On a typical Linux distro, what information do WiFi access points get when you search for and use another AP?
2026-04-29 02:32 UTC
Replies (5)
-
@Maiq@piefed.social 2026-04-29 03:16
If you and the attacker share the same network the attacker can get all sorts if info. Tools like nmap show things like ip, mac, ports and os detection. You can use macchanger to randomize your mac. I think there is a setting in networkmanager to do this. Been a while since I looked in the settings.
-
@Scipitie@lemmy.dbzer0.com 2026-04-29 04:54
Oh boy! First: Thank you - I thought to briefly validate my knowledge and understanding before answering and went down a rabbit hole :D this is my current grasp, happy to be corrected! First: Most is actually not even distro agnostic but also OS agnostic: Most modern wifi devices when you tell them to “connect to WiFi” radiates, literally, what it can do and what kind of connection it wants. E.g. im a wifi device with WPA3 capabilities and this is my Mac address to answer me. OS specific is the question if your Mac address gets scrambled or not. For both iwd and networkmanager, which both support it, have it turned off by default. There is a big advantage to being able to be recognizable on friendly networks after all. Now comes the part I wasn’t aware: Even your hostname is often still broadcasted publicly! This happens during the DHCP handshake - and many devices don’t support apparently existing standards to address this gap. It’s all about securing the first frames where devices align on communication standards, encryption way, etc. This seems to still be quite public. Android was easier (and iOS seems to be the same but I didn’t bother with that more): Same as Linux but more aggressive by default: Mac scrambling all the time, DHCP uses obscure strings as hostnames, etc. Fun fact: even those have stable max addresses once connected. Again, getting the same DHCP lease and being able to whitelist or recognized by the network seems to have more upsights than I was aware of.
-
@ghodawalaaman@programming.dev 2026-04-29 07:04
if you are using fedora they randomize your mac address
-
@RodgeGrabTheCat@sh.itjust.works 2026-04-29 08:30
I have no idea about Linux but on GrapheneOS the MAC address is randomized with each connection.The phone appears to be a different device each time.
-
@ApertureUA@lemmy.today 2026-04-29 12:06
Most compromised routers scrape the hostname (both regular and mDNS) and MAC address. What you do is disable mDNS related daemons like kdeconnect and avahi (until you want them) and put this in /etc/NetworkManager/NetworkManager.conf: [main] hostname-mode=none [device] wifi.scan-rand-mac-address=yes [connection] ethernet.cloned-mac-address=random wifi.cloned-mac-address=random connection.mdns=0 connection.llmnr=0 (yes, the mdns bit above is a bit redundant, but systemd has something related that might read it and better be safe than sorry) This won’t protect you if the router is a bit smarter and can see your NTP server (usually like “x.archlinux.pool.ntp.org” instead of just “x.pool.ntp.org”), your connectivity check (same as NTP) and other servers your machine connects to (like Tor nodes if you have the daemon running and oftc.net if you have an IRC client). The good news is that none are known to check that (at least to me).