Hacker News

points by treesknees 1 day ago | 0 comments

You’re not actually making the point you think you are. This comes back to the original comment stating you need to compromise a lot to MITM here.

So you need to somehow trick macOS into remotely connecting to the wrong bssid, and then arp poison a user who happens to be using a macOS cli tool that’s using https.

Sounds pretty targeted and unlikely to happen.

[–] 9dev 1 day ago

Go to a random coffee shop that allows people to work at the tables, and you’ll find a few developers with MacBooks there pretty soon. They will be connected to the local hotspot, which either has no password at all, or WPA2 with the password written on a billboard behind the counter. Spin up an evil twin, then wait for the connections to roll in.

I don’t think that’s either targeted or unlikely?

[–] yonatan8070 1 day ago

Exactly, I do this all the time for doing out-of-office demos with our company's robots.

I just set up my phone's hotspot to be the same SSID and password as the network the robots already know from the office, and I'll have the robots, a couple phones, and a laptop connected in 10 seconds.