To do it right, you don't want a six byte random number, but only 46 random bits. Two of the MAC address bits are reserved to distinguish unicast vs. multicast, and globally unique (OUI) vs. locally administered. For a random MAC address for normal (unicast) use, these bits should be set to 0 and 1, respectively. They are the least significant bit and next to the least significant bits of the first octet, so the first octet in binary should be xxxxxx01.
By using a locally administered MAC address you avoid both having everyone that sees the MAC address able to determine what entity assigned the address, and the possibility of collision with any other device on your network that uses a "normal" MAC address (globally unique). You still have the possibility of collision with a locally administered MAC address on your local network.
There also seems to be a lot of confusion in general (but not in this article) about how MAC addresses are used. When you use your web browser to get a web page from a server off in the internet somewhere, that server generally does not get your MAC address, but only your IP address. The MAC address is only used on your Local Area Network (LAN), which is Ethernet or Wifi. However, as stated in the article, other devices on your same LAN, including iPhones and such using Wifi, do get to see your MAC address.
Posted Dec 6, 2012 18:46 UTC (Thu) by BenHutchings (subscriber, #37955)
[Link]
The interface's MAC address is used for the local part of its IPv6 addresses, by default. (The 'privacy extensions' for IPv6 allow you to randomise the local part, but this is not robust to local attack.) And the gateway router or DHCP server on the LAN might log or otherwise expose the MAC address to remote peers.