this post was submitted on 31 Jul 2025
216 points (99.1% liked)
Technology
73534 readers
2451 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
And serious company will have this as basic security. It's a fundamental function even available on your consumer grade router at home. While it's overkill for that use, it's basic security for a company.
That's why it's not surprising at all that a bank didn't bother to do that. Banks have some of the most egregious security issues.
i’d argue that any serious company wouldn’t really bother with MAC identification… they’re so easy to spoof that it adds to operational overhead far more than the benefit it brings
more likely with these things you’d have a VLAN mapped to a physical port, and if that port were disconnected you’d instantly get a notification and send someone to check it out
Spoofing a MAC is easy but it still requires knowing both what an existing valid address is, and ensuring that it's not already connected to the network. It's only operational overhead when a new device is onboarded, after that the impact is minimal.
A policy that requires sending a tech is fine, but if you have hundreds or thousands of individual locations then you aren't going to have a tech onsite at every one of them to quickly check and fix an issue, and you don't really want to have to trust an end user to verify and/or make physical changes on site if you can avoid it.
This is still trivial. A Pi with 2 NICs and a Linux bridge. Using the 2 ports, effectively put the Pi in between the device you want to spoof and the rest of the network. Now you can see the traffic, the MAC addresses etc.
Port security prevents this. As soon as the switch detects a physical disconnect it disables the port.
You could, with some electrical engineer-level tools and hardware, passively read the traffic to determine the MAC and then splice into the wire without disrupting the physical connection. But it would be very hard to do covertly or quickly.