Network privacy

MAC address randomisation

• A stable random address per network. Each Wi-Fi or wired network sees its own address — the same one each visit, so captive portals and DHCP reservations keep working — and no two networks see the same one.
• Random addresses while scanning. Stock Ubuntu turns Wi-Fi scan randomisation off; Arkyn turns it on.
• Your own identity. The image ships no machine ID and no network secret: each install generates its own at first boot, so two Arkyn machines never share an address. A two-machine test proves it on every release.

Need your real address on one network (a dock or a DHCP reservation keyed to it)?

nmcli connection modify "<connection name>" wifi.cloned-mac-address permanent

(ethernet.cloned-mac-address for a wired connection.)

Encrypted DNS

Lookups go to Quad9 over TLS (dns.quad9.net), with DNSSEC validation where available. The network’s own resolver only answers for its own local names, and no fallback servers are configured.

It is opportunistic on purpose: a VPN pushes its own resolver, and captive portals need plain DNS to let you sign in. Strict mode would break both. Check it with:

resolvectl status

IPv6 privacy addresses

Temporary IPv6 addresses are preferred for outgoing connections, so no address derived from your hardware follows you between networks.