Comment by kefka | Hacker News Reader

Comment by kefka | Hacker News Reader

Parent Full thread

And one last story regarding the Glass.

Google engineers came to us for a public demonstration. Now, our network has a secure component (WPA2-enterprise) and a non-secure component. However to use either, you need to register the MAC address with our system. Simple. No.

For a company that made Android, and focuses oh so much on security, they dont support WPA2-enterprise. Just doesn't work. So, we were relegated to the unencrypted network. Except, we needed the MAC addresses.

So, how do you get a MAC address on a Glass? You go in to settings and.... Just kidding! You don't get to see what the MAC address is on a Glass. You have to associate it to a AP and then look in the configs to see what MAC it has.

So... Google Engineers gave us a list of their GG mac addresses. Except, they got it wrong. But of course, they gave us this list 30 minutes before the demo.

Eventually, our network didn't work with GG. They ended up buying Aircards from some cell vendor.

That's what I call "Google Quality". No support. Worse than Alpha, except you paid retail 'production quality' for it. Google

Project Tango is also another turd, in the similar light of the GG. Except the 3d driver crashes regularly (every 3-10 minutes of use).

This is obviously an issue with Google Glass, but MAC address filtering is a waste of time. It offers absolutely no protection against a determined adversary. It is a perfect example of security theater.

You're assuming that it is the only defense. It isn't.

We look at security as one would look at an onion.

It makes you cry when you chop it wrong?

Brittle outer layers?

OP is right though. As far as the onion is concerned you better add more characters to the security pass-phrase, also make sure WPS is disabled on all routers etc.

Once someone has determined to break in, even minimally sophisticated they will spoof the mac address. It is good that you want to add extra security, but even as your story shows it just creates confusion, and make using the system harder.

Those decisions come the people in the glass room in the security office. Not much I can do to change global security policy.

I understand, it was more of a comment in general, or maybe the glass room people would stop by and read too ;-)

Do you also never use Padlock or Combination Lock or basic door lock because they also offer "no protection against a determined adversary" ?

Using MAC address filtering on unsecured WiFi is literally like locking your door and then hanging the key on a nice hook outside the door, where anyone can grab it.

The larger point is that if a device is going to work with multiple unknown future security systems (theater or not) it needs to be convenient to do so.

Expecting me to change my security to suit your needs is the height of hubris, when your device is not a necessity.

Nobody is expecting you to change anything. He agrees: your story highlights a problem with GG.

But mac filtering is a pet peeve for many of us. It is worth mentioning, as often as necessary: it's bollocks. Don't do it. Let everyone know that it's useless.

Read that post as if prefaced with: "On a tangent: ..."

Please remember that with, say, a macbook, one can easily monitor traffic between your access points and authorized clients of your wireless network.

From that, is simple to extract the mac address of an authorized client, configure your macbook wireless card with that mac address and join your unencrypted network.

This is why mac filtering is useless on wifi networks.

Why do people need to manually give you their MAC address for a non-secure network? Any "bad actor" could just sniff and copy an approved MAC address, so it does nothing for security. And while it's possible to look up the MAC address on some devices, it's not simple on any of them. This seems more like your shortcoming, not Google's.

Well, for one it would stop employees accidentally connecting to the 'public' wifi and generating support calls when applications which relied on being on the secure/internal network failed to work. Or from devices automatically switching over to the public wifi when they had connection issues with the secured network.

Anyone clever enough to spoof their MAC address is clever enough to not generate a support call in these cases.

Reply on news.ycombinator.com