[jessenaser]

On top of that, some networks like Spectrum already report all the MAC addresses that are connected to it remotely to the Spectrum database, instead of just on your network panel locally (because there isn't a Spectrum network panel anymore, only the app). This means that a nation state (USA) can see real time minute by minute who is on that network, and recent devices on that network because Spectrum designed this in their firmware.

You can check yourself from the app:

Services > Devices on Network > Manage

And it will show all of the MAC addresses connected, and recently connected. Even remotely if you are not logged into your network.

You also can see the *plaintext* password to your router from this app.

Services > Your WiFi Network

Which means a nation state also can remotely login to your network without you knowing, and otherwise is bad for security if passwords for millions of homes are plaintext.

---

Moral of the story is that even if Apple eventually fixes this, the other side of the tracking that nation states could do could be done at the ISP firmware level. To solve this kind of attack, either allowing open firmware or new legislation is the only to stop this. (Which when has privacy legislation ever happened... is another question for another day).

[sandworm101]

>> To solve this kind of attack, either allowing open firmware or new legislation is the only to stop this.

Or just randomize every MAC at the client level, blinding everyone up the chain and no doubt causing many false reports as randomized macs collide.

[jessenaser]

Yes this helps the MAC concern, but this means we need wide scale device manufactures to enable this by default, because users won't. Similar level of consensus.

Also why is some devices don't support this randomization, or even if they do, the first connection is not supported. When you first activate an iPhone or use a Windows computer, it still does not expose all the settings to randomize the MAC address until you setup the device, so the first connection exposes the actual address to the network. Yet again we need deeper levels of change to fix this.