在 Hacker News 上看到透過 mDNS 建立 fingerprint 的方式，進而定位使用者身分：「Brute-forcing a macOS user’s real name from a browser using mDNS (fingerprint.com)」，原文在「Demo: Brute-forcing a macOS user’s real name from a browser using mDNS」。
利用發 HTTP(s) request 出去時，雖然都是傳回 Failed to fetch 錯誤，但因為 hostname 存在時會是 connection timeout，而不存在時會直接因為 DNS 查不到而很快 failed 掉，這個時間差異產生了 side channel，可以透過時間差異知道某個 hostname 是否存在。
這個技巧配合字典就可以大量掃描 *.local 的 mDNS 網段，進而產生出內部網路的 fingerprint。
這個問題應該是有標準解法 (或是有被提案過的解法)，就是不讓 internet domain 存取 local domain 的東西，像是避免 internet 上的網站透過 JavaScript 碰到 http://127.0.0.1:xxx/ 的機制。
應該是把 *.local 用同樣方式對待就能避開這個問題？
正文完
可以使用微信扫码关注公众号（ID：xzluomor）
ufabet
มีเกมให้เลือกเล่นมากมาย: เกมเดิมพันหลากหลาย ครบทุกค่ายดัง
tornado crypto mixer
Discover the power of privacy with TornadoCash! Learn how this decentralized mixer ensures your transactions remain confidential.
ดูบอลสด
Very well presented. Every quote was awesome and thanks for sharing the content. Keep sharing and keep motivating others.
ดูบอลสด
Pretty! This has been a really wonderful post. Many thanks for providing these details.
ดูบอลสด
Pretty! This has been a really wonderful post. Many thanks for providing these details.
ดูบอลสด
Hi there to all, for the reason that I am genuinely keen of reading this website’s post to be updated on a regular basis. It carries pleasant stuff.
Obrazy Sztuka Nowoczesna
Thank you for this wonderful contribution to the topic. Your ability to explain complex ideas simply is admirable.
ufabet
Hi there to all, for the reason that I am genuinely keen of reading this website’s post to be updated on a regular basis. It carries pleasant stuff.
ufabet
Very well presented. Every quote was awesome and thanks for sharing the content. Keep sharing and keep motivating others.
