Originally Posted by
dranz
> The ARP table for a router should be shielded from the outside
> network. Thusly, a hacker outside the router network segment
> couldn't read/detect the ARP table or redirect traffic by poisoning
> the ARP table.
Correct. They aren't using ARP to inhibit multiple devices.
If the WiFi does not require login ... my hypothesis:
Side channel analysis (packet sniffing). Web-browsers bury a LOT
of user-device info in their headers that can fingerprint user devices.
How much uniqueness is possible? EFF has a website that will
report the uniqueness of your device/configuration:
http://Panopticlick.EFF.org
Without logging-in to anything ... Panopticlick estimates my
uniqueness as one in 1,494,778
Very interesting, not surprised. But it's not foolproof.
I have IE, FireFox, and Chrome on my PC. I use all three at various times. So a test like this could potentially lock out users who are not on NAT devices, causing more headaches for the ISP IT support.
Also if someone uses VPN or SSH or SSL this wouldn't be an issue.