Suppose that I use a smartphone with an external WiFi adapter to cover up my real MAC address and on top of that I use a no-log VPN. In what way could I still be identified? I have heard a lot of talk against smartphones as hacking devices as they contain a lot of personal information, but I cannot see the validity of this argument as none of this personal information is related to the packages being sent when penetration testing another device.
I only see two things identifying oneself: MAC address and IP address.
Using an external adapter, the MAC address of the phone is not used. Suppose that the wifi adapter is bought with cash in some local store, there would be no way of identifying someone by knowing the MAC address of the external WiFi adapter.
VPN to fake the location and IP address.
Why would it be more secure to pentest or "hack" from a computer that contains no personal information about me compared to my smartphone? If the argument is because the entity that I am hacking could hack me and break into my system and reveal all my information, well they can't. Understanding the Android system shows that everything is sandboxed, every app is within its own environment and cannot see the rest of the system. Hacking into an Android device would just hack into a useless environment that is completely locked down. Even commands like "iwlist" are not allowed. I see smartphones as more secure devices to hack from than computers.
Can anyone expand my knowledge or prove that I am completely wrong?