Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm asking this because according to this article , Microsoft collects much less information than actually exists for Windows licensing (e.g. only 10 bits for MAC addresses, 6 for CPU serial number etc.) - perhaps this is because of privacy issues?

share|improve this question
    
Let's just spoof the mac address :) –  HamZa Jul 8 '13 at 22:10
add comment

2 Answers

For its computations related to activation keys, Microsoft must perform a delicate dance between a number of booby traps. In particular, they aim at detecting people who reuse the activation keys on other systems, but not unduly block users who simply changed parts of their hardware. There is a fine limit between "this is a new computer" and "this is the same computer but with some upgraded parts".

Among Microsoft's preoccupations, I'll wager that "user privacy" ranks rather low. However, "user sues Microsoft because of privacy issues" is probably more of a concern, from Microsoft point of view, so chances are that they will make some token public relations effort on the lines of "your privacy is important to us" and collecting only 10 bits of a MAC address may be part of this apparent display.

share|improve this answer
add comment

Tom Leek answered correctly regarding Microsoft's hardware fingerprint storage policy, but I'd like to dive into a little bit more detail regarding the privacy implications of MAC address storage.

When your computer connects to another machine on your network--say, your router for example--it is identifiable by its hardware MAC address (on its NIC). When you connect to another machine on the Internet, however, that MAC address is stripped.

In other words, visiting Google.com does not allow Google web servers to view your MAC address.

In terms of the original question, storing a MAC address has a couple of implications:

  1. Storing a MAC address can reveal some of your hardware specs, since they are designed to be manufacturer-specific. In almost all instances, this is a non-issue, unless there is some crazy hardware vulnerability against specific types of NICs.

  2. In certain instances, it can be possible to use a MAC address to find an IP address. This would only work if you were on the same network as the victim and were looking to correlate a certain user's MAC with their local IP address.

I think I've mostly gotten the idea across: there are some certain, very-specific use cases in which you would not want your MAC address to be stored and revealed, but in general there are very few privacy risks associated with a leaked MAC address. Hope this helps!

share|improve this answer
    
There is another concern with MAC addresses: if software stores not only your computer's NIC's MAC address, but the LAN/WLAN MAC address of your home router and perhaps other wireless routers near you, then they will be able to find your router's physical location by querying geolocation databases. This is how the browser geolocation API works. –  Anorov Jul 13 '13 at 17:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.