The ISP I use at home also provides access points in cafés etc. Can they, for example with my MAC address, match my identity when I'm using one of these access points to when I'm at home? And what steps would one take to avoid this?
1 Answer
Identification via MAC address is only possible, if your ISP can "see" that. MAC addresses are only seen on the client that are in the local ethernet collision domain, i.e. if they're on the same switch (simply put). This, of course, includes the router that acts as a gateway.
So, if at home you have a router that your ISP can't access, your MAC can't be seen beyond that router. At a public access point, which acts as a router, it can be seen by the owner of that AP - likely that ISP.
That being said, your ISP is likely to be able to recognize you in different café's, but not at home. In order to avoid this, you'd have to spoof your MAC, which is not easy and requires root access.
That much about MACs, someone who wants to identify you is very likely to use some other kind of identification that can be tracked across routers. Cookies, browser fingerprinting, just to name two. There're more than that and it's hard to counter all of them.
One thing I'd like to add:
Though tracking by ISPs is an issue, it's not the kind of tracking that'd worry me most. ISPs are usually specialized on providing you internet access. That's probably because the scope where an ISP can track you, is always limited. As soon as you're in another country or simply logged in to a friend's Wifi, your ISP has little chance of seeing your traffic at all.
On the other hand, if you have, say, a Google or Facebook account that you use across multiple devices - which most people do and of course they're always encouraged to do so, it's much, much easier to use that information for tracking you - and that's only the tracking that's officially done and most likely legal. There're many more trackers out there that have at least a questionable legal status - at least in some countries - and while you actually can refrain from using Google or Facebook (though avoiding them completely is difficult), it is even harder to avoid trackers that you may not know or think of.
Remaining completely anonymous on the internet is a very hard thing. TOR may be a good choice against just about anything but the NSA, but there're issues, too, and you have to know what you're doing.
Yet one more thing:
Most trackers do not know who you are. Usually they do not care. They're not going to write you a letter, so they don't need your address - letters are too expensive anyway. Same thing for phone calls. The police may look for that if they think they have to, but usually that's about it.
For a tracker it's enough to know something like that: "This person - likely male, probably married with an annual income somewhere around $100.000 has been searching the net for information about pregnancy tests. Therefore he might be interested in buying those as well as baby toys, baby clothing, baby insurance, maybe a bigger car and so on, so if that person loads one of our advertisements, it might be a good idea if it's from one of those categories. Since he lives somewhere around Syracuse, N.Y., we may also add some stores for baby supplies from that area." Try it. Google those things a bit and watch your banners miraculously change. It worked in my case. :)
-
ISPs may not be as benign as we would hope, and certainly do have access to a lot of our traffic. See: freedom-to-tinker.com/blog/feamster/… I don't think we can state authoritatively that ISPs, as a rule, don't collect MAC addresses from their WiFi access points. That wouldn't allow them to correlate to your home traffic, but certainly across their own access points (and beyond, if the data is shared). But more likely is as you say is the use of fingerprinting or other identifiers - differences of course across platforms, and apps vs. web, etc.– pseudonMay 28, 2016 at 16:38
-
I think your ISP is like a physician whereas Trackers are like pharma salesmen. The equivalent of good tracking is selling you the most profitable medication.– ThomasMay 28, 2016 at 17:00
-
That's good from the pharma point of view, but not necessarily good for the patient. ISPs vary widely in their motivations and behaviors, especially across jurisdictions, but it's enough for me to know that the US ISPs are fighting the (arguably weak) FCC Proposed Rules to Protect Broadband Consumer Privacy (fcc.gov/document/…). If the data can be collected, it can be abused, breached, etc., so I think the OP has valid concerns.– pseudonMay 28, 2016 at 18:11
-
BTW, ISP is unlike a physician in that they have no fiduciary or legal compliance duty currently to protect the privacy of your dossier. They can and usually do collect-store-aggregate full HTTP URLs, HTTPS domains, DNS data, and other user protocol/destination data. In addition, with ISPs consolidating with content providers, expect tracking by these companies to increase in the absence of strong new law.– pseudonMay 28, 2016 at 18:15
-
Nobody really cares for the patient unless forced by either law or personal ethics... ;-) The more money there is involved, the less you can count on either restriction to actually work...– ThomasMay 28, 2016 at 20:21