[flagged]
Brute-forcing a macOS user’s real name from a browser using mDNS
71–80 of 168 posts
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#72Earlier quoted context omitted.
You'd think so, but the way I've set it up Little Snitch throws up a dialog box when a browser makes errant requests but otherwise remains silent. Most recently this caught Firefox trying to force DNS over HTTPS despite me having disabled it when it first became generally available. I suppose leaking DNS requests to Cloudflare isn't the worst thing in the world, but it would circumvent the ad blocking I've set up loc…
How _do_ you have it set up? What does errant request mean in this case? A request to a domain that you haven't allowed before?
Ah so I just dug into the rules. What happened was a plugin made a DNS request to mozilla.cloudflare-dns.com. I've nothing special set up for Firefox, but basically no rules for plugin-container, so when a plugin tries to make a DNS request Little Snitch pops up an alert.
Not great I suppose, but better than nothing. Generally what I'll see for Firefox itself are requests for non 80/443 ports.
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#73If only disabling JavaScript didn't disable end user experience lol
This is the only thing stopping me from globally disabling JavaScript.
I predict in the future through, I’ll have no choice but to have it off by default due to privacy concerns
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#74As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.
I do the same, mostly because I don't like my full name showing up in every subpath of the home directory. Sometimes this leaks far beyond your local computer, too, since many build tools include some path info in the compiled binaries. You can download apps from the app store, run `strings` on them, and find the username of the developer who built the binary.
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#75As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.
I use a random person's name because anonymous could be me but e.g. Josephine most definitely isn't a bloke. A lesson learned with early feature phones and Bluetooth names in high school At home my wifis are currently Japanese emojis, but anything funny goes
Ideally you'd use the most common name, in order to maximize the size of your anonymity set. So you could go with "John Appleseed" to get a "john" home directory and a "John's MacBook Pro" hostname. But in a small community, to local observers seeing your device on bluetooth screens, you might get weird looks ("there is no John here, why is this sus?") whereas "iPhone" looks like a default. And for non-local observers, your choice of a name like "John" suggests you're a westerner named John. So by just going with "iPhone" or "MacBook" you're in a smaller anonymity set but also not drawing attention to yourself in your local area, and not externally leaking information like your locale (although of course you could always leave a false trail by using a cyrillic hostname).
Some other leaky, seemingly private identifiers are SSH pubkeys (I always delete the comment trailer), which are sent to every server you SSH to and also published to places like GitHub, and WiFi SSIDs (which are visible to any application with access to the network stack, and unfortunately aren't entirely within your control - often a list of nearby SSIDs, combined with a mapping of SSID to geolocation, is enough to triangulate your location to within a meter, which is one of many reasons I disable WiFi in favor of ethernet whenever possible).
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#76Earlier quoted context omitted.
My hotspot on my phone is "FBI van 4"
I see this joke frequently when looking at available wifi; is this meme a reference to a particular thing (other than the FBI having surveillance vans) or did a bunch of people just converge onto it?
Some years ago there was a lot of stuff on 4Chan about “FBI party van”, “vanned”, v&, etc. I’m guessing that’s part of where it has come from.
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#77Earlier quoted context omitted.
It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex
Rather than choosing at random, I like to pick names that have some relation to the device in question, e.g. "Pichu" for a tiny mobile device, "Snorlax" for the big slow machine, "Articuno/Zapdos/Moltres" for three successive powerful servers, etc. What's extra fun about Pokemon, if you're familiar with the franchise, is that you can pick names based on generation, with older generations for e.g. older devices, and i…
I was so proud of my spec'd out M1 Max MacBook Pro that I named it "Arceus", the god of the Pokemon universe.
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#78Earlier quoted context omitted.
I do the opposite: one of my laptops is named "Peter's iPhone" (hint: my name is not Peter, nor do I own an iPhone) and I've also set all my Bluetooth to random Bluetooth headset or mouse models.
My hotspot on my phone is "FBI van 4"
Hey! I'm FBI and NSA Guest :)
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#79Earlier quoted context omitted.
In my case, I couldn't imagine configuring LittleSnitch to only allow certain hostnames from my browser. It has a "allow all traffic to 53/80/443" rule, otherwise most websites would flood me with hundreds of new LittleSnitch popups.
You'd think so, but the way I've set it up Little Snitch throws up a dialog box when a browser makes errant requests but otherwise remains silent. Most recently this caught Firefox trying to force DNS over HTTPS despite me having disabled it when it first became generally available. I suppose leaking DNS requests to Cloudflare isn't the worst thing in the world, but it would circumvent the ad blocking I've set up loc…
Better cloudflare than your ISP that's already explicitly intercepting your dns queries to sell your data/profile.
Re: Brute-forcing a macOS user’s real name from a browser using mDNS
#80Earlier quoted context omitted.
I use a random person's name because anonymous could be me but e.g. Josephine most definitely isn't a bloke. A lesson learned with early feature phones and Bluetooth names in high school At home my wifis are currently Japanese emojis, but anything funny goes
Ideally you'd use the most common name, in order to maximize the size of your anonymity set. So you could go with "John Appleseed" to get a "john" home directory and a "John's MacBook Pro" hostname. But in a small community, to local observers seeing your device on bluetooth screens, you might get weird looks ("there is no John here, why is this sus?") whereas "iPhone" looks like a default. And for non-local observer…
> seemingly private identifiers are SSH pubkeys (I always delete the comment trailer), which are sent to every server you SSH to and also published to places like GitHub
I use this in my .ssh/config file:
Host *
IdentitiesOnly = yes
More discussion: https://news.ycombinator.com/item?id=10004678