Understanding MAC addresses

[deleted]

I have a few questions in an attempt to get a better understanding of MAC addresses,

I recently cleared saved WiFi connections in settings > about phone > WiFi MAC address. Are MAC addresses spoofed by graphene during WiFi scanning so that receiving WiFi connection points don't see the same phone via MAC address? Or are spoofed MAC addresses generated only once connection has been made? My understanding is GOS creates a singular MAC address for each WiFi connection point (I assume to prevent fingerprinting of phones when used across multiple networks). Since I have cleared my networks, will GOS create new MACs for previously saved wifi connections that are now cleared?

Thanks for your help.

GrapheneOS

[deleted]

AOSP and the stock Pixel OS use a random MAC address for each Wi-Fi scan along with randomizing other data like probe sequence numbers. This prevents identifying the device based on scanning for networks beyond a very basic idea of the type of device based on the type of Wi-Fi chipset, etc.

AOSP and the stock Pixel OS use a random MAC address for each saved network by default, unless you switch to using the device MAC which shouldn't be necessary in practice.

GrapheneOS changes this by using a random MAC address for each connection by default to prevent detecting that the same device has returned to the same network by both the network itself and other people observing the traffic since this is visible to everyone nearby not only the network. We also use fresh DHCP state for each connection.

Unless you switched the default per-connection randomization to per-network randomization for the networks, you weren't using a saved per-network MAC address for them but rather GrapheneOS was choosing one for each connection to them. Disconnecting and connecting again will use a new random MAC with the GrapheneOS approach.

[deleted]

GrapheneOS

Thanks for the prompt response,

So essentially due to the randomization, there's no concerns of the preferred network list (which I thought was what I was clearing) being thrown out during WiFi probe request / auto connect concerns?

Also, where in settings do I go confirm the default (I assume preferred) per connection randomization option?

Thank you again for you and your teams hard work in the project you have created, it probably seems thankless at times in your day to day, but know that many appreciate what you do.

[deleted]

Figured it out, thanks.

DeletedUser59

I am using my Pixel with GOS in a home wifi network with a router that filters connections according to IP/MAC addresses, i.e. e.g. device1 connected to this router may me allowed to use the internet until 8 p.m. using a blacklist and only websites allowed for minors, device2 has no time restrictions but the blacklist... etc., the standard filter connection to this router having no internet access at all, so that you first have to attribute new devices a certain filter manually.

Now I am having some trouble connection my GOS device to this network because of "use per-connection randomized MAC (default)", which will keep the Pixel running into the standard filter leaving it without internet everytime the MAC address changes.

I already tried the other options and only "Use device MAC" helped for a while, but finally not. A connection to that network can be made, so the login data has been entered correctely, but even with "Use device MAC" the filters in the routers don't work as they should. There are no issues with other smartphone such as iPhone, where switching off MAC randomization does the trick and all other devices work fine as well. I also deleted the connection in the phone and set it up again, no difference.

I have no clue, what I could try on the Pixel to get this working. For the moment, I set up a second wifi network for guests without IP/MAC based filtering, but maybe s.o. can help me to find a real solution, to set this up correctely.

de0u

DeletedUser59 I already tried the other options and only "Use device MAC" helped for a while, but finally not. A connection to that network can be made, so the login data has been entered correctely, but even with "Use device MAC" the filters in the routers don't work as they should.

Meaning that the device can access everything, or nothing? Can you provide more detail about the not-working symptoms? What filters are you hoping are applied to this device?

Have you tried rebooting the router?

Is it possible that the router is blocking the DNS service used by the GrapheneOS device, or the captive-portal connectivity servers?

Have you contacted the customer support infrastructure for the router?

DeletedUser59

de0u That's not the problem. Let's wait if s.o. else has an idea. Thx.

DeletedUser59

Today I noticed, when the connection phone (GOS) - wifi (fritzbox) is not stable again, the wifi icon in the upper right of the smartphone's screen starts flickering and sometimes shows an exclamation mark. When you open wifi connection settings in the phone, the IPv6-DNS-address is flickering as well. Weird. When I turn off IPV6 in my router completely, the connection phone - wifi works fine. (Might be related: https://discuss.grapheneos.org/d/5910-2nd-try-ipv6-on-wifi-drops-out-after-a-few-minutes/4)

No other device in my network has this problem.

Private DNS in phone is off, I use pihole plus unbound, connectivety checks in phone on. MAC randomization set to "per connection"

Remember that everything works fine when I connect the phone to the guest network of the same router.

Matth

DeletedUser59 I'm not using mac filtering, nor IPv6. However I have recently experienced some other weird Wifi issues where the phone kept losing the Wifi connection and even lost the password.

I have just now turned off Band steering on the Wifi and since then the connection seems to be stable again, at least so far. Not sure your Fritzbox has that feature, but you might wanna have a look at it and try turning it off.