Slashdot Mirror
Tracking Protection In Wi-Fi Networks Coming Soon To Linux
prisoninmate writes: Fedora contributor and NetworkManager developer Lubomir Rintel explains how your devices are being identified on a network by a unique number that most of us know by the name of MAC address. Same goes for mobile networking, as your laptop's or mobile phone's MAC address is, in most cases, broadcasted everywhere you go before you even attempt a connection to a wireless network. And that's a problem for your privacy. The solution? Randomization of the MAC address while scanning for Wi-Fi networks. Apple is already using this method on iOS 8 and later mobile operating systems, and so is Microsoft in Windows 10, so Linux users will ["likely"] get it in the upcoming NetworkManager 1.2 release.
terrorrists... we're all suspects now?
My ancient pocket dino (a Nokia N900) has had this feature for ages. And yes, it runs Linux.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Please don't. My company is building tools that help businesses understand their customers through WiFi. We're having to waste a lot of time building heuristics that determine whose MAC switched when they blip off and a new one randomly appears. We're barely off the ground with this stuff, now we're probably going to have to build new heuristics for Android devices.
I will say that the good part of this is the product managers now understand we can't track real people, which was never our intent, but was possible given the long-lived nature of MACs. I just wish they'd randomize in the middle of the night when charging.
What do we gain, what makes it worth our while to let others track us?
what is happend here?
This will mess with DHCP reservation
Also, how can I randomise on Windows?
I think the best way to randomise is to use randomisation on a separate USB dongle if you are conerned, on your private subnets you want a MAC stable for DHCP reservation.
Because systemd sucks.
I want random MAC for public use, but stable mac for my own private subnet.
We need the best of both worlds.
I use DHCP reservation on my private subnet. I wish to use public wifi but random mac's, to solve this, I would like to use a USB nano dongle, and then randomise that mac, and for my private use I can use the built in PCIE MAC thats stable.
That is not how random MAC scanning works. The scanning is done with a random MAC, but actual traffic uses the real hardware MAC. Your MAC address based authentication is unaffected.
Real random MAC on public networks has not been implemented by any OS yet, AFAIK.
Finally! A year of moderation! Ready for 2019?
So, basically a useless feature.
I want periodic (every connection) to be a new RANDOM MAC on a specific adapter and SSID network.
I want it on Windows 7 and Linux.
I can't imagine it would be either. The consequense for DCHP on IPv4 would be not great to say the least.
I would see address pool exhaustion, the concept reservations breaking entirely, any hardware based options variability failing (IE send the right pixie boot server for the device class) all becoming a total mess.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Damn slashdot and its lack of edit, that should be DHCP
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
No, it's not at all useless. It may not be exactly as useful as YOU want, but it's absolutely useful.
Pretend your MAC address is some number, that I'll call Larry. Without this, just walking through an area can result in your machine saying "Larry here, what networks are around?" With this, every time he asks, he'll say "$RANDOM_NAME here, what networks are around?" This is good design, because you shouldn't have to leak information like a MAC just to see what's going on.
Now pretend you want to connect, and you connect as Larry. That's fine for most people, but you want more- you want your address to connect differently each time. This is much more niche, but you CAN do it- there are hardware MAC address changers, after all, and you could automate one in Linux. Not quite sure in Windows how to do it automatically, but I'm sure you could.
I think your idea is good too, btw- but it's nowhere near as important as the one that gives your info away to networks you aren't even trying to connect to.
Use ifconfig:
ifconfig eth0 hw ether
Its had this option for years. I presume it'll work for the wlan0 device though I've never tried it.
Depends, some access points will not send the probe reply to an unauthorized MAC, then it will indeed not work.
Most of those problems would be non-issues on public Wifi, as long as the MAC address doesn't change more often than say once an hour.
If you are TFTP-booting on Starbucks Wifi you deserve what you get.
Finally! A year of moderation! Ready for 2019?
You know what to do.
Real random MAC on public networks has not been implemented by any OS yet, AFAIK.
Works on Linux. man ifconfig, or tl;dr: 'ifconfig wlan0 hw ether $(generate_random_MAC.sh) && dhclient '
1 - Don't connect automatically.
2 - Have a button that generates a random MAC. Don't use it at home.
With this in the news though, they will just move to fingerprinting, which is harder for me to fake. I guess I will start by setting my user strings to say I am Windows XP with Internet Explorer 8 (I am actually Linux and Firefox). By the time they figure out that is not true, I will be gone.
I have always turned off my wifi when not at home (Android and Win Phone/Mobile - plenty of data allowance for my usage patterns on the plans I've had).
You can already do it on Linux
ifconfig wlan0 hw ether 00:11:22:33:44:55
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Linux users already have this. Systemd users will have it soon. Rehashing previous functionality, selling it as a compelling advantage over what came before.
boo systemd, boo
Just won't work.
Mostly due to java creep in browsers - https://panopticlick.eff.org/
If you want to get unwarranted attention - randomly flip your MACs - makes you look like a spook.
What we really need is a browser that looks very common via finger-print - the page is not shown - only an OCR document created from the page with links that have tracking information removed. Once the OCR doc is created the instance of the browser is removed.
I really miss web sites that don't use java..
my problem with this is
1 what happens when multiple orgs want to be LAST in the chain
2 an SSID only has 32 characters to begin with so if you need to use a few tags you land up with
mine_eatfresh_fred_optout_nomap as your ssid
I support the idea, but please make it optional for those of us who have reasons not to want to do it. One example of why you might not want to do this: if you restrict MAC addresses on your home wifi, this will break it.
If you want to keep your privacy, you'd better employ passive scanning. Avoids any MAC transmission at all and saves some power while disconnected.
Link in Wi-fi.org
Screw NetworkManager, its broken anyways and wpa_supplicant can already do everything one might want there:
Add 'mac_addr=1' and 'preassoc_mac_addr=1' to your /etc/wpa_supplicant.conf. Then your MAC-address will be randomized during the Scanning/Preassociation phase and afterwards.
For networks that need a static MAC address for filtering, add 'mac_addr=0' in the appropriate 'network' section. You also want to make sure you are using 'dhcpcd' instead of 'dhclient' (alias isc-dhcp-client). The latter can't deal with changing MAC addresses, it seems.
The summary was maybe bit misleading
This is not actually abput changing your MAC address, but using a different algorithm for IPv6 StateLess Address Auto Configuration than the EUI-64 method (which is "ef80${MAC}").
This doesn't impact IPv4 DHCP or AP MAC address filters at all, and if your routers are configured to send the right eouter advertisements in response to IPv6 router solicitation, will have no impact on DHCPv6.
You can already do this in linux via macchanger
BTDT. I have been randomizing my mac address in Linux for years.
We were a lot more private when there were open access points that didn't have security enabled. If you want to allow truly anonymous a communication, letting random people access the internet with no paper trail (logs) is the only way that it will work.
But, 10 years ago, the tech community shunned the freeloaders and people connecting to unsecure wifi. They had it all locked down, and now they are complaining about the tracking problem they created.
Per connection randomised MAC per physical/SSID/adapter is what we need to have true control.
Can somebody hack up a Windows 7 and Linux tool for this? I think we need that even more than scanning. I currently use a "disposable" USB nano adapter for places I don't want my machine MAC addresses used, sometimes I sit behind a pocket router to mask all my interfaces.
Just Don't use de:ad:be:ef:00 because that's my random address.
Er wait...
SJW n. One who posts facts.
Open Sores playing catch-up again.
Already works fine on Linux. Especially useful for places that have "1 hour free wifi", based on MAC address.
for over a year and a half now!
What is more, both products also work on BSDs with GTK+ and Qt front ends.
Who needs this NetworkManager anyway?
Yes, you can implement it yourself quite easily on Linux for a 90% solution. Once you want notifications to the DHCP client, periodic changes of MAC address, selection of which networks to keep the factory MAC address on, and so forth, it is not so simple.
Finally! A year of moderation! Ready for 2019?
I don't like being tracked, so I randomize my MAC with Pry-Fi. If you would be so kind to tell us who you work for, we can all enable the "Go to war!" mode to flood you with bogus MACs. Game?
As someone who has modeled pedestrian traffic, specifically for retail outlets - including stores. Well, you get things optimized and more easily found. Of course, you're rooted through the store like cattle. Ever notice how almost everyone goes in the same direction and the people who don't go the "right" way get ugly looks. There's a reason for that but, alas, I'm too ill to explain it and, frankly, I don't like you that much.
Hmm... They said this Prednizone (sp) would make me grumpy. They're right. So, seeing as I have a perfectly fine excuse - fuck you. (Don't take it personal.)
"So long and thanks for all the fish."
TAILS