Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brute-forcing a macOS user’s real name from a browser using mDNS

fingerprint.com

Post reply on HN
Print view View original

21–30 of 168 posts

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#21

Post by doakes »

capableweb wrote: post #11
darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

They generally can't, because of CORS. The only reason this "hack" works is because the timing of the rejection is different between non-resolving domain request and resolving-but-rejected request. But if you run something on https://192.168.2.1 it can't be accessed from a web app running on https://my-own-domain.com unless the service running at 192.168.2.1 allows the "Origin" my-own-domain.com.

Technically they can make the request. The server will receive and respond to the request. CORS is applied by the browser which prevents the response from being read. This is why CORS doesn't prevent a request from mutating something on a server. A CSRF token does.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#22

Post by Arech »

franga2000 wrote: post #9
joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

I do the opposite: one of my laptops is named "Peter's iPhone" (hint: my name is not Peter, nor do I own an iPhone) and I've also set all my Bluetooth to random Bluetooth headset or mouse models.

Bluetooth on my old phone is named as "Pfizer-BioNTech chip #" :D

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#23

Post by johannes1234321 »

tentacleuno wrote: post #3
joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex

If youlook for a naming scheme: this wiki has you covered

https://namingschemes.com/Main_Page

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#24

Post by rmccue »

userbinator wrote: post #18

In the example above, the difference is four milliseconds for a valid address versus five seconds for an invalid one. This is surprising --- I'd expect a DNS lookup failure to be much faster than a default connection timeout which comes after a successful DNS lookup. That said, I've always found the s-mac-xxxx to be a bit of an odd choice, especially considering it's from a company that advertises privacy as a huge s…

> This is surprising --- I'd expect a DNS lookup failure to be much faster than a default connection timeout which comes after a successful DNS lookup.

Unlike regular DNS where you're asking a single server at a single IP for a yes/no answer, mDNS is multicast, so no single server can authoritatively say no†. You can only detect that there are no records when the lookup times out because no servers have responded.

† Not technically true, a device can say no if it knows it owns that name.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#25

Post by aidos »

doakes wrote: post #21
capableweb wrote: post #11

Earlier quoted context omitted.

They generally can't, because of CORS. The only reason this "hack" works is because the timing of the rejection is different between non-resolving domain request and resolving-but-rejected request. But if you run something on https://192.168.2.1 it can't be accessed from a web app running on https://my-own-domain.com unless the service running at 192.168.2.1 allows the "Origin" my-own-domain.com.

Technically they can make the request. The server will receive and respond to the request. CORS is applied by the browser which prevents the response from being read. This is why CORS doesn't prevent a request from mutating something on a server. A CSRF token does.

Is that true? There’s a preflight request that checks with the server as to what’s allowed and then the browser issues the original request if it’s ok, right?

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#26

Post by mlyle »

userbinator wrote: post #18

In the example above, the difference is four milliseconds for a valid address versus five seconds for an invalid one. This is surprising --- I'd expect a DNS lookup failure to be much faster than a default connection timeout which comes after a successful DNS lookup. That said, I've always found the s-mac-xxxx to be a bit of an odd choice, especially considering it's from a company that advertises privacy as a huge s…

> default connection timeout which comes after a successful DNS lookup.

In addition to the sibling's comment, the other factor is that they received a "connection refused" -- RST, not a connection timeout.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#27

Post by TechBro8615 »

darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

Brave recently added a feature requiring permission to access the local network:

https://brave.com/privacy-updates/27-localhost-permission/

On HN: https://news.ycombinator.com/item?id=36574775

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#28

Post by dunham »

tentacleuno wrote: post #3
joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex

I've been using chili peppers (peri, shishito, ancho, ...) for my devices for the last few years. Many years before that, I was using named swords (notung, glamdring, sting, etc).

Back in college my boss named a sun workstation lab with aleutian islands, and another after indonesian islands. (Some of those were fun to remember, there was an umnak and an unimak.) The servers were named after seas and oceans. We tried to name a new lab of windows machines after bugs, but the department nixed that.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#29

Post by wil421 »

joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

I prefix all my device names with “My”. My iPhone, My AirPods, My MacBook Air, and so on.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#30

Post by eindiran »

vorticalbox wrote: post #16
franga2000 wrote: post #9

Earlier quoted context omitted.

I do the opposite: one of my laptops is named "Peter's iPhone" (hint: my name is not Peter, nor do I own an iPhone) and I've also set all my Bluetooth to random Bluetooth headset or mouse models.

My hotspot on my phone is "FBI van 4"

I see this joke frequently when looking at available wifi; is this meme a reference to a particular thing (other than the FBI having surveillance vans) or did a bunch of people just converge onto it?
Post reply on HN