Hacker News Reader

Comment by brotherjerky | Hacker News Reader

> Leakers shouldn’t use their work computers and should use public wifi, “like a Starbucks or at a hotel or anywhere where the Internet is open for public use.”

Lately there seem to be very few completely open wifi points. Most of them at least require some click through for agreeing to terms. Is there any risk involved here?

View on HN

All of the ones with click thru terms of service are logging your MAC too.

My personal favorite open wifi service is the one on Amtrak, and you can buy a paper ticket with cash. Pretty anonymous.

Any AP knows your MAC, as that's the basis of how Ethernet works.

Changing your MAC address is possible on most operating systems, if you're at that level of paranoia.

If you where leaking a document that involved the NSA/GCHQ I'm not sure it would be paranoia or that there is a sufficient level of paranoia.

They aren't Godlike but I'll admit the Snowden revelations surprised me and I'd been following that stuff for years.

And there's nothing special about your MAC, changing your address is as easy as editing a single setting.

Yes thanks. The point is those click-thru landing pages work by temporarily whitelisting your MAC, which means they have a list of MACs somewhere. The MAC information needed by ordinary networks is ephemeral.

Even without click-throughs. Comcast Business routers keep a log of every MAC that's ever connected wirelessly. Granted I think it's a bug as it causes the MAC whitelisting page to take like a minute to load.

Even my Mikrotik at home logs MACs by default. The log is small and not persisted, but log entries definitely stick around a few days.

Don't count on your MAC not being logged.

And if the router itself isn't doing it, there are programs like arpwatch.

DHCP also works by recording your MAC (so that you can renew your IP, and another computer can't). Most DHCP servers write their lease files to disk. Most also log to disk. I wouldn't consider the absence of a captive portal to be a strong signal.

I wish Apple would extend the mac randomization for probe packets to normal operation (as an optional setting).

Hypothetical:

A journalist uses some apple computer. If its new, Tails won't be able to establish a network interface, so maybe there is a usb wifi dongle as well.

When entering boot mode (restart with option key pressed), in order to select Tails, wifi networks are shown.

You are suggesting that Apple is leaking the MAC address of the computer to all AP before Tails is even selected to boot from.

This suggests that any MAC address randomization the user intended to use for the built in computer wifi or the dongle via Tails will be partially defeated.

Many AP will log the original MAC immediately and one (the one chosen for wifi after Tails boots) will log the randomized Tails MAC.

Is this correct assumption?

EDIT: After rereading it sounds like you are saying they DO randomize probe packets and the scenario I describe above does not occur, NO MAC is leaked during Tails boot selection process on apple hardware.

Can anyone confirm this?

Does MAC address randomization apply to desktops/laptops? Google implies its iOS-only.

Not that I'd advocate something like this, because you could get some innocent homeowner in a bunch of trouble, but it generally doesn't take long to drive or walk around and find an unprotected access point on a personal router.

Also known was "wardriving".

Schneier has written about (and sort of advocates) being on the receiving end of this [0]:

   I spoke to several lawyers about this, and in their lawyerly way they outlined several other risks with leaving your network open.

   While none thought you could be successfully prosecuted just because someone else used your network to commit a crime, any investigation could be time-consuming and expensive.

[0] - https://www.schneier.com/blog/archives/2008/01/my_open_wirel...

Is this still true? I never notice open residential access points any more. The last few times I've set up new residential Internet service it has come with a Wifi router that has a password by default.

What would you define as completely open? I mean, the very act of leaking data is a risk; you're performing an act of civil disobedience, which while for the greater good is still likely to land you in some legal trouble if you get caught, depending on what you're leaking. I think breaking the ToS on an access point in starbucks or mcdonalds would probably be inconsequential overall, and any follow up litigation by the owner of the AP would probably just attract undesired hostile attention towards the owner.

I mean, mostly, open access APs are set-and-forget amenities. Most places don't even bother to change the default root login for the AP. I really don't think they're suddenly going to care about what someone uploaded from their AP; certainly I can envision law enforcement or federal agencies making a case out of it if it served their needs, but I doubt this is going to be high on their list.

He's not worrying about Terms of Service, but about being logged and traceable later on.

Reply on news.ycombinator.com