Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Private Mac addresses in IOS14

    Scheduled Pinned Locked Moved General pfSense Questions
    69 Posts 10 Posters 11.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • NogBadTheBadN
      NogBadTheBad @JKnott
      last edited by

      @JKnott said in Private Mac addresses in IOS14:

      @NogBadTheBad

      Again, the MAC address is completely irrelevant beyond the first router. So, if you're running your own router, not even your ISP will see your phone's MAC address. The snooping must be done no later than that first router. It's definitely tinfoil hat time!

      Not sure why you keep saying this, what Apple term as private MAC addresses are really only designed to be used away from home.

      It’s really only of use when you are using free wifi and don’t want your MAC address to be registered whenever you connect away from home

      Andy

      1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

      1 Reply Last reply Reply Quote 2
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Yeah, this could be painful initially when those devices send a different MAC but it's not random every time they connect back to the same SSID.

        Android does this now too: https://source.android.com/devices/tech/connect/wifi-mac-randomization

        Steve

        JKnottJ 1 Reply Last reply Reply Quote 1
        • JKnottJ
          JKnott @stephenw10
          last edited by

          @stephenw10

          I just checked my Pixel 2 with my guest SSID and see it does use a random MAC for new SSIDs. However, anything I had set up on previous phones uses device MAC. I hadn't even known about that setting.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Ah that's good to know.

            It was also unclear if it does this now by default on either OS but I think it does.

            Steve

            JKnottJ V 2 Replies Last reply Reply Quote 0
            • JKnottJ
              JKnott @stephenw10
              last edited by JKnott

              @stephenw10

              My Pixel 2 with Android 10 has it, but not my Asus tablet with Android 7. Random is default, except for previously configured connections. So, any that were inherited from my Nexus 5 use the device MAC.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              1 Reply Last reply Reply Quote 1
              • V
                Vollans @stephenw10
                last edited by

                @stephenw10 said in Private Mac addresses in IOS14:

                It was also unclear if it does this now by default on either OS but I think it does.

                It certainly turned on by default on my iPad Pro and iPhone 11 Max.

                NollipfSenseN 1 Reply Last reply Reply Quote 0
                • NollipfSenseN
                  NollipfSense @Vollans
                  last edited by

                  @Vollans said in Private Mac addresses in IOS14:

                  @stephenw10 said in Private Mac addresses in IOS14:

                  It was also unclear if it does this now by default on either OS but I think it does.

                  It certainly turned on by default on my iPad Pro and iPhone 11 Max.

                  I upgraded last night just to see what's about ... seems like much to do about nothing even if turned on by default.

                  pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                  pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                  1 Reply Last reply Reply Quote 1
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Yeah not sure who it would cause headache for - other than someone that doesn't under how dhcp reservations work..

                    So it turned it on for networks your phone had already been connected too?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    JKnottJ V 2 Replies Last reply Reply Quote 0
                    • JKnottJ
                      JKnott @johnpoz
                      last edited by

                      @johnpoz said in Private Mac addresses in IOS14:

                      So it turned it on for networks your phone had already been connected too?

                      My understanding is it picks a new random MAC when connecting to a new SSID. It shouldn't change when you connect again.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • V
                        Vollans @johnpoz
                        last edited by

                        @johnpoz yes, my pre-existing learnt networks have it switched on automatically. For me, that's not a problem.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Apple seems to have a pretty good POLA violation on their hands here, IMHO. Considering it uses the same MAC address every time it connects to the same network it shouldn't break things like Captive Portals or DHCP pools. But static mappings, etc will certainly break.

                          The user should have at least been asked if they want new MAC addresses for existing networks, while the blank stares at the screen from the majority would be funny to montage.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            @Derelict said in Private Mac addresses in IOS14:

                            The user should have at least been asked

                            Yeah no shit ;) First thing I had to go and turn off on my 3 apple devices as I updated them to 14 the other day.. Not a peep from the thing that it was doing this..

                            Why do these OS makers continue to treat their users like idiots.. The last sort of thing that was pissing me off is windows with its update to 2004.. Just saying your machine is not ready -- well why and the F not?? Clearly you know why its not updating, because your not letting it... But what is the specific reason.. So possible it can be corrected.

                            Finally had to just do a freaking clean install.. Works fine..

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            DerelictD JKnottJ 2 Replies Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate @johnpoz
                              last edited by

                              @johnpoz said in Private Mac addresses in IOS14:

                              Why do these OS makers continue to treat their users like idiots..

                              🤔

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 1
                              • JKnottJ
                                JKnott @johnpoz
                                last edited by

                                @johnpoz said in Private Mac addresses in IOS14:

                                Why do these OS makers continue to treat their users like idiots..

                                Maybe because they bought iPhones. 😉 <ducking>

                                With Android, it appears to generate a random MAC when first connected to an SSID and then use it for all future connections.

                                PfSense running on Qotom mini PC
                                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                UniFi AC-Lite access point

                                I haven't lost my mind. It's around here...somewhere...

                                NogBadTheBadN 1 Reply Last reply Reply Quote 0
                                • NogBadTheBadN
                                  NogBadTheBad @JKnott
                                  last edited by NogBadTheBad

                                  @JKnott said in Private Mac addresses in IOS14:

                                  @johnpoz said in Private Mac addresses in IOS14:

                                  Why do these OS makers continue to treat their users like idiots..

                                  Maybe because they bought iPhones. 😉 <ducking>

                                  With Android, it appears to generate a random MAC when first connected to an SSID and then use it for all future connections.

                                  LOL no ****, it’s in the interest of Google to be able to track you by MAC address when ever you join a Wi-Fi network if the MAC stays consistent per SSID they are sorted.

                                  Andy

                                  1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Both Android and iOS appear to do the same for new networks; use a random MAC but that keep using that for re-connections to that same network.
                                    The only thing that seems unclear is their behaviour when connecting to already known networks.
                                    It seems iOS is using a random MAC there too potentially breaking stuff.
                                    Android seems to retain the real MAC for existing networks as reported above.

                                    Steve

                                    JKnottJ 1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott @stephenw10
                                      last edited by

                                      @stephenw10

                                      Yes, when I got my Pixel 2 and synced it to my previous phone, it also received my WiFi connections. They use the hardware MAC. A connection I set up a couple of weeks ago uses the random number.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 0
                                      • AKEGECA
                                        AKEGEC
                                        last edited by

                                        It is so funny to see some Netgate forum members always bring up TIN FOIL HAT every time someone asks or says about privacy & security.

                                        @bcruze, Mac Private address is just a layer of security. The same as T2 chip and read-only system volume in Catalina. Apple is aware that their previous devices were easy target for hacking. Not to mention the leaking on intel chip issue.

                                        1 Reply Last reply Reply Quote 0
                                        • ?
                                          A Former User
                                          last edited by

                                          Security and Privacy are not the same thing. Just saying...

                                          AKEGECA 1 Reply Last reply Reply Quote 1
                                          • AKEGECA
                                            AKEGEC @A Former User
                                            last edited by

                                            @jwj said in Private Mac addresses in IOS14:

                                            Security and Privacy are not the same thing. Just saying...

                                            Let me explain the differences between them;

                                            Security = Protection of a person, building, organization, or country against threats such as crime or attacks.

                                            Privacy = Someone's right to keep their personal matters and relationships secret.

                                            Everyone has the right for security and privacy.

                                            ? 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.