CreateGUID no longer including hardware MAC?

This is either a documentation issue, an OS version issue, or a Wine issue, but my calls to CreateGUID do not produce values ending in a MAC address.


According to
https://docs.microsoft.com/en-us/windows/desktop/api/combaseapi/nf-combaseapi-cocreateguid
https://docs.microsoft.com/en-us/windows/desktop/api/rpcdce/nf-rpcdce-uuidcreate
https://docs.microsoft.com/en-us/windows/desktop/api/rpcdce/nf-rpcdce-uuidcreatesequential

CoCreateGuid calls UuidCreate which was changed to not include MAC information. To get MAC info you need to use UuidCreateSequential instead.

I think we can treat this as a documentation problem, don't you? Having your actual MAC in the string could leak information about you (if you made it public) whereas it seems at present that you just get a GUID.

Maybe. I found this because I was actually looking for a way to find the MAC for something. If someone just wants a large random number, there are much better formats for that than hex strings.

It was more that you wanted a unique number. Two people could easily generate the same random number.

Non-hardware-based GUIDs are really nothing more than big random numbers[0]. It's all a house of cards. GUID/UUIDs are only probably unique, not guaranteed to be so.

[0] - https://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_(random)

Anyway, it's possible to call UuidCreateSequential directly via the rpcrt4.dll and Lua/LuaJIT's FFI so I'm fine going either way on this. MAC randomization[0] might make knowing MAC addresses less useful in the future anyway.

[0] - https://support.microsoft.com/en-us/help/4027925/windows-how-and-why-to-use-random-hardware-addresses

I’m not convinced MAC addresses are actually unique anyway, so any advantage of using them for uniqueness is lost.

See Wikipedia - MAC address

Although intended to be a permanent and globally unique identification, it is possible to change the MAC address on most modern hardware. Changing MAC addresses is necessary in network virtualization. It can also be used in the process of exploiting security vulnerabilities. This is called MAC spoofing.

On the Arduino, for example, you specify your desired MAC address in software. I’ve also seen, I think, configuration settings on PCs where you can choose a different MAC address if you want.

That's also true.

I've modified the documentation to remove references to the MAC. The online documentation is updated immediately, the documentation that ships with the client will change on the next release.