Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brute-forcing a macOS user’s real name from a browser using mDNS

fingerprint.com

Post reply on HN
Print view View original

111–120 of 168 posts

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#111

Post by vogon_laureate »

pyrolistical wrote: post #54
vogon_laureate wrote: post #36

This is interesting, well written up and even has a nice proof of concept. Nicely done! A fun countermeasure would be to change the device hostname to something like atemptingurl.local that entices the attacker to try visiting that website where a webpage is carefully crafted to run the exact same technique on them and return: "Hi [hacker's device name]! Your machine information, IP address, geolocation and other fin…

You would need to be running a http server with CORS allow all. You would then also reduce your own security as you are now exposed to all the bugs in the chosen http server

No pain, no gain.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#112

Post by fsflover »

cwales95 wrote: post #73
collsni wrote: post #69

If only disabling JavaScript didn't disable end user experience lol

This is the only thing stopping me from globally disabling JavaScript. I predict in the future through, I’ll have no choice but to have it off by default due to privacy concerns

I already do this on my phone. Makes it faster, too.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#113

Post by KingLancelot »

fsflover wrote: post #112
cwales95 wrote: post #73

Earlier quoted context omitted.

This is the only thing stopping me from globally disabling JavaScript. I predict in the future through, I’ll have no choice but to have it off by default due to privacy concerns

I already do this on my phone. Makes it faster, too.

[dead]

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#114

Post by marlz »

bozhark wrote: post #85
watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

Little Snitch is amazing. Any windows comparable?

I used to use tinywall on Windows. https://tinywall.pados.hu/

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#115

Post by xp84 »

lmm wrote: post #96
brazzledazzle wrote: post #79

Earlier quoted context omitted.

Better cloudflare than your ISP that's already explicitly intercepting your dns queries to sell your data/profile.

I trust my ISP a lot more than cloudflare, in part because there's actual competition and I picked one with a strong privacy focus.

Picked...an ISP? What is this fantastical idea?

- An American

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#116

Post by RandomBK »

darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

A common abuser of this is the Discord desktop app, which listens on a local port.

When your browser navigates to a Discord channel's join page, it sends a request to localhost via this port and sends the channel ID to the client. This lets the app pop open a native 'Join Channel' experience.

I discovered this when I noticed how this behavior worked even in incognito mode and my browser was signed out of Discord.

Not. Cool. We need to massively improve sandboxing - of all applications - in the desktop world.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#118

Post by xp84 »

doublerabbit wrote: post #63
watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

I use NetFence [0] on my jail-broken iPhone. It's surprising what sneaky socket connections applications connect too; including bank apps. [0] https://havoc.app/package/netfence

How do you even use bank apps on a jailbroken phone? Last time I was JB'd everything from McDonald's to my bank just threw up a big 'no' and refused to even work.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#119

Post by sarnowski »

lmm wrote: post #96
brazzledazzle wrote: post #79

Earlier quoted context omitted.

Better cloudflare than your ISP that's already explicitly intercepting your dns queries to sell your data/profile.

I trust my ISP a lot more than cloudflare, in part because there's actual competition and I picked one with a strong privacy focus.

And in some/many jurisdictions, your ISP is more regulated by your local government (also in regards to data protection) than cloudflare who has no obligation to you.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#120

Post by BiteCode_dev »

watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

I've used a similar software for linux: open snitch.

I never caught anything weird, but it surely annoyed me a lot for all my basic tasks.

Post reply on HN