Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brute-forcing a macOS user’s real name from a browser using mDNS

fingerprint.com

Post reply on HN
Print view View original

101–110 of 168 posts

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#101

Post by TheNewsIsHere »

pndy wrote: post #34
joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

That reminded me that almost 10 years ago ghacks [1] instructed people to add _nomap to their Wifi networks name to avoid these being harvested by Google and Mozilla. I wonder if that ever worked or still does and if companies stopped collecting that information. [1] - https://www.ghacks.net/2014/10/29/add-_nomap-to-your-routers...

Officially this is still supported. With that said, there have in past years been data sanitizing failures which get them mapped anyway. Google caught a little flack for that several years ago.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#102

Post by eviks »

watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

Except Little Snitch leaks your IP on blocks :(

https://news.ycombinator.com/item?id=35363343

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#105

Post by electrondood »

nneonneo wrote: post #8
tentacleuno wrote: post #3

Earlier quoted context omitted.

It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex

Rather than choosing at random, I like to pick names that have some relation to the device in question, e.g. "Pichu" for a tiny mobile device, "Snorlax" for the big slow machine, "Articuno/Zapdos/Moltres" for three successive powerful servers, etc. What's extra fun about Pokemon, if you're familiar with the franchise, is that you can pick names based on generation, with older generations for e.g. older devices, and i…

My company uses codenames like this for our services and it drives me insane every time I have to go look up which is which or mentally convert to the name it should have been given.

At work, let's just call things what they are.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#106

Post by electrondood »

varenc wrote: post #7
tentacleuno wrote: post #3

Earlier quoted context omitted.

It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex

I do the same thing but with Star Trek words! I have a somewhat logical naming scheme too. Computers are named after Star Trek ships (Yorktown), phones are named after handheld devices (Phaser), and drives are storage related things (Isolinear). And my printers are just named Replicator and Synthesizer.

This is fun.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#107

Post by nier »

nop_slide wrote: post #97
Syonyk wrote: post #59

The more time passes, the more comfortable I feel about mostly interacting with the internet from a Qubes box, in a disposable Whonix/Tor VM, with Javascript disabled... This is just gross. I mean, not surprising. But appalling in so many ways that it's even possible. If you're not familiar with fingerprint.com, they do "deep user profiling" - think "maintaining a constant user ID across computers, browsers, OSes, et…

Wow it totally recognizes my same device across different VPN IPs. Creepy indeed

In my tests it only recognizes the same browser. I’m a different person when using different browsers. I noticed that I can still be correctly fingerprinted after resetting the browser or using a private window.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#108

Post by leohonexus »

electrondood wrote: post #105
nneonneo wrote: post #8

Earlier quoted context omitted.

Rather than choosing at random, I like to pick names that have some relation to the device in question, e.g. "Pichu" for a tiny mobile device, "Snorlax" for the big slow machine, "Articuno/Zapdos/Moltres" for three successive powerful servers, etc. What's extra fun about Pokemon, if you're familiar with the franchise, is that you can pick names based on generation, with older generations for e.g. older devices, and i…

My company uses codenames like this for our services and it drives me insane every time I have to go look up which is which or mentally convert to the name it should have been given. At work, let's just call things what they are.

Sounds like that would be a perfect simple application for a go/ link or a Raycast extension, just saying :p

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#109

Post by Ycdr4thfdd »

nier wrote: post #107
nop_slide wrote: post #97

Earlier quoted context omitted.

Wow it totally recognizes my same device across different VPN IPs. Creepy indeed

In my tests it only recognizes the same browser. I’m a different person when using different browsers. I noticed that I can still be correctly fingerprinted after resetting the browser or using a private window.

Using Firefox (on a Linux laptop) with resistfingerpriting=true or Mull (on an Android) with its default settings, I'm able to get assigned a new fingerprint whenever I clear cookies or use a new Incognito session.

I haven't tested it, but presumably they also wouldn't be able to track me between domains, even without clearing cookies.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#110

Post by Affric »

Ycdr4thfdd wrote: post #109
nier wrote: post #107

Earlier quoted context omitted.

In my tests it only recognizes the same browser. I’m a different person when using different browsers. I noticed that I can still be correctly fingerprinted after resetting the browser or using a private window.

Using Firefox (on a Linux laptop) with resistfingerpriting=true or Mull (on an Android) with its default settings, I'm able to get assigned a new fingerprint whenever I clear cookies or use a new Incognito session. I haven't tested it, but presumably they also wouldn't be able to track me between domains, even without clearing cookies.

So it gets me on MacOS with safari, lynx, and firefox with strict anti-tracking on.

Tor works for blocking it.

All in all they have created a creepy wee tool.

Post reply on HN