Slashdot Mirror
Tracking Protection In Wi-Fi Networks Coming Soon To Linux
prisoninmate writes: Fedora contributor and NetworkManager developer Lubomir Rintel explains how your devices are being identified on a network by a unique number that most of us know by the name of MAC address. Same goes for mobile networking, as your laptop's or mobile phone's MAC address is, in most cases, broadcasted everywhere you go before you even attempt a connection to a wireless network. And that's a problem for your privacy. The solution? Randomization of the MAC address while scanning for Wi-Fi networks. Apple is already using this method on iOS 8 and later mobile operating systems, and so is Microsoft in Windows 10, so Linux users will ["likely"] get it in the upcoming NetworkManager 1.2 release.
Please don't. My company is building tools that help businesses understand their customers through WiFi. We're having to waste a lot of time building heuristics that determine whose MAC switched when they blip off and a new one randomly appears. We're barely off the ground with this stuff, now we're probably going to have to build new heuristics for Android devices.
I will say that the good part of this is the product managers now understand we can't track real people, which was never our intent, but was possible given the long-lived nature of MACs. I just wish they'd randomize in the middle of the night when charging.
What do we gain, what makes it worth our while to let others track us?
what is happend here?
Because systemd sucks.
This is automatically done when scanning for WiFi access points, which your phone or laptop or whatever is probably doing constantly. When you connect you use whatever MAC rules you normally have.
This is about not advertising your real MAC address to APs you have no intention of connecting to, so third parties (NSA and friends) cant scatter a bunch of APs around town to track your movements.
The solution? Randomization of the MAC address while scanning for Wi-Fi networks
Scanning only. It uses the real MAC address when connecting to a network.
That is not how random MAC scanning works. The scanning is done with a random MAC, but actual traffic uses the real hardware MAC. Your MAC address based authentication is unaffected.
Real random MAC on public networks has not been implemented by any OS yet, AFAIK.
Finally! A year of moderation! Ready for 2019?
I can't imagine it would be either. The consequense for DCHP on IPv4 would be not great to say the least.
I would see address pool exhaustion, the concept reservations breaking entirely, any hardware based options variability failing (IE send the right pixie boot server for the device class) all becoming a total mess.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Damn slashdot and its lack of edit, that should be DHCP
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
No, it's not at all useless. It may not be exactly as useful as YOU want, but it's absolutely useful.
Pretend your MAC address is some number, that I'll call Larry. Without this, just walking through an area can result in your machine saying "Larry here, what networks are around?" With this, every time he asks, he'll say "$RANDOM_NAME here, what networks are around?" This is good design, because you shouldn't have to leak information like a MAC just to see what's going on.
Now pretend you want to connect, and you connect as Larry. That's fine for most people, but you want more- you want your address to connect differently each time. This is much more niche, but you CAN do it- there are hardware MAC address changers, after all, and you could automate one in Linux. Not quite sure in Windows how to do it automatically, but I'm sure you could.
I think your idea is good too, btw- but it's nowhere near as important as the one that gives your info away to networks you aren't even trying to connect to.
Use ifconfig:
ifconfig eth0 hw ether
Its had this option for years. I presume it'll work for the wlan0 device though I've never tried it.
Most of those problems would be non-issues on public Wifi, as long as the MAC address doesn't change more often than say once an hour.
If you are TFTP-booting on Starbucks Wifi you deserve what you get.
Finally! A year of moderation! Ready for 2019?
You can already do it on Linux
ifconfig wlan0 hw ether 00:11:22:33:44:55
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Just won't work.
Mostly due to java creep in browsers - https://panopticlick.eff.org/
If you want to get unwarranted attention - randomly flip your MACs - makes you look like a spook.
What we really need is a browser that looks very common via finger-print - the page is not shown - only an OCR document created from the page with links that have tracking information removed. Once the OCR doc is created the instance of the browser is removed.
I really miss web sites that don't use java..
my problem with this is
1 what happens when multiple orgs want to be LAST in the chain
2 an SSID only has 32 characters to begin with so if you need to use a few tags you land up with
mine_eatfresh_fred_optout_nomap as your ssid
I support the idea, but please make it optional for those of us who have reasons not to want to do it. One example of why you might not want to do this: if you restrict MAC addresses on your home wifi, this will break it.
If you want to keep your privacy, you'd better employ passive scanning. Avoids any MAC transmission at all and saves some power while disconnected.
Link in Wi-fi.org
Screw NetworkManager, its broken anyways and wpa_supplicant can already do everything one might want there:
Add 'mac_addr=1' and 'preassoc_mac_addr=1' to your /etc/wpa_supplicant.conf. Then your MAC-address will be randomized during the Scanning/Preassociation phase and afterwards.
For networks that need a static MAC address for filtering, add 'mac_addr=0' in the appropriate 'network' section. You also want to make sure you are using 'dhcpcd' instead of 'dhclient' (alias isc-dhcp-client). The latter can't deal with changing MAC addresses, it seems.
The summary was maybe bit misleading
This is not actually abput changing your MAC address, but using a different algorithm for IPv6 StateLess Address Auto Configuration than the EUI-64 method (which is "ef80${MAC}").
This doesn't impact IPv4 DHCP or AP MAC address filters at all, and if your routers are configured to send the right eouter advertisements in response to IPv6 router solicitation, will have no impact on DHCPv6.
Just Don't use de:ad:be:ef:00 because that's my random address.
Er wait...
SJW n. One who posts facts.
Yes, you can implement it yourself quite easily on Linux for a 90% solution. Once you want notifications to the DHCP client, periodic changes of MAC address, selection of which networks to keep the factory MAC address on, and so forth, it is not so simple.
Finally! A year of moderation! Ready for 2019?
I don't like being tracked, so I randomize my MAC with Pry-Fi. If you would be so kind to tell us who you work for, we can all enable the "Go to war!" mode to flood you with bogus MACs. Game?
As someone who has modeled pedestrian traffic, specifically for retail outlets - including stores. Well, you get things optimized and more easily found. Of course, you're rooted through the store like cattle. Ever notice how almost everyone goes in the same direction and the people who don't go the "right" way get ugly looks. There's a reason for that but, alas, I'm too ill to explain it and, frankly, I don't like you that much.
Hmm... They said this Prednizone (sp) would make me grumpy. They're right. So, seeing as I have a perfectly fine excuse - fuck you. (Don't take it personal.)
"So long and thanks for all the fish."
Scanning only. It uses the real MAC address when connecting to a network.
No need for that on a public network, is there?
If this is a known network, connect using a 'real' MAC address. (Which doesn't need to be the hardware one, it just needs to be constant, so static IP assignment works). If this is an unknown network, just use a random MAC address - or else they'll track you.
When adding a network to your known list, it could give you the option to use the 'real' address, or continue to use a fake one.
It's all moot, really. This would require a Linux laptop to have a working wifi driver.