Comment by jdavis703 | Hacker News Reader

Comment by jdavis703 | Hacker News Reader

Parent Full thread

Seattle uses WiFi MAC addresses to track traffic movements. While the data is currently hashed and anonymized, it wouldn't surprise me if this data is eventually processed and combined with CV technology (specifically license plate readers and facial recognition tech) to provide detailed information on the movements of individuals. From one of their documents:

Acyclica technology collects encrypted media access control (MAC) address information and sends the data to the cloud using their RoadTrend Sensor. This sensor is a proprietary Linux-based device that is discreetly installed inside of traffic control cabinets for SDOT. The devices are Ethernet connected and have a Wi-Fi adapter capturing the MAC addresses of all devices within its range. Using the detection of MAC addresses, Acyclica identifies and differentiates vehicle movement as it approaches, stops and leaves an intersection. When Wi-Fi enabled device comes within range, the sensor generates a one-way hash code from the detected device’s MAC address (using a SHA-256 algorithm). Only the hash codes are transmitted to their cloud server, and there is no way to reverse this process and access addresses of the original devices. From the aggregated data, Acyclica can extract and provide actionable traffic related information to SDOT.

> generates a one-way hash code from the detected device’s MAC address (using a SHA-256 algorithm)

This does not sound truly "no way to reverse" if they are using plain or some simple variants of SHA-256. There are only up to 2^48 possible MAC addresses (way less in practice), which is a very realistic number for rainbow tables.

That said, this might be less relevant quickly as more and more devices are going to use randomized MAC addresses for probing Wi-Fi networks.

Also, (typical) MAC addresses are not random; the upper 24 bits are constrained to a given smaller set of manufacturer codes, so you can reduce the search space considerably.

Unless they purposefully produced hash collisions by truncating the hash, they've just traded one unique identifier for another one. The information they throw away is not very hard to recreate, you just need to discover an individual person again (provided that the MAC hasn't changed), hash it, and now you've got the hash->MAC mapping for that individual, and you can look at their location history.

It's always the race for more and more telemetry that seems to justify an increase in general data collection. Can't we just accept a certain level of blindness/primitiveness?

More specifically I wonder, how has the addition of this collection approach improved whatever it's used for over the previous approach? Is that improvement worth it? Or is it, as is often the case, data for data's sake that makes them feel better about decisions than whether the decisions are actually any better?

"there is no way to reverse this process and access addresses of the original devices"

That doesn't mean you can't abuse this data! If you know a MAC addresses (say of your ex-spouse's cellphone) and the algorithm you can calculate the hash and then use that hash to track their phone.

this is one of the reasons why the wifi button in the ios control center slide-in sheet is so infuriating. at the very least, that button should be tri-mode, so i can turn the wifi radio off rather than just disconnecting from the current wifi ap. otherwise, it leaks location data all over the place.

In this particular case, I believe you don't need to worry too much. iOS (since iOS8, I think?) randomizes WiFI MAC addresses to avoid this kind of tracking.

Android doesn't.

https://source.android.com/devices/tech/connect/wifi-mac-ran...

Very cool! I feel like the behavior that'd match iOS is the developer switch variant, no?

Still happy to be corrected. :)

No. It matches iOS without the developer switch. iOS never use randomized MAC address when joining network.

Using randomized MAC address per SSID may break some well-established authentication scheme base on client MAC address. And it is not marginally stronger than only randomize when scanning, because the randomized MAC address is pinned to ESSID instead of BSSID.

ah yes, i dimly remember hearing about that but forgot. do you know the parameters around this feature? for instance, how often the mac is rotated and what triggers rotation?

It's automatic for every WiFi connection, I believe.

Someone pointed out to me on Twitter that there's probably still more fingerprinting happening behind the scenes here, so worth noting as well.

Enter something like..

>> while true; do rotate_mac_random.sh; done

Running on hundreds of devices with their radios turned up to maximum power.

All this data, but yet most traffic lights don't have sensors and are still on timers.

Source?

http://www.seattle.gov/Documents/Departments/Tech/SDOT%20Acy...

See the original post, it lists all Seattle's current surveillance tech.

Reply on news.ycombinator.com