WiFi - use per-network random MAC by default?

edent

I use lots of hotel and municiple WiFi. They all seem to use the MAC as an identifier for users.

Whenever I lose connectivity and reconnect, GrapheneOS presents a new MAC. That means I frequently have to reauthenticate myself.

I know I can manually set a WiFi network to use a per-network random MAC, but is there any way for me to set that as a default for all new connections?

de0u

edent I know I can manually set a WiFi network to use a per-network random MAC, but is there any way for me to set that as a default for all new connections?

Not at present, I don't think. And there would be some tracking risk if the "sticky MAC addresses" option were enabled and forgotten.

I think it would be safer if the joining dialog would prompt people to pick a per-network MAC privacy option, though that might confuse some users. So perhaps the request might be for an option that would configure the joining dialog to ask about MAC randomization the first time each network is joined.

That sounds like "a simple matter of programming", but it doesn't sound to me like something that the project would prioritize above other existing issues. So an issue followed by a pull request seems like the most effective approach.

user2025

Never heard hotels using MAC as identifier,sorry ! Whats the reason ? They are using guest portals where you may enter certain info but MACs, who the neck is the IT guy maintening that database !??

The fact the OS changes this address each and everytime is a true real bonus for privacy.

On stock OS there was a setiing to chose between hardCoded and random MAC, not sure on GOS...i will never activate it,to be honest,random all the way.

vodka

user2025 Never heard hotels using MAC as identifier

Very normal for hotels with an open network with captive portal, they give your MAC address x amount of hours of access before you have to re-auth via the captive portal. Usually 24 or 48 hours in my experience.

At least it lets you get access fom one specific mac that you can then spoof on a different device like a travel router if you want. (though most travel routers these days support just doing the captive portal on their own)

dapofi2471

Tested with GrapheneOS release: 2025120400

Settings → About Phone → Wi-FI MAC addresses → <SSID>

Network usage = Detect automatically
Privacy       = MAC User per-connection randomized MAC (default)
Auto-connect  = ON

PowerShell 7 command to get values

> adb shell dumpsys wifi | Select-String -Pattern 'randomization' -CaseSensitive:$false
> adb reboot

The values are persistent.

edent

dapofi2471 yes, I know I can manually set them for each network - but it is a pain to remember to do so.

I want the option of setting the default to persistent MAC per network.

dapofi2471

Caveat: If the Wi-FI hotspot regularly flushes their RTR connection cache, you must re-authenticate.
Best of luck finding their IT guy that can answer that question when you are visiting :-)

andrej567

edent i learned about the setting the hard way.. we were in a hotel and I got two activation codes for hotel wifi for one room. once activated, the router/portal remembered the mac address and did not ask for any activation after. So I ran out ouf activation codes within 15 min and went to buy a local sim.

dapofi2471

Settings → About Phone → Wi-FI MAC addresses → <SSID> → Privacy
You have 3 options:

Use per-connection randomized MAC (default)
Use per-network randomized MAC
Use device MAC (Not randomized, all networks, persistent)

Select the option that best fits your use case and test.
No other options exist in GrapheneOS.

skyward5883

Almost all APs that do authentication via captive portal (and i mean authentication beyond agreeing to some terms and conditions) store your mac address to avoid having you redo the auth process everytime the connection is re-established.
Maybe an option for GrapheneOS would be to prompt the user if per-network randomized mac is desired after a captive portal has been successfully completed?

gxtj53s

This also applies to in-flight wifi where you sign in with a seat number or account and, if you lose the connection, you’re unable to connect again for free because it’s one device per passenger per flight!

My perfect default would be a time-limited per connection MAC, eg 24 hours, 7 days etc so the device can’t be tracked long-term but the connection remains stable for the duration of the flight/stay/etc.

randommac

There is a Github issue that requests to reset the per-network random MAC every time a user chooses to Forget that network: https://github.com/GrapheneOS/os-issue-tracker/issues/3441.

There is also a separate Github issue for a time-limited option similar to what's described in gxtj53s: https://github.com/GrapheneOS/os-issue-tracker/issues/4452.

The Forget-based option is more flexible as the user can control exactly when the MAC address is reset. The time-based one is more automated, but gives less control to the user and requires more UI changes for the settings.