Subject: [Madinas] Best Practices for MAC Address handling..

From: Michael Peddemors <[email-masked]>
Date: Fri, 30 Oct 2020 10:15:16 -0700

I don't think I can allocate the time for this discussion, but I just 
subscribed, so I can quickly throw in my two bits...

I think that I speak for many infosec people, that I agree that MAC 
addresses should NOT be randomly generated, but instead fixed.

The problem that they are trying to address should probably be worked on 
in a different manner than obfuscating or randomizing the MAC address, 
as it subverts the whole purpose.

And many in the infosec community rely on that data to be fixed for 
their algorithms, and many others might use MAC mapping for many 
purposes, including identifying traffic patterns, requests, etc, 
breaking their monitoring tools.

I vote for making MAC addresses static as a "Best Practice".

Dont' have much more to add.

-- 
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 30 Oct 2020 17:25:27 +0000

> addresses should NOT be randomly generated, but instead fixed.

FWIW, speaking as someone interested in security
and privacy, I disagree. But both things are kinda
moot - OSes can and are doing this, so we can say
what we do/don't like but they'll still do it.
(And there are valid reasons for that.)

Aside from that, one of my hopes for this BoF is
that it not degenerate into "camps" e.g. of those
that want to see better privacy or those you refer
to as "the infosec community."

We've followed that destructive path a couple of
times now, and ISTM it leads nowhere.

I hope, in this case, that we instead focus on how
to both improve privacy and try find new ways to do
the kinds of access control that previously depended
on hard-coded long lived identifiers like MAC addresses,
particularly for interfaces that move around with
people.

Cheers,
S.