So many people here will go though great lengths to protect themselves from fingerprinting and snooping. However, one thing tends to get overlooked is DHCP and other layer 3 holes. When your device requests an IP it sends over a significant amount of data. DHCP fingerprinting is very similar to browser fingerprinting but unlike the browser there does not seem to be a lot of resources to defend against it. You would need to make changes to the underlying OS components to spoof it.

What are everyone’s thoughts on this? Did we miss the obvious?

https://www.arubanetworks.com/vrd/AOSDHCPFPAppNote/wwhelp/wwhimpl/common/html/wwhelp.htm#href=Chap2.html&single=true

  • Max-P@lemmy.max-p.me
    2·
    6 months ago

    Most modern operating systems randomize the MAC. DHCP does have extra fields such as the device’s hostname that can be used to counter that.

    But as I said, that’s unlikely to be the weakest link. If you don’t trust the network you’re also likely in a public environment where people can just see you anyway.

    • user134450@feddit.orgEnglish
      4·
      6 months ago

      Most modern operating systems randomize the MAC.

      [citation needed]
      having the option to randomize the MAC is not the same as actually doing that. There are also a few downsides to random MACs, like captive portals not remembering you on public WiFis.

      • delirious_owl
        1·
        6 months ago

        Captive portals not remembering you between sessions is a huge bonus for captive portals with time limits.

    • 14th_cylon@lemm.ee
      1·
      6 months ago

      Most modern operating systems randomize the MAC.

      that doesn’t seem to be uniform behaviour. but i think we agree on the merit. if you are this paranoid, you just don’t use networks where you don’t have control over the local segment.

      [admin@MikroTik] > ip arp print 
Flags: X - disabled, I - invalid, H - DHCP, D - dynamic, P - published, C - complete 
 #    ADDRESS         MAC-ADDRESS       INTERFACE                                                    
 0 DC 192.168.88.160  A2:35:xx:xx:xx:xx bridge                                                       
 1 DC 192.168.88.159  F4:60:xx:xx:xx:xx bridge                                                       
 2 DC 192.168.0.1     44:32:xx:xx:xx:xx ether1                                                       
 3 DC 192.168.88.168  18:3D:xx:xx:xx:xx bridge                                                       
 4 DC 192.168.88.156  70:BB:xx:xx:xx:xx bridge

      • ReversalHatchery@beehaw.orgEnglish
        1·
        6 months ago

        you just don’t use networks where you don’t have control over the local segment.

        Easier said than done. Sometimes it’s not an option.

        • 14th_cylon@lemm.ee
          1·
          6 months ago

          there is always an option. unless you are pressured by lets say some state authority or your employee, in which case your identity is probably well known and they don’t really need to spy on you through dhcp.