Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brute-forcing a macOS user’s real name from a browser using mDNS

fingerprint.com

Post reply on HN
Print view View original

61–70 of 168 posts

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#61

Post by inferiorhuman »

cyrnel wrote: post #58
watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

In my case, I couldn't imagine configuring LittleSnitch to only allow certain hostnames from my browser. It has a "allow all traffic to 53/80/443" rule, otherwise most websites would flood me with hundreds of new LittleSnitch popups.

You'd think so, but the way I've set it up Little Snitch throws up a dialog box when a browser makes errant requests but otherwise remains silent. Most recently this caught Firefox trying to force DNS over HTTPS despite me having disabled it when it first became generally available. I suppose leaking DNS requests to Cloudflare isn't the worst thing in the world, but it would circumvent the ad blocking I've set up locally.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#62

Post by krackers »

inferiorhuman wrote: post #61
cyrnel wrote: post #58

Earlier quoted context omitted.

In my case, I couldn't imagine configuring LittleSnitch to only allow certain hostnames from my browser. It has a "allow all traffic to 53/80/443" rule, otherwise most websites would flood me with hundreds of new LittleSnitch popups.

You'd think so, but the way I've set it up Little Snitch throws up a dialog box when a browser makes errant requests but otherwise remains silent. Most recently this caught Firefox trying to force DNS over HTTPS despite me having disabled it when it first became generally available. I suppose leaking DNS requests to Cloudflare isn't the worst thing in the world, but it would circumvent the ad blocking I've set up loc…

How _do_ you have it set up? What does errant request mean in this case? A request to a domain that you haven't allowed before?

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#63

Post by doublerabbit »

watersb wrote: post #57

On my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little S…

I use NetFence [0] on my jail-broken iPhone.

It's surprising what sneaky socket connections applications connect too; including bank apps.

[0] https://havoc.app/package/netfence

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#64

Post by hot_gril »

joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

The hostname is derived from the admin user's name, which ought to also be fake. My "full name," unix username, and hostname are all a nice short "me".

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#65

Post by nonameiguess »

darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

My WiFi access points allow me to configure networks so that no devices on it are allowed to make requests to the local network. I haven't done this with networks used by my PCs, though, just for televisions and IoT devices.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#67

Post by [deleted] »

Arnavion wrote: post #39
darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

uBlock Origin static filter: ||local^$all This will block all requests to .local, even from .local itself. If you want to allow foo.local to talk to itself, say because you run a webserver on it, you'll have to add additional overrides for each such domain: @@||foo.local^$domain=foo.local,all ... or if you trust your .local entirely to allow any foo.local to talk to any bar.local, you can add one override for all of…

[deleted]

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#68

Post by collsni »

Arnavion wrote: post #39
darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

uBlock Origin static filter: ||local^$all This will block all requests to .local, even from .local itself. If you want to allow foo.local to talk to itself, say because you run a webserver on it, you'll have to add additional overrides for each such domain: @@||foo.local^$domain=foo.local,all ... or if you trust your .local entirely to allow any foo.local to talk to any bar.local, you can add one override for all of…

This essentially blocks all .local domains from the browser user gen or not

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#70

Post by Aachen »

joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

I use a random person's name because anonymous could be me but e.g. Josephine most definitely isn't a bloke.

A lesson learned with early feature phones and Bluetooth names in high school

At home my wifis are currently Japanese emojis, but anything funny goes

Post reply on HN