Spoofing MAC

[pl1...@sigaint.org]

Hi
I followed the guide that explains how to spoof MAC using debian based
appVM. Now will my ISP "see" this new or it anonymize just my surfing?

[Sae]

-------- Forwarded Message -------

Subject:	Re: [qubes-users] Spoofing MAC
Date:	Wed, 25 Jan 2017 20:52:35 +0100
From:	Sae <s...@nopping.eu>
To:	pl1...@sigaint.org

 wrote:
> Hi
> I followed the guide that explains how to spoof MAC using debian based
> appVM. Now will my ISP "see" this new or it anonymize just my surfing?
>
Hello.
You ISP never sees your MAC. Your MAC is used for the communication
between your computer and your router.
Spoofing your MAC is usefull in networks which are not under your
control (hotspots, school, work, …).
Then, from that network point of view, your computer won't identify
itself with your mac address that is closely tied to your computer hardware.
Spoofing your mac address has no impact on your IP address, so it won't
anonymise your surfing.

forwarding because I forgot to send to the list. 

[john.david.r.smith]

> Spoofing your MAC is usefull in networks which are not under your
> control (hotspots, school, work, …).
> Then, from that network point of view, your computer won't identify
> itself with your mac address that is closely tied to your computer hardware.

of course this is useless, if you have a login via a personal account (e.g. hot spot registration/ student number used for login/ some id in your workplace used for login etc)

[Unman]

Since your ISP has complete control over your router they *always* see
your MAC. If you spoof the MAC then they would be able to associate the
spoofed MAC with that router. If you have been consistent and keep
changing it then you would have some degree of plausible deniability for
any particular session.
Best approach would probably be to add another wireless card on another
netvm, and use spoofed MAC and separate qubes on that netvm, while keeping the
vanilla card for "normal" use. That way to maintain "normal" use and
mask the other activity. Use a removable wifi card and disposable
netvm for the spoofing to minimise trace. Increase deniability by
setting router to open or with simple to guess password.

[Sae]

My ISP doesn't have control over my router. My modem/router is my own. I
just configure it with their credentials.

[Unman]

It's standard advice to use a router you supply yourself. I've always had
my doubts.
You've attached a device you bought, probably generic, to a network and infrastructure
over which you have no control. I wouldn't be so sanguine about who controls it now.

[pl1...@sigaint.org]

Then if I use other internet connections and spoof MAC, they never know my
real MAC,right?

[Chris Laprise]

On 01/27/2017 06:03 AM, pl1...@sigaint.org wrote:
>>
> Then if I use other internet connections and spoof MAC, they never know my
> real MAC,right?
>

If you're using Network Manager MAC randomization described in the doc,
then yes---it will use a different random address with each "connection"
(each radio access point or router). It can also do this for wired
connections. (This has nothing to do with IP addresses... Tor handles
anonymization at the IP level.)

Unfortunately, other identifiable information was recently discovered in
the Wifi hardware handshake packets, so full anonymization at the MAC
level won't be possible until sometime in the future.

Chris