A neat information leak in browsers that support mDNS-based hostname resolution. The demo brute forces common names + device prefixes/suffixes, but this can be abused for a dozen other things (do you have a specific IoT device on your network? do you use Meraki? etc):
https://fingerprint.com/blog/apple-macos-mdns-brute-force/