"MAC addresses are unique and permanent"

networkingprivacy

The burned-in address stopped being either: operating systems randomize Wi-Fi MACs per network by default, and any MAC can be set in software in seconds.

iOS, Android, Windows, and macOS all ship MAC randomization to defeat tracking; IEEE 802c formalized local-address usage. Tracking-by-MAC and MAC-based security both quietly broke.

MAC addresses are burned into hardware at manufacture and are commonly described as permanent identifiers. The first part is true and the second has not been for many years, since every mainstream operating system can change the address in software and most do so deliberately.

Randomization is now the default behaviour when scanning for or joining networks, because a stable hardware identifier broadcast continuously is a tracking beacon. Retail analytics, venue tracking and passive location profiling all worked by collecting these, and the platforms responded by rotating the address per network and per session, which broke a substantial commercial industry.

The consequences reach into ordinary network administration. MAC-based access control was always weak, since an address is trivially spoofed to match one that is permitted, and it is now also unreliable, because a legitimate device may present a different address on each connection. Network access control that depends on recognizing devices by hardware address is fighting the operating system, and the durable answer is certificate-based authentication where the identity is something the device proves rather than something it announces.

Disputed / commonly mistold A popular version of this story is inaccurate - see the note above.

← All glossary entries