Hacker News Reader

Comment by gkfasdfasdf | Hacker News Reader

Do you have any idea how often they change? Like if you were only looking counts of distinct MAC addresses, could you shorten the listening window so that an individual phone would have the same address?

View on HN

On probe requests this can be very often(< second or within 50 frames), especially in the case of IOS. On Android MAC randomisation is implemented only on a handful of specific devices and some vendors dont at all. Mac randomisation is flawed at the least and can still be used to identify an individual in some cases. The paper below lists techniques explored by the US Navy published in 2017. https://arxiv.org/pdf/1703.02874.pdf

But the nature of Probe Requests make tracking very easy.

It would be interesting to have an exact number of how probable is to have a MAC collision in the wild.

It's 48bits, so a space or around 2.8 million billion possibilities, so you'd need a over a million billion devices to have a 50% chance of collision. _If_ everything was statistically randomly distributed across the entire address space. But they aren't. There's a few kinds of structure in MAC address formats that reduce that but potentially a _lot_...

Theoretical worst care, a MAC address has 24bit of organisation identifier and 24 bits of device identifier. So If an organisation/manufacturer only makes one model of device, they'd "only" need to build ~16.7 million (24bits) of them before they repeated a device identifier (if they chose not to use up any of their organisation bits to reflect that rollover). Again, maybe half that if they just randomly choose a device ID each time instead of enumerate the space.

Practically? Manufacturers screw up...

https://www.raspberrypi.org/forums/viewtopic.php?p=902294

Oooops...

(Also, many Wi-Fi adaptors have easily changeable MAC addresses. Back in the day when cafes used to charge for Wi-Fi access, it wasn't uncommon to sniff the network for a "paid up" MAC address, and either wait til they left and use it, or de-auth them and do a hostile takeover of their paid-for internet access. Apologies to anyone who used to pay for "unreliable" Wi-Fi at Atlas Cafe on Alabama St back in the late 90s/early 2000s...)

The Birthday Problem, as it is known, has sqrt(N) as an approximate answer to get a 50% chance of a clash.

So 16 million devices.

Yep - the chance of any collisions at all, vs the chance of a collision with _your_ specific device/MAC.

That does though drop the chance of any collision at all (aka the birthday paradox) of devices discriminated solely by the 24 bit device identifier down to sort(2^24) which is only 4096. A significantly smaller number than I expected...

I think another question to ask is: do they randomize across all possible MAC addresses, or just within the block of addresses assigned to the type of device. My experience suggests it’s the latter.

Not often at all

Reply on news.ycombinator.com