Hacker News new | past | comments | ask | show | jobs | submit login

just fired up airmon and cannot reproduce your observation



Maybe you're running an old version (or not BLE). It's been doing it for a long time. Same with a lot of other types of devices, I'm sure. It's standard security practice, these days.

https://support.apple.com/guide/security/bluetooth-security-...


> old version (or not BLE)

both actually, but i am seeing unrandomized normal bt beacons.

how about your device?


I've written BT software[0], and it always randomizes it. I don't think it randomizes for every transaction, but it does use different UUIDs, when I run the device at different times. You can't switch the UUID, after establishing a connection.

[0] https://riftvalleysoftware.com/work/ios-apps/bluevanclef/


impressive.

did you have a chance to check what kind of beacons your iphone actually emits?


I did look, back when, but it’s been a few years, since I wrote that, and it hasn’t really been a priority.

When I was writing it, I spent a lot of time with a sniffer and WireShark, so I was looking at the raw data.

[EDITED TO ADD] Sniffers are of minimal use, with BLE, since everything gets encrypted, as soon as devices start talking to each other, but you can see the advertisements. I used one, because all the Apple devices seem to have a different opinion, on what's out there. I'd see a device with the Watch, but not the phone or TV, and vice-versa.

I actually submitted a bug report on it, but I don't think Apple ever even looked at it. I'm sure they are well aware of this. I suspect the Apple engineers are probably some of the top BT people in the world.


take a look (again) and see that your iphone emits bluetooth classic beacons with the device mac address (non randomized)


That doesn't surprise me. I don't think classic can handle changed UUIDs. I didn't really spend much time on Classic.

In any case, I'm pretty sure all BT will look like BLE, sooner or later. I know that they are already starting to implement high-bandwidth BLE, and that's about the only reason to use Classic.




The deadline for YC's W25 batch is 8pm PT tonight. Go for it!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: