Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I know that the MAC address is provided, but it can be spoofed.
What other information would they be able to obtain about your computer to be able to uniquely identify you?
If so, is there anyway to prevent them from doing so?
I have already tried VPNs and they are entirely blocked.
There are many methods which can help in discovering information about devices and people on the network, however it is difficult to get the exact identity of someone.
Browser fingerprinting is one technique that can glean information about your device.
Device fingerprinting or browser fingerprinting is the systematic collection of information about a remote device, for identification purposes. Client-side scripting languages allow the development of procedures to collect very rich fingerprints: browser and operating system type and version, screen resolution, architecture type, lists of fonts, plugins, microphone, camera, etc.
From https://amiunique.org/faq
See what a fingerprint can identify here
The public network may have a sign in page where it can see your browser fingerprint.
Although it is unlikely for a browser fingerprint to be able to identify exactly who the user is, it can show some useful information which could give a general indication of who the user could be.
There are some methods which can be used to make it more difficult to be tracked:
Make yourself more common
By making yourself look more common your fingerprint becomes less unique and therefore you are more difficult to track.
An example of how you can do this is by using a common browser. This will make yourself fit in with everyone else and make your fingerprint less unique.
Disable JavaScript
This is a good defense tactic as it prevents websites from detecting data such as fonts and plugins. An example of a browser plugin to block JavaScript is NoScript.
The public WiFi may log their users activity which may be of use for them identifying users. Consider the following scenario:
Unusual activity from a device is detected. Logs are examined, and it is shown that the device connected to the public WiFi at 14:50. Looking over CCTV, it can be seen that there was only one person at that time using a laptop. They now know what that person looks like, their gender, etc.
Even if you aren't the only person on the network, the number of people that could be there is reduced by physical restrictions.
This is a difficult thing to prevent, as you most likely don't have direct access to where the logs are stored.
Cookies may also be of use to identify the user. If you are to sign into the public WiFi under your real name and then sometime later you sign in anonymously, the cookies can show that it is the same person signing in.
This can easily be combatted by simply disabling cookies in the browser.
MAC addresses can be used to uniquely identify devices in a local network. Your identity could be discovered if the network owners were able to get physical access to devices on their network. However, this is a weak method since MACs can be so easily spoofed an infinite number of times.
As already mentioned, this threat can be eliminated by spoofing your MAC address. If you wanted you could change your MAC address to a previous user on the network to make tracing your identity more difficult.
The hostnames of devices could identify the user behind the device. For example, iPhones default to yourName's iPhone. People may have also manually set their hostnames to include a keyword which can identify the user.
Prevention is pretty easy: set the hostname to something that doesn't relate to you. If you wanted to make yourself being traced more difficult, you could include a fake name in the hostname.
This method will be able to get the most personal information about you. The websites and type of websites you visit may expose your true identity. If you log into a website which uses plaintext, your username can be viewed and identified to you. You might also be sending personal data such as photos and phone numbers which link back to you.
You could prevent your traffic being monitored by using a VPN which would encrypt all your traffic, making it unreadable to others.
There are many methods which can be used to gather information regarding your identify, and it is difficult to eliminate all of these methods.
Although these techniques can gather lots of information, it would still be difficult to find the true identity of someone.
