Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brute-forcing a macOS user’s real name from a browser using mDNS

fingerprint.com

Post reply on HN
Print view View original

141–150 of 168 posts

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#141

Post by lapcat »

giancarlostoro wrote: post #137
watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

I've heard of little snitch a ton, but is it just a really smart firewall essentially? On Windows, every darn thing connects to something, its ridiculous.

> I've heard of little snitch a ton, but is it just a really smart firewall essentially?

Yes, but why say "just"? You won't find anything better.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#142

Post by tough »

xp84 wrote: post #115
lmm wrote: post #96

Earlier quoted context omitted.

I trust my ISP a lot more than cloudflare, in part because there's actual competition and I picked one with a strong privacy focus.

Picked...an ISP? What is this fantastical idea? - An American

Granting monopolies by deafult even if geographically contained might not end up being the best way to go about competition and free markets

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#144

Post by KomoD »

RandomBK wrote: post #116
darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

A common abuser of this is the Discord desktop app, which listens on a local port. When your browser navigates to a Discord channel's join page, it sends a request to localhost via this port and sends the channel ID to the client. This lets the app pop open a native 'Join Channel' experience. I discovered this when I noticed how this behavior worked even in incognito mode and my browser was signed out of Discord. Not…

> I discovered this when I noticed how this behavior worked even in incognito mode and my browser was signed out of Discord.

That is exactly what is nice about the feature, not having to be logged in on the browser, I love it.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#145

Post by hn8305823 »

eviks wrote: post #102
watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

Except Little Snitch leaks your IP on blocks :( https://news.ycombinator.com/item?id=35363343

Also: the noscript plugin downloads every .js file first before it decides if it's not going to execute it which is a massive data leak unless you also have host file entries or firewall rules blocking access to the most common privacy abusers.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#146

Post by hn8305823 »

mrbuttons454 wrote: post #47

Fortunately for me, my device is often named something like "xxxs's MacBook Pro (34)". It's not a bug, it's a feature.

Set username to 'user' and hostname to 'hostname' on laptops. The more people who do that the better.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#147

Post by Eisenstein »

Bagged2347 wrote: post #140
inferiorhuman wrote: post #90

Earlier quoted context omitted.

False dichotomy. Not only am I pretty sure Sonic isn't selling my DNS queries, I've already opted out of DNS over HTTPS. Refusing to respect the choices I've made is worse than not. Besides, unencrypted SNI means that if my ISP wanted to get the hosts I was looking at, they could.

Can you elaborate on why you'd want to opt-out of DNS over HTTPS? I was under the impression that it was useful and good for privacy, but I may be misinformed.

It breaks DNS based blocking if you have it setup. Some people setup ad-blocking so that it encompasses their entire network and the way this works is that it silently drops DNS requests to ad domains on the edge of your local network.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#148

Post by lopkeny12ko »

> Both errors will be mapped into the same Failed to fetch JavaScript error, so we can’t rely on the error type, but we can perform a timing attack. Local networks are fast, so the valid mDNS hostname registered in the network will be resolved in a reasonable time frame, which is significantly faster than the default connection timeout. In the example above, the difference is four milliseconds for a valid address versus five seconds for an invalid one.

This isn't really a "timing attack." A timing attack implies exploitation of an unintended behavior by executing something at some specific time. This just sounds like a workaround for the fact that the Javascript API doesn't expose a way to detect a hostname resolution error, which really should exist.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#149

Post by Eisenstein »

dylan604 wrote: post #139
giancarlostoro wrote: post #137

Earlier quoted context omitted.

I've heard of little snitch a ton, but is it just a really smart firewall essentially? On Windows, every darn thing connects to something, its ridiculous.

Same with macOS. Install LittleSnitch in strict mode, and you won't go 5s without a pop up blocking something. You can either trust all of the lists that are available to keep LS somewhat out of your way, or you can go full tilt and approve everything. Personally, I've never found that middle ground.

> Personally, I've never found that middle ground.

The middle ground is setting up your own rules once and then dealing with the popups occasionally.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#150

Post by Eisenstein »

ProllyInfamous wrote: post #123
watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

>Little Snitch Just FYI, DNS-resolutions do still occur BEFORE THE POPUP DIALOGUE TO CONFIRM/DENY CONNECTION (i.e. www.example.com gets resolved to 1.1.1.1 , but no connection is made to 1.1.1.1 until `Confirm` is selected). Add a PiHole to your network, you will not regret this time/$$$/investment.

Are you saying that DNS resolution bypasses software firewalls?
Post reply on HN