC address conflicts, provided they use only widgets from those who honor the assignment scheme.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#153

Post by elarkin »

userbinator wrote: post #134
brunnsbe wrote: post #6

If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.

It's disturbingly creepy to think that stores would even think of doing this, but on the other hand it's also an indication of how clueless the general population is about the amount of identifiable data they're unconsciously "leaking" through personal, (nearly) always-on devices. My laptop is setup with a random MAC precisely to prevent this sort of tracking. Interestingly, the unbranded Android phones I have (one l…

Without being too specific, you should assume that Large stores already do this. Any store claiming to have "in store wifi" is almost guaranteed to be tracking you through your mac address.

The system that I'm familiar with only tracks where you're going. It didn't (as of a couple months ago) have any way of linking your mac back to a consumer profile.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#154

Post by Nikker »

userbinator wrote: post #134
brunnsbe wrote: post #6

If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.

It's disturbingly creepy to think that stores would even think of doing this, but on the other hand it's also an indication of how clueless the general population is about the amount of identifiable data they're unconsciously "leaking" through personal, (nearly) always-on devices. My laptop is setup with a random MAC precisely to prevent this sort of tracking. Interestingly, the unbranded Android phones I have (one l…

Now that the MACs are random does that really solve the problem? A probe request sends out the real MAC of the AP it's looking for as well as the AP ESSID. By using anyone of many translators you can get a map of each ESSID with GPS co-ordinates. While many people will be probing for Starbucks and McDonalds they will always have a unique probe for their own home AP. So now there is no "neat" way of using the MAC as a primary key you can still infer the user by the AP least in common with anyone else, i.e. which probes are NOT McDonalds et al.

So if my home AP ESSID is Einstein, MAC=deadbeef every time I enter a store my home AP MAC is still being recorded as well as the relative movement throughout the store. As well inter-relational data could be inferred by other AP MAC addresses if I visit a friend or family member it's likely that probe will connect us.

TL;DR Relations are based on unique data just because some of the data is 'scrambled' it's reliance on static data is it's weakness.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#155

Post by eli »

dag11 wrote: post #85
eli wrote: post #80

Earlier quoted context omitted.

Are retail stores actually using cell phones to track people at the individual level? I mean, I know the technology exists and all, but it just doesn't seem like it'd actually be all that useful to the stores. My guess is that the stores that are using this tech are mostly concerned about how long the average person has to wait in the checkout line, not whether Joe Blow is was in the store.

Large stores use it to positionally track unique customers. They can analyze the paths they take and ultimately what they buy. This is powerful because the can optimize the layout of their stores to maximize sales based on hard data. This will now become much more difficult to do.

I'm genuinely curious: is there data on how many or which retailers do this?

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#156

Post by tks2103 »

userbinator wrote: post #134
brunnsbe wrote: post #6

If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.

It's disturbingly creepy to think that stores would even think of doing this, but on the other hand it's also an indication of how clueless the general population is about the amount of identifiable data they're unconsciously "leaking" through personal, (nearly) always-on devices. My laptop is setup with a random MAC precisely to prevent this sort of tracking. Interestingly, the unbranded Android phones I have (one l…

It's pretty reasonable to expect a store would think of tracking a customer's path through the store. Websites do that all the time.

In addition, if we find a good way to provide information to the store owner about how his or her store is being browsed and used, it is likely that stores will provide better shopping experiences.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#157

Post by akira2501 »

sliverstorm wrote: post #118
akira2501 wrote: post #113

Earlier quoted context omitted.

Serious question: are you sure you'd actually be happier? I like efficiency as much as the next guy, but that doesn't mean that I'm looking forward to companies more efficiently marketing to me. Especially if it's going to be constant.

I have already started to notice ads targeted at me. Ads for niche outdoor gear companies that I patronize. I can report that it has indeed made me happier, as compared to when the ads were "Click here, Millionth visitor, and win a prize!". The dragnet advertising is a constant assault on your intelligence. It also helps that the targeted ads I am seeing are tasteful & well designed. I adblock 90%+ of the time, but I…

It can go both ways. When I was researching for the next car I was going to buy, I started getting a _ton_ of car advertisements; however, most of them were useless. What their simple algorithm failed to notice is that I was looking at a very specific class of cars, and I spent more than 1 hour on several manufacturers websites doing research and had mostly narrowed in on my choice. The proper move would be to see that and advertise different dealerships to me, but I only got ads for other cars that I already decided I _didn't_ want.

Also, I like to research, in general. Which means I can often come across and get deeply into some very odd subjects and it seems there are some odd correlations out there in society. For example, after doing a bunch of research on different world religions and their origin stories, I started getting ads for the Mormon church, and strangely, for all types of gambling websites, destinations and attractions. None of this advertising was of any use.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#158

Post by eli »

yuubi wrote: post #152
maguirre wrote: post #130

Earlier quoted context omitted.

excuse my ignorance but does that mean if one is to use a locally administered address a device is free to take whatever they please? What would be advantage of paying to the IEEE for a universally administered block?

> does that mean if one is to use a locally administered address a device is free to take whatever they please? I think those have traditionally been set by network admins, not randomly chosen by devices, but pretty much: nobody apart from local admin coordinates addresses with the local bit set. > What would be advantage of paying to the IEEE for a universally administered block? The promise that no device built by…

Legit devices have had duplicate Mac addresses even though they're not supposed to. In practice a totally random MAC is probably safer than the one assigned to a cheap network card.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#159

Post by 2muchcoffeeman »

DanBC wrote: post #70
shurcooL wrote: post #63

Earlier quoted context omitted.

> Why should I have my movements tracked in a store when I'm not using the resources offered by them? To answer your question directly, one of the advantages could be that they can optimize the store layout better so you don't have to walk as much to find what you want. (There are other disadvantages and advantages, by listing one of them I don't exclude the existence of others, but I can't cover everything.)

> one of the advantages could be that they can optimize the store layout better so you don't have to walk as much to find what you want. But stores do not want to do that. Stores know you want a pint of milk and loaf of bread. They put these two items far apart which means you need to walk past all that other stuff, this increasing the chance you'll buy something else. Tracking technology isn't going to ne used to ma…

Depends what you're selling. A grocery store is like that since they operate on razor thin margins and making you impulse buy is how they are going to make more money.

An Apple store is not laid out like that. I always see the big ticket items upfront and the accessories in the back. Most people don't impulse buy things that expensive.

Re: iOS 8 randomises the MAC address while scanning for WiFi networks

#160

Post by reddit_clone »

userbinator wrote: post #134
brunnsbe wrote: post #6

If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.

It's disturbingly creepy to think that stores would even think of doing this, but on the other hand it's also an indication of how clueless the general population is about the amount of identifiable data they're unconsciously "leaking" through personal, (nearly) always-on devices. My laptop is setup with a random MAC precisely to prevent this sort of tracking. Interestingly, the unbranded Android phones I have (one l…

>bit on the paranoid side Not at all. Probably saves battery too.
Post reply on HN