be prepared for the german law for big WLAN hot spots

NeddySeagoon · Posted: Sat Apr 11, 2015 5:01 pm Post subject:

toralf,

Will we be able to get these big WLAN hot spots in Scotland :)
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

toralf · Posted: Sat Apr 11, 2015 6:32 pm Post subject:

yeah, btw (in german) : http://www.heise.de/newsticker/meldung/Oeffentliche-WLAN-Hotspots-sollen-schnueffeln-helfen-2599623.html

UberLord

toralf

UberLord · Posted: Tue Apr 14, 2015 1:42 pm Post subject:

Of far greater concern is sites you visit tracking the EUI64 component of your SLAAC address - so they have your MAC address regardless of the hotspot itself.
Luckily dhcpcd defaults to providing a private stable SLAAC address without any MAC details being leaked past the router

_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool

UberLord · Posted: Tue Apr 14, 2015 1:44 pm Post subject:

steveL · Posted: Fri Apr 17, 2015 6:47 am Post subject:

toralf · Posted: Fri Apr 17, 2015 8:22 am Post subject:

steveL · Posted: Fri Apr 17, 2015 6:23 pm Post subject:

Yeah that'd be cool, toralf.

krinn · Watchman Joined: 02 May 2003 Posts: 7470

Sorry for being curious. What this law is about?

toralf · Posted: Sat Apr 18, 2015 4:39 pm Post subject:

krinn · Watchman Joined: 02 May 2003 Posts: 7470

Ah, i knew it was something stupid again.
Looks like european countries cannot work together, but when it comes to do shit, even following different paths, they all walk toward the same direction.

french did it easier btw, we have the great entity that attack the IP owner (lol yeah, i know, you were thinking nobody could do worst than germans, but french beat you badly).
Of course our ISP add free wifi option that takes few of your bandwith to provide free wifi to other travellers next to your spot, combine that with the "your IP is the badass, so you're the rat" ; wonder result

It would be laughable if they (our politicians) weren't pay to do that crap, but they are, and with good big numbers.

steveL · Posted: Sun Apr 19, 2015 2:33 am Post subject:

krinn · Watchman Joined: 02 May 2003 Posts: 7470

Yeah steveL, but something you read as "is" was written as "shall be"

Don't worry, they would do the same even if it was written with "is"

steveL · Posted: Mon Apr 20, 2015 2:59 am Post subject:

krinn: As it was, so shall it be.. yea, and verily. ;-)

yngwin · Posted: Mon Apr 20, 2015 9:20 am Post subject:

UberLord · Posted: Mon Apr 20, 2015 9:37 am Post subject:

lost+found · Posted: Mon Apr 20, 2015 1:01 pm Post subject:

rm /var/lib/dhcpcd/dhcpcd-wlan0.lease

Otherwise the old lease is requested (and NAK'ed because of the changed MAC), and "they" gotcha...

And how about:
dhcp_wlan0="nontp nosendhost"
So they can't give you a clock skew, and write down your host name.

When things don't go as expected (after a crash for instance, or restarting udev after an upgrade), it's a good idea to check /etc/udev/rules.d/70-persistent-net.rules. The MAC addresses in there, must be the real ones. Any extra interfaces added by Udev - based on fake MACs - can be removed. After that it needs a cold boot (power switch off).

Added:
Some reading about macchanger (syntax) in: /usr/share/doc/netifrc-0.2.2/net.example.bz2

krinn · Watchman Joined: 02 May 2003 Posts: 7470

charles17 · Advocate Joined: 02 Mar 2008 Posts: 3664

steveL · Posted: Thu Apr 23, 2015 2:12 am Post subject:

I'd gladly add it, if I knew wtf "the EUI64 component of your SLAAC address" meant (beyond the obvious that it looks like a 64-bit field, which reveals your LAN MAC addr.) Still, it's not so much about the wiki, though ofc it should be there too.

IOW: we need about a paragraph at least from UberLord, explaining what it is in a bit more context.

UberLord · Posted: Thu Apr 23, 2015 10:52 am Post subject:

IPv6 supports end to end connectivity. There is no NAT (at least not normally).
As such, a host you connect to will know your IPv6 address.

A IPv6 address is compromised of two parts - the Prefix which is unique to your site (office, home, etc) and your HostID, which is unique to your host at the site.
The HostID is generally formed from the MAC address of the network interface (which has to be unique to the site as well for IPv4 to work)

Take this IPv6 address
fe80::dead:beff:feef:f00d

From this, we can derive tha the MAC address is de:ad:be:ef:f0:0d.
We know this because the magic bits ff:fe are inserted in the middle.
If this host had a global prefix (fe80:: is local) it would look like so
2345:123:3::dead:beff:feef:f00d

So you can see, MAC address is the same.

There are two ways to mitigate this - DHCPv6 (because it's a stateful address and not PHY based) or a different way of generating the HostID.
IPv6 has long supported random temporary addresses, but this has pitfalls as you cannot use it on say a server and won't easily work with DNS.
This is where RFC 7217 comes into play. By storing a secret key on the host, we can use this along with other information such as the Prefix, MAC address and SSID of the connected network (obviously wired interfaces won't have that) and combine them together. Put the result through SHA256 and take a portion of the result to the be host ID.
This results in a stable but private address which changes for each network you connect to, so you cannot be tracked by IPv6 address across networks *

Here's the original Gentoo news article:
https://www.gentoo.org/support/news-items/2014-07-17-dhcpcd_6.4.2_changes_defaults_for_ipv6.html

* Of course, you are generally tracked by your browser as well, but we're strictly talking network topology here.
_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool

steveL · Posted: Thu Apr 23, 2015 11:41 am Post subject:

Perfect, thanks UberLord. :-)

krinn · Watchman Joined: 02 May 2003 Posts: 7470

How can it works with a NAT?
From my knowledge if my IP is 3.3.3.3 and this host (mac 4.4.4.4) send something to someone, it would send it back to my IP with my mac in it, allowing the router to know even it's for 3.3.3.3 the reply is for the host with the mac 4.4.4.4 and not some other random hosts.

So if the router cannot match the mac return value, it may drop the reply or give it to the host that is dmz no?
I don't have any ipv6 router to see how this work, but do ipv6 packets aren't made with the mac inside them too?