Slashdot Mirror
Austin Airport Tracks Cell Phones To Measure Security Line Wait
jfruh writes If you get into the TSA security line at Austin-Bergstrom International Airport, you'll see monitors telling you how long your wait will be — and if you have a phone with Wi-Fi enabled, you're helping the airport come up with that number. A system implemented by Cisco tracks the MAC addresses of phones searching for Wi-Fi networks and sees how long it takes those phones to traverse the line, giving a sense of how quickly things are moving. While this is useful information to have, the privacy implications are a bit unsettling.
Modern IOS versions randomize the MAC used for passive wifi scans. I'd imagine android is also doing the same.
While this is useful information to have, the privacy implications are a bit unsettling.
As best I can tell from the description, this sounds similar to what Disney and other themeparks use to track their wait times for rides, except the amusement parks occasionally hand out little RFID "things" to guests at the ride entrance and ask the guest to give it to the operator.
As far as I'm aware, any time you're polling for WiFi networks you're broadcasting your MAC; this just seems like a fairly benign way to get information about a process without getting actual data on an individual.
Granted, you can somewhat reliably tie together a MAC addy's travel path if you have the ability to see all the places that MAC has been, but that was true even without this particular software.
So, yeah, what is the concern about this software in particular? It seems like the complaint is more with how the scanning for networks works.
I disagree. Although i do think my phone should change its mac address regularly so that the tracking is at most session based. They know -a phone- was in line for 30 minutes. They don't know the phone is my phone. And when they see a phone a for 30 minutes next week they won't know its the -same phone-.
Also, just a heads up to those excited about Apple's ios mac randomization -- its proving to be not remotely as good as they led us to believe it would be. (It only sends out a random mac when a) not connected to a network, b) AND asleep.
Any time anything wakes up the phone it probes with its real mac. (So for example, if your on cellular data, and twitter or email or something gets a message to your phone, it wakes up and probes wifi with its real mac...) rendering the feature all but useless. Apparently the fake probes also include your recent SSID list too making them even more useless.
http://www.imore.com/closer-lo...
So... not worse than ios7 ... but not exactly useful either.
And on that note, does anyone recommend a good automatic mac randomizer for android?
MAC address randomization is currently being argued back and forth in IEEE 802.
It breaks many things. It might work randomizing between sessions on a simple LAN, but in the presence of the the 802.1 network features (bridges, vlans, STP, provider bridges etc. etc.) it simply breaks.
It doesn't sit well with the various authentication schemes that mix the MAC address into the security header and key derivation.
It doesn't sit will with MAC based routing entities that are not on the local segment.
People with a deep knowledge of 802 protocols are looking at this and it isn't simple or easy.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.