Patrick Schleizer: > Tails' current implementation... > > only spoof the NIC part: yes [1] > OUI part unchanged: yes [2] > > quu9ohch [1]: >> [...] It is not possible to "blend into the crowd" with a > "typical-looking" mac address when so many users allow themselves to be > uniquely fingerprinted and tracked.
I'm not sure what this means. Since all "real" MAC addresses around you can be tracked down, your spoofed one will stand out, arising suspicion? I'm not sure how that is distinguishable from a new device coming online for the first time, or similar, which is nothing out of the ordinary. > The tradeoff of using a weird (or > never manufactured) mac address is like the tradeoff of using tor. It > follows from the pigeon hole principle that one cannot hide the fact > that they are trying to hide (it is up to other users to hide you), but > the best one can do is become statistically exchangeable with the > largest possible set of anonymity participants via randomness. [...] [2] I don't agree with any of this, at least vs the goals stated for MAC spoofing in Tails. If we spoof with a MAC address that uses an OUI somewhat common to the area, we have successfully blended into the crowd and successfully achieved the relevant user goals: AvoidTracking; AvoidIdTails and AvoidIdMacSpoof. That is clearly superior to blending in with other anonymity participants in the area, which in the worst case fails all of the goals; if there are no anonymity participants in the area, failing AvoidIdTails or AvoidIdMacSpoof implies failing AvoidTracking too since you'll be the only one doing it. > An argument of mine... Quote Tails MAC changer design. > >> [MAC OUI] lists do not take into account that some devices are pretty > much only used in some geographical areas > > I conclude, for someone who traveled far or bought an uncommon notebook, > by not changing the OUI part, one could stand out more. Because always > that uncommon OUI shows up that is rare in that geographical area. And > worse so, the uncommon OUI with an always changed NIC. This would lead > to AdvGoalIdMacSpoof, AdvGoalIdTails and AdvGoalTracking. That > particular user with that uncommon OUI would be better off with a fully > random (OUI part and NIC part) MAC address. It would lead to > AdvGoalIdMacSpoof, but not to AdvGoalTracking. In my opinion, the better > compromise. I'm just gonna rehash the argument I just made above: a fully random MAC address also implies the adversary achieving AdvGoalTracking if you are the only Tails (etc) user in the area, which isn't a very inconceivable situation. Cheers! _______________________________________________ Tails-dev mailing list Tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev To unsubscribe from this list, send an empty email to tails-dev-unsubscr...@boum.org.
