# Wireless security: MAC filter good enough? **URL:** \ **Category:** Factual Questions\ **Created:** [February 25, 2010, 7:42pm UTC](https://boards.straightdope.com/t/wireless-security-mac-filter-good-enough/530430 "2010-02-25T19:42:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sapo](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@Sapo](https://boards.straightdope.com/u/Sapo)\ **Post date:** [February 25, 2010, 7:42pm UTC](https://boards.straightdope.com/t/wireless-security-mac-filter-good-enough/530430/1 "2010-02-25T19:42:11Z")
Is an exclusive MAC filter by itself a good security solution for wireless security? Does disabling the SSID broadcast help at all? If a MAC filter is not enough, what security mode should I use? This is all for home use and in a semirural area where I don’t really fear hackers lining up at my door to bust in, but still. ---
**Author:** ![Larry\_Mudd](https://avatars.discourse-cdn.com/v4/letter/l/f14d63/32.png) [@Larry\_Mudd](https://boards.straightdope.com/u/Larry_Mudd)\ **Post date:** [February 25, 2010, 7:47pm UTC](https://boards.straightdope.com/t/wireless-security-mac-filter-good-enough/530430/2 "2010-02-25T19:47:16Z")
If you’re in a fairly rural area, you’ve not got much to worry about. However - Generally, MAC filtering is not secure enough - it’s possible to sniff the MAC address out and then spoof it. Use WPA-PSK, turn off SSID, and use MAC filtering. If you don’t live in the downtown core, that should be more than adequate. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [February 25, 2010, 7:49pm UTC](https://boards.straightdope.com/t/wireless-security-mac-filter-good-enough/530430/3 "2010-02-25T19:49:23Z")
MAC addresses are easy to sniff and discover. People can easily change the mac addresses of most computers. So it does not provide very much security. Disabling SSID broadcast makes it more difficult to know that there is wifi to use. So it is of some help. I would not turn off SSID it mostly makes it more of a pain in the but to setup things and provides little in the way of security. Use WPA2-psk most every thing supports it. It is pretty easy to use. ---
**Author:** ![Sapo](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@Sapo](https://boards.straightdope.com/u/Sapo)\ **Post date:** [February 25, 2010, 7:56pm UTC](https://boards.straightdope.com/t/wireless-security-mac-filter-good-enough/530430/4 "2010-02-25T19:56:50Z")
Actually, disabling SSID broadcast has the (to me) convenient side effect that my iPod won’t connect on its own, which means the kids don’t have access to the internet. Just typing my network name to log in is not that much of a price to pay for that “feature”. Experience has shown me that I forget to turn off wifi all too often when I give the iPod to the kids. ---
**Author:** ![Sapo](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@Sapo](https://boards.straightdope.com/u/Sapo)\ **Post date:** [February 25, 2010, 10:09pm UTC](https://boards.straightdope.com/t/wireless-security-mac-filter-good-enough/530430/5 "2010-02-25T22:09:36Z")
Trouble. When I enable security, it autoconnects. Is there a way to force it to ask before connecting? ---
**Author:** ![Algorithm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/algorithm/32/12204_2.png) [@Algorithm](https://boards.straightdope.com/u/Algorithm)\ **Post date:** [February 25, 2010, 10:19pm UTC](https://boards.straightdope.com/t/wireless-security-mac-filter-good-enough/530430/6 "2010-02-25T22:19:36Z")
> [@Larry\_Mudd](#): > > Generally, MAC filtering is not secure enough - it’s possible to sniff the MAC address out and then spoof it. It’s not just possible, it’s _trivial_. Every packet sent contains a MAC address of an allowed device in the header. Looking at a single packet gives you everything you need to get access to the network - simply look at the header, use that MAC address and you’re in. Turning off your SSID broadcast is about as useless as MAC filtering. Doing both isn’t any more useful. WPA on its own is more than sufficient to keep out undesirables, and it’s easy to implement and provide access to friendlies. Don’t bother with multiple security schemes - if you have WPA enabled, suppressing SSID or MAC filtering doesn’t add any additional security value.