1

Recently, I overheard by chance some technically savvy guys saying that when you accept the terms of service in order to use the "free" WiFi at Starbucks (which you pay for when you buy some coffee), the popup window actually performs an HTTP operation that sends the computer's WiFi MAC address in the URL in an HTTP GET request to the service that Starbucks has contracted with, e.g. "GoogleStarbucks". Why do they do that? Are they actually recording all of the customers packet traffic? If so that is a serious privacy violation!

I heard this happens on a Macbook, but I assume iPhones as well and I am curious if Windows and Linux users can confirm here in this forum that it happens to them too.

Concern #1: That Starbucks is recording all traffic for some MAC addresses.

Concern #2: That Starbucks is sending the MAC address to some services e.g. if you log in to an anonymous email account, it's provided somehow.

Concern #3: That the popup is running Safari / JavaScript that is specially allowed to obtain the MAC address, and that WebKit may have a vulnerability that lets others access this datum.

Concern #4: That Starbucks is recording my daily patterns e.g. which Starbuckses I go to and when, and selling it to the highest bidder.

Concern #5: Retailers are sharing this information, so that if someone with a given MAC goes to Starbucks, that same MAC is tracked in other stores that the shopper happens to pass by e.g. in a mall.

closed as off-topic by Rory Alsop Feb 18 '15 at 17:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7
    In order to better answer your question: do you already understand that you have to send a MAC address to connect to any router? Also, could you clarify why you're concerned that Starbucks may be "recording all of the customers traffic"? Their router can certainly see all unencrypted traffic (that's fundamental to what a router does), but whether they record traffic is purely a matter of policy. I don't see how Starbucks policy for recording traffic (or not) has any relation to their ability to identify a user as one who has clicked through the network's terms of use or not. – apsillers Feb 16 '15 at 17:28
  • Icann: I'm speculating that it's for the same reason a MAC address is sent over AT&T visitor wifi here at my college campus - to provide a session key/identifier to the backend that permits access beyond the captive portal in such an environment - by IDing the MAC address of the machine, then for however long the session length is (or the expiry for the session length), your connection won't be subjected to re-requesting access. – Thomas Ward Feb 16 '15 at 17:35
  • Meh. After all the revelations about the N-S-A I'm hesitant to agree that the intention is 100% innocent and no reason for worry. – Icann Feb 22 '15 at 5:18
6

A MAC address more-or-less* uniquely identifies a network card, and is only accessible to other devices on the local (non-routed) network. So yes, the Starbucks network can and does know your MAC address, and certainly could be sending it up into their database somewhere.

Concern #1: That doesn't mean they're "recording traffic" (although, of course, they could do that as well). It just means they're taking a fingerprint of your device and making note of the fact that you were there.

Concern #2: It's unlikely they're sending the address to anyone but their own database. There's usefulness for them to track who uses their network, how often, and at which locations. There's very little usefulness in supplying that address to anyone else, and good reasons (your concerns among them) not to.

Concern #3: They might very well use Javascript to populate your MAC address into the submission you send when you agree to use their network. Nothing nefarious there - remember, they own the network, they know your MAC address, and could do whatever they wanted with that information without routing it through your browser. If you wanted you could mess with it if they're sending it through your browser - although, of course, you could mess with the system by changing your MAC address anyway.

Concern #4: Unless you pay with cash each and every time you go to Starbucks, your MAC address is the least traceable thing about you.

In summary: don't worry about it. They're doing standard consumer-level tracking, and you're a consumer.

Note* While a MAC address is intended to uniquely identify a network card, many cards allow the address used to be reconfigured. You can probably set your MAC address to whatever you'd like, as long as it doesn't match another MAC address in use at another network. So you could use a different MAC address each time you went to a Starbucks and thwart their tracking. That's why I refer to it as consumer-level tracking - it's cheap, easy, and while it can be tricked it's not worth most people's time to do so.

Not the answer you're looking for? Browse other questions tagged or ask your own question.