[Madinas] Re: BSSID randomization

["Lee, Yiu" <[e-mail]>]

Hi Erik,

Thanks for sharing the paper. I read it this morning. Unlike personal devices, most people don’t pay too much attention to AP for privacy concerns. Your paper points out some legit use cases. Congrats to your work. That being said, randomizing BSSID will cause some issue for the current practices. For example: current iOS uses the BSSID to determine the “home” location. More careful analyzes may be needed to address the impact to simple home setup.

When the WG started working on the use cases, the WG only charted to work on devices. We didn’t consider the use cases of randomizing the AP’s mac-address (usually used for BSSID). The WG will need to update the charter to include this new work. I will let the AD and Chairs to chime in.

Thanks,
Yiu



From: Erik Rye <[e-mail]>
Date: Monday, January 27, 2025 at 14:46
To: "[e-mail]" <[e-mail]>
Cc: Dave Levin <[e-mail]>
Subject: [Madinas] BSSID randomization

Hi everyone --

My name is Erik Rye; I'm a PhD student at the University of Maryland where I'm advised by Dave Levin (cc'ed). I've been interested in MAC address randomization in mobile devices for some time, and think that the work your group is doing is timely and important.

Dave and I recently had a paper (https://www.cs.umd.edu/~dml/papers/wifi-surveillance-sp24.pdf<https://urldefense.com/v3/__https:/www.cs.umd.edu/*dml/papers/wifi-surveillance-sp24.pdf__;fg!!CQl3mcHX2A!BIP6uXZKHpAPRgHibDMuO2ESRU0pFlY8vYBpBMRi34Tpi6T-OIev-d9xLph2f511hSxtpoNpspM$>) at S&P that looks at tracking access points, rather than client devices. Our paper exposes some severe risks to privacy that are made possible when access points have static BSSIDs. One of our recommendations is for Wi-Fi access point manufacturers to randomize their BSSIDs to prevent tracking via a Wi-Fi Positioning System (WPS), which tech companies like Apple and Google use to help clients in their ecosystems self-geolocate.

Through personal correspondence with SpaceX, and blog posts from GL-iNet (https://blog.gl-inet.com/preventive-actions-to-safeguard-glinet-users-from-bssid-based-location-tracking<https://urldefense.com/v3/__https:/blog.gl-inet.com/preventive-actions-to-safeguard-glinet-users-from-bssid-based-location-tracking__;!!CQl3mcHX2A!BIP6uXZKHpAPRgHibDMuO2ESRU0pFlY8vYBpBMRi34Tpi6T-OIev-d9xLph2f511hSxthiP2Gq0$>) and Super Networks (https://www.supernetworks.org/pages/blog/bssid-randomization<https://urldefense.com/v3/__https:/www.supernetworks.org/pages/blog/bssid-randomization__;!!CQl3mcHX2A!BIP6uXZKHpAPRgHibDMuO2ESRU0pFlY8vYBpBMRi34Tpi6T-OIev-d9xLph2f511hSxt_I3t5c8$>) we know that at least several vendors are already implementing BSSID randomization. We were wondering if you had considered this additional MAC address randomization use case; if not, we are happy to help contribute to some best practices and recommendations in your work.

Best,

Erik and Dave