So many people here will go though great lengths to protect themselves from fingerprinting and snooping. However, one thing tends to get overlooked is DHCP and other layer 3 holes. When your device requests an IP it sends over a significant amount of data. DHCP fingerprinting is very similar to browser fingerprinting but unlike the browser there does not seem to be a lot of resources to defend against it. You would need to make changes to the underlying OS components to spoof it.
What are everyone’s thoughts on this? Did we miss the obvious?
- irq0 ( @irq0@infosec.pub ) 9•3 months ago
I feel like I’m missing something here…
Who’s going to be fingerprinting DHCP messages on your home network?
Outside of that, fingerprinting or tracking any DHCP info would be the least of my concerns. You have 0 control over any data the moment your devices connect to a public network. What use is DHCP info when you can person-in-the middle all the traffic anyway?
And anyway, what info are you concerned about? Having had a VERY quick browse of RFC2131 the worst thing would be “leaking” the device MAC address which can be discovered via several other means anyway
- Max-P ( @Max_P@lemmy.max-p.me ) 5•3 months ago
I guess the hostname could be used to defeat MAC randomization if you use public WiFi like hotels, airports and coffee shops. You could probably identify repeat users if you cared enough.
But then your worry should be the security cameras not the WiFi, because that’s what’s gonna tie you personally to your device connecting.
- 14th_cylon ( @14th_cylon@lemm.ee ) 2•3 months ago
Your router always knows your Mac address, no matter how you got your ip assigned. And yes, you can use it to identify the client - that is why it is there. This whole post is nonsense written by someone who doesn’t really understand what dhcp is or how it works. Long story short, don’t look for privacy on local Ethernet segment :D
- Max-P ( @Max_P@lemmy.max-p.me ) 2•3 months ago
Most modern operating systems randomize the MAC. DHCP does have extra fields such as the device’s hostname that can be used to counter that.
But as I said, that’s unlikely to be the weakest link. If you don’t trust the network you’re also likely in a public environment where people can just see you anyway.
- user134450 ( @user134450@feddit.org ) English4•3 months ago
Most modern operating systems randomize the MAC.
[citation needed]
having the option to randomize the MAC is not the same as actually doing that. There are also a few downsides to random MACs, like captive portals not remembering you on public WiFis.- redjard ( @Redjard@lemmy.dbzer0.com ) 2•3 months ago
The default on android is to give every wifi network its own random but static mac.
- delirious_owl ( @delirious_owl@discuss.online ) 1•3 months ago
Captive portals not remembering you between sessions is a huge bonus for captive portals with time limits.
- 14th_cylon ( @14th_cylon@lemm.ee ) 1•3 months ago
Most modern operating systems randomize the MAC.
that doesn’t seem to be uniform behaviour. but i think we agree on the merit. if you are this paranoid, you just don’t use networks where you don’t have control over the local segment.
[admin@MikroTik] > ip arp print Flags: X - disabled, I - invalid, H - DHCP, D - dynamic, P - published, C - complete # ADDRESS MAC-ADDRESS INTERFACE 0 DC 192.168.88.160 A2:35:xx:xx:xx:xx bridge 1 DC 192.168.88.159 F4:60:xx:xx:xx:xx bridge 2 DC 192.168.0.1 44:32:xx:xx:xx:xx ether1 3 DC 192.168.88.168 18:3D:xx:xx:xx:xx bridge 4 DC 192.168.88.156 70:BB:xx:xx:xx:xx bridge
- ReversalHatchery ( @ReversalHatchery@beehaw.org ) English1•3 months ago
you just don’t use networks where you don’t have control over the local segment.
Easier said than done. Sometimes it’s not an option.
- 14th_cylon ( @14th_cylon@lemm.ee ) 1•3 months ago
there is always an option. unless you are pressured by lets say some state authority or your employee, in which case your identity is probably well known and they don’t really need to spy on you through dhcp.
- ReversalHatchery ( @ReversalHatchery@beehaw.org ) English1•3 months ago
Long story short, don’t look for privacy on local Ethernet segment :D
You seem to be forgetting that a lot of people use portable devices on other networks than their home one.
- 14th_cylon ( @14th_cylon@lemm.ee ) 1•3 months ago
i am not forgetting anything. using your portable device on network other than your own is your free choice and if you are such control freak that you are afraid of being spied on through dhcp, you probably should not do that.
See the linked page
- delirious_owl ( @delirious_owl@discuss.online ) 1•3 months ago
Wear a mask and sunglasses so you just blend in.
You can’t easily man in the middle https with encrypted DNS
- delirious_owl ( @delirious_owl@discuss.online ) 1•3 months ago
Why would encrypted DNS help here? HTTP(S) uses IPs
IPs are arbitrary
- MonkderDritte ( @MonkderDritte@feddit.de ) 2•3 months ago
I mean, yeah. Lots of shopping centers have devices specialized on fingerprinting mac adress. It was already 10 years ago a thema that you should disable wlan and bluetooth if you go out of the house.
Phones randomized Macs
- MonkderDritte ( @MonkderDritte@feddit.de ) 1•3 months ago
Oh right, i forgot that’s the reason Androids do this now too.
- jet ( @jet@hackertalks.com ) English2•3 months ago
Using randomized MAC on my phone’s, and observing the behavior on my network. It works fine, the router can’t assign a ip to the device because the physical address changes. The os fingerprinting still works, the gateway knows what kind of device it’s talking to.
- delirious_owl ( @delirious_owl@discuss.online ) 2•3 months ago
Android? How do I force it to use a random Mac every time? It pins a random Mac to a given network, which greatly reduces privacy between sessions.
- jet ( @jet@hackertalks.com ) English1•3 months ago
Developer settings for newer androids.
GOS has it on by default https://grapheneos.org/features#wifi-privacy
- delirious_owl ( @delirious_owl@discuss.online ) 0•3 months ago
How do I install this on non-Graphene OS?
- jet ( @jet@hackertalks.com ) English1•3 months ago
- delirious_owl ( @delirious_owl@discuss.online ) 2•3 months ago
Eh, I tried it. It doesn’t work. Even the option says that it “may” change the mac on reconnect.
- jet ( @jet@hackertalks.com ) English1•3 months ago
What android are you running?
- delirious_owl ( @delirious_owl@discuss.online ) 1•3 months ago
14
- Arthur Besse ( @cypherpunks@lemmy.ml ) English1•3 months ago
If you use systemd’s DHCP client, since version 235 you can set
Anonymize=true
in your network config to stop sending unique identifiers as per RFC 7844 Anonymity Profiles for DHCP Clients. (Don’t forget to also setMACAddressPolicy=random
.)