Is this cause android and apple have it and there could be a case where an authentication issue would arise due to having the same MAC as another device?
Not sure why tails is so late in the game to implement full spoofing of the mac yet?
Agreed. I’d like to hear the reason too.
This would clear up some tracking concerns more but IIRC I think the reason is issues with certain wifi cards or support from certain wifi drivers causing spoofing failure.
Understandable. However, this should be an option on the Tails menu where you’re able to disable/enable things. A clear warning/information about the spoofing should suffice.
Why does Tails not spoof full Mac Address?
The current is a deliberate design trade off between anonymity and network compatibility.
Mac Address consists of two parts in the address: [OUI][NIC]
The OUI is the vendor ID and the NIC (Network Interface Card) is essentially the unique part. Though this is constantly debated cause a person using an older or unique computer probably has a unique OUI in the first place. Now if that said user connects to the same network, its pretty obvious to anyone monitoring the dhcp logs or other form of network logs that its the same device.
Part of their reason (only speculating here) like you mentioned “authentication”, is public Wi-Fi networks, hotels, and enterprise environments use the MAC address as a lightweight authentication token after connecting. Example some networks may kick you off after a certain amount of time passes.
But again I’m not sure if tails mac spoofing randomizes a new mac upon every connection or its stable randomization for the boot session? Like say network connection drops, then you re-connect now you have new mac and have to do a captive portal again. Someone like a dev or something could clarify this.
To my knowledge is that layer 2 Maps IP to MAC, Not Hostname to MAC so two devices with the same MAC but different hostnames would not solve broken connection.
Arguable I think this could be revisited but would be better to add option in the helper for those that want it. Like those that choose to disable unsafe browser on their home network might also want full random on their home network. While other user may need the default cause of certain issues like auth or spoofing failure.
Agreed! I hope it’s added eventually.
This has been open for awhile now:
Just a note.
What iOS and Android are doing isn’t “fully randomize MAC address”, they generate a locally administered address (LAA) whenever they connect to a new network (some OS might even generate a LAA whenever they connect to a previously-connected network, depending on configuration). Locally administered addresses are only addressable in a subnet, and carries no information about what the device is, unlike universally administered address (UAA) which identifies its manufacturer even if the NIC part has been randomized.
Locally administered addresses are distinguishable by its 7th bit. If a MAC address’ 7th bit (“U/L bit”) is 1 (meaning the 2nd octet is one of 2,3,6,7,A,B,E,F), then this MAC address is a locally administered address.
See the related Wikipedia article.
Pretty sure that’s wrong and it’s bit 1 (second least significant bit). The U/L (Universal/Local) bit is the second least significant bit of the first octet, not the 7th bit?
See the merge request in that work item
Windows 10/11, Android, and iPhone all use locally Locally administered addresses. From what I know from iPhone and Android both do this per saved network ssid if turned on not per connection. You can set it per connection now but the feature used to be per saved network ssid. Tails should use locally administered with their already per connection design (LAA per boot regardless of network connection).
Windows WLAN Device Driver Interface (WDI) /wdi-miniport-driver-design-guide
When configuring randomized MAC addresses, the operating system uses the “locally administered” format defined for IEEE802 addresses.
Oh I was counting from MSB so got 7th. You’re right.