From ef33f88d803f0c5e04b101d153080ae04444b3dd Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Mon, 24 May 2021 09:17:14 -0400 Subject: document DHCP privacy improvement --- static/usage.html | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'static/usage.html') diff --git a/static/usage.html b/static/usage.html index 1d07ed7d..2de00f96 100644 --- a/static/usage.html +++ b/static/usage.html @@ -508,9 +508,6 @@

Associated with an Access Point (AP)

-

The DHCP client uses the anonymity profile rather than sending a hostname so it - doesn't compromise the privacy offered by MAC randomization.

-

Associated MAC randomization is performed by default. This can be controlled per-network with Settings ➔ Network & Internet ➔ Wi-Fi ➔ <network> ➔ Advanced ➔ Privacy.

@@ -521,6 +518,12 @@ connecting to a network. It has 3 options available: "Use fully randomized MAC (default)", "Use per-network randomized MAC" and "Use device MAC".

+

The DHCP client uses the anonymity profile rather than sending a hostname + so it doesn't compromise the privacy offered by MAC randomization. When the + per-connection MAC randomization added by GrapheneOS is being used, DHCP + client state is flushed before reconnecting to a network to avoid revealing + that it's likely the same device as before.

+

GrapheneOS also disables support for stable link-local IPv6 addresses, since these have the potential to be used as identifiers. It's more sensible to use typical link-local address generation based on the (randomized) MAC address since link-local -- cgit v1.3.1