Re: [Tails-dev] [Secure Desktops] MAC changer "blend into th…

Patrick Schleizer:
> Tails' current implementation...
>
> only spoof the NIC part: yes [1]
> OUI part unchanged: yes [2]
>
> quu9ohch [1]:
>> [...] It is not possible to "blend into the crowd" with a
> "typical-looking" mac address when so many users allow themselves to be
> uniquely fingerprinted and tracked.

I'm not sure what this means. Since all "real" MAC addresses around you
can be tracked down, your spoofed one will stand out, arising suspicion?
I'm not sure how that is distinguishable from a new device coming online
for the first time, or similar, which is nothing out of the ordinary.

> The tradeoff of using a weird (or
> never manufactured) mac address is like the tradeoff of using tor. It
> follows from the pigeon hole principle that one cannot hide the fact
> that they are trying to hide (it is up to other users to hide you), but
> the best one can do is become statistically exchangeable with the
> largest possible set of anonymity participants via randomness. [...] [2]

I don't agree with any of this, at least vs the goals stated for MAC
spoofing in Tails. If we spoof with a MAC address that uses an OUI
somewhat common to the area, we have successfully blended into the crowd
and successfully achieved the relevant user goals: AvoidTracking;
AvoidIdTails and AvoidIdMacSpoof. That is clearly superior to blending
in with other anonymity participants in the area, which in the worst
case fails all of the goals; if there are no anonymity participants in
the area, failing AvoidIdTails or AvoidIdMacSpoof implies failing
AvoidTracking too since you'll be the only one doing it.

> An argument of mine... Quote Tails MAC changer design.
>
>> [MAC OUI] lists do not take into account that some devices are pretty
> much only used in some geographical areas
>
> I conclude, for someone who traveled far or bought an uncommon notebook,
> by not changing the OUI part, one could stand out more. Because always
> that uncommon OUI shows up that is rare in that geographical area. And
> worse so, the uncommon OUI with an always changed NIC. This would lead
> to AdvGoalIdMacSpoof, AdvGoalIdTails and AdvGoalTracking. That
> particular user with that uncommon OUI would be better off with a fully
> random (OUI part and NIC part) MAC address. It would lead to
> AdvGoalIdMacSpoof, but not to AdvGoalTracking. In my opinion, the better
> compromise.

I'm just gonna rehash the argument I just made above: a fully random MAC
address also implies the adversary achieving AdvGoalTracking if you are
the only Tails (etc) user in the area, which isn't a very inconceivable
situation.

Cheers!