1

On occasion I change my MAC address from time to time at a public Wifi service. However lately something has changed. The captive portal (Wifi) remembers me even if I change my MAC address on my Macintosh. How is that possible? Is it leaving a cookie on my computer somehow? If so, how to remove it?

  • 2
    Its probably next to impossible to answer this technical question without any details. In theory they could use cookies (or similar techniques), but its impossible to tell. Try a different browser and/or the private mode of yours. Also make sure your MAC is really changed (e.g. use packet sniffing software). – Karol Babioch Jan 31 '17 at 23:24
  • I only have one computer (Macbook Pro running the latest OS/X Sierra) so I can't sniff what's in the air. The Wifi portal is Starbucks coffee house. – Muxe Jan 31 '17 at 23:45
  • Have you tried launching your browser in whatever its name for Private/Incognito mode is? Or even using a different profile than your standard one? – iwaseatenbyagrue Mar 3 '17 at 13:42
  • Every 'anon/4chan/foo' is using macchangers, Starbucks has probably found a more reliable method for tracking customers. – user400344 Apr 2 '17 at 8:47
4

It may use your WebGL ID (which never changes, unless you reinstall MacOS), or some other variable. Try disabling images, javascript (noscript, scriptsafe). Have a look at https://amiunique.org/faq . Disable flash and java as well via an appropriate add-on.

The obvious answer is that it's using a cookie, but I assume you've cleared those. Try clearing them pre-connect, and see what cookies are added post-login.

You will learn nothing useful (for solving your problem) by running tcpdump or wireshark. If you run it anyway, do a capture of 2-3 login sequences, and build filters later. I don't use wireshark, so can't help with those, but a tcpdump pcap filter may look like this (for capturing a HTTP captive portal session): sudo tcpdump -ni en1 -s 4096 host 192.168.1.2 and port 80, where en1 is your wireless interface and 192.168.1.2 is the IP of the captive portal.

  • Or employ a supercookie. – mootmoot May 2 '17 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.