Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN leaks users’ IPs via WebRTC

voidsec.com

Post reply on HN
Print view View original

131–140 of 172 posts

Re: VPN leaks users’ IPs via WebRTC

#131

Post by lovelearning »

urda wrote: post #96
lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

> Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Did you file a bug report?

I searched for one and found some that seem to be related. Will file one today and also work on a fix, since it appears this is known from a long time and nobody has bothered to provide even a simple fix.

Re: VPN leaks users’ IPs via WebRTC

#132

Post by Aloha »

MichaelGG wrote: post #107
Aloha wrote: post #68

Earlier quoted context omitted.

SIP is one of a few protocols where two completely standard-compliant implementations are commonly unable to interop.

Oh it gets better. I have implemented SIP software (written, from scratch). On the SIP implementors mailing list, one of the authors defends the insane parsing rules by saying that C and Java allow you to be flexible with syntax, so why not SIP? They are totally detached from actually implementing elegant or high performance software. Actual engineers achieve this despite of SIP's terrible decisions. Granted, many of…

I'm not sure binary protocols are any better, unless you make the first two bytes of every message a version number.

FWIW, I consider the canonical implementation of SIP at this point to be asterisk.

I work on a SIP derived protocol, P25 CSSI - it has all the issues of SIP, and more!

Re: VPN leaks users’ IPs via WebRTC

#133

Post by throwaway2048 »

lallysingh wrote: post #118
MichaelGG wrote: post #108

Earlier quoted context omitted.

I'm only going off some in-person dealing with folks behind WebRTC and they know that permissions suck and would hurt adoption and hence fight to make sure they don't happen. They dismiss all privacy concerns with "you can't have privacy in a browser" and "fingerprinting will work anyways so we can't make it worse". It's head-in-sand approach to privacy and it's bad. Even then, Firefox is simply wrong to tell people…

Lots of people in webrtc are critically concerned with the safety and privacy of their users.

obviously not that critically concerned if leaking sensitive information like this was required by the spec as drafted, and has remained uncorrected.

Re: VPN leaks users’ IPs via WebRTC

#134

Post by Digital-Citizen »

cosmiccartel wrote: post #2

Just want to point anyone looking to test their own VPN to https://ipleak.net/ . That's been my go-to, and it seems more comprehensive than the linked service.

And it needlessly requires Javascript to do things other services don't need Javascript to do. That's not a good plan.

One's IP address should be detectable to at least some degree with data from the packets making the request for the webpage. Some of this is remedied with what appears to be duplicative information further down the page.

DNS Address detection is done better by https://dnsleaktest.com/.

Geolocation detection is likely done by looking up what geolocation is paired with one's IP (and sometimes this data is wrong), so there's no real need for Javascript here either. It's not as if the requesting computer should supply this information, else it becomes even more easily spoofed. Some of this is remedied with what appears to be duplicative information further down the page.

Torrent detection is also needlessly JS-driven, and done better at http://dev.cbcdn.com/ipmagnet/.

There are also some grammar errors confusing singular and plural in the text at the bottom of the page.

Re: VPN leaks users’ IPs via WebRTC

#135

Post by throwaway2048 »

Crontab wrote: post #97
lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

I am so annoyed with this. It feels like every advance in web browser technology takes away as much as it gives. Some days, it feels like the web was better back in the HTML4 days. Can't wait to see how WebAssembly will be used against us.

Just wait till you get a load of content rendering engines being written in (dynamicly re-obfuscated) web assembly and rendered via canvas, so users are totally locked out of modifying content loaded into them or blocking ads.

This is already being worked on.

Re: VPN leaks users’ IPs via WebRTC

#136

Post by mirimir »

matheusmoreira wrote: post #113
MichaelGG wrote: post #61

Earlier quoted context omitted.

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is…

What if the entire system is configured to use Tor? Does the use of Tails mitigate this weakness?

To be safe, one must restrict output on the LAN interface to the Tor process. I'm not sure whether Tails does that by default.

Re: VPN leaks users’ IPs via WebRTC

#137

Post by mirimir »

swiley wrote: post #90
lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

This is why when I actually do anything with tor it's always curl -H "" Using something as complex as firefox for anything important is just stupid.

Or just use Whonix. Or better, Whonix in Qubes.

Re: VPN leaks users’ IPs via WebRTC

#138

Post by earenndil »

throwaway2048 wrote: post #135
Crontab wrote: post #97

Earlier quoted context omitted.

I am so annoyed with this. It feels like every advance in web browser technology takes away as much as it gives. Some days, it feels like the web was better back in the HTML4 days. Can't wait to see how WebAssembly will be used against us.

Just wait till you get a load of content rendering engines being written in (dynamicly re-obfuscated) web assembly and rendered via canvas, so users are totally locked out of modifying content loaded into them or blocking ads. This is already being worked on.

It's being fought before it's even fully grown.

Computer vision adblockers are also being worked on.

Re: VPN leaks users’ IPs via WebRTC

#139

Post by the8472 »

fauigerzigerk wrote: post #76
mahkoh wrote: post #66

Earlier quoted context omitted.

>You have to disable WebRTC in the browser Incorrect. An easy and foolproof way of using VPNs is with network namespaces. You start the VPN in your init network namespace and then move the created device into a dedicated VPN namespace. OpenVPN has support for this because it allows you to execute a shell script after the VPN device has been created. Then you simply start your browser, torrent client, whatever in this…

>DNS leaks can be prevented by using a generic DNS provider such as 8.8.8.8 You mean leaking to Google doesn't count as leaking? Your namespaces suggestion is interesting, but easy and foolproof?

You can run a DNS resolver in the network namespace that forwards¹ to google DNS through the VPN.

¹ Or run your own recursive resolver

Re: VPN leaks users’ IPs via WebRTC

#140

Post by gear54rus »

throwaway2048 wrote: post #135
Crontab wrote: post #97

Earlier quoted context omitted.

I am so annoyed with this. It feels like every advance in web browser technology takes away as much as it gives. Some days, it feels like the web was better back in the HTML4 days. Can't wait to see how WebAssembly will be used against us.

Just wait till you get a load of content rendering engines being written in (dynamicly re-obfuscated) web assembly and rendered via canvas, so users are totally locked out of modifying content loaded into them or blocking ads. This is already being worked on.

Any links to that? What kind of enemies of mankind are working on this? Advertisers again?
Post reply on HN