The New York Times uses WebRTC to gather local IP addresses

#1

Post by DamienSF » Wed, Jul 15, 2015, 7:36 PM UTC

The New York Times uses WebRTC to gather local IP addresses
webrtchacks.com

Re: The New York Times uses WebRTC to gather local IP addresses

#2

Post by AdmiralAsshat » Wed, Jul 15, 2015, 8:45 PM UTC

Just a friendly reminder for anyone using uBlock Origin on Chrome or Firefox that you can now configure it to prevent webRTC from leaking your real IP:

http://www.ghacks.net/2015/07/02/you-can-block-webrtc-from-l...

You do need to enable this. After reading the article I immediately checked by dashboard and saw that the option was available, but unchecked.

Re: The New York Times uses WebRTC to gather local IP addresses

#3

Post by itistoday2 » Wed, Jul 15, 2015, 8:49 PM UTC

Why are they doing this?

Re: The New York Times uses WebRTC to gather local IP addresses

#4

Post by spiralpolitik » Wed, Jul 15, 2015, 8:55 PM UTC

itistoday2 wrote: post #3

Why are they doing this?

I would guess it is part of their paywall setup.

Re: The New York Times uses WebRTC to gather local IP addresses

#5

Post by proactivesvcs » Wed, Jul 15, 2015, 8:57 PM UTC

I recently added tagsrvcs.com to my Privoxy blocklist. Source site? ycombinator.com.

Re: The New York Times uses WebRTC to gather local IP addresses

#6

Post by slg » Wed, Jul 15, 2015, 8:57 PM UTC

itistoday2 wrote: post #3

Why are they doing this?

Probably part of their marketing fingerprinting. Lets say you have a big company that only has a specific set of public IPs and you centrally manage browser updates, add-ons, and extensions. Previously any user from that network might show up as the same user in the NYT's marketing data. Now they have an extra piece of data to help differentiate them.

Re: The New York Times uses WebRTC to gather local IP addresses

#7

Post by joosters » Wed, Jul 15, 2015, 9:01 PM UTC

Can they grab local IPv6 addresses using this? While a huge number of computers are going to be on 192.168.0.1, their IPv6 address could actually be unique, making user fingerprinting easier.

Re: The New York Times uses WebRTC to gather local IP addresses

#8

Post by btown » Wed, Jul 15, 2015, 9:03 PM UTC

The only possible reason I can fathom that this would be useful would be for tracking unique users behind a NAT (i.e. corporate or educational) who block all cookies. Seems like a pretty niche edge case in the U.S., but I'd imagine this could be useful in, say, the EU where cookies are opt-in by law?

Re: The New York Times uses WebRTC to gather local IP addresses

#9

Post by x0x0 » Wed, Jul 15, 2015, 9:12 PM UTC

there's really no way in chrome to disable webrtc? That's amazing.

edit: from the horse's mouths https://code.google.com/p/chromium/issues/detail?id=457492

edit2: you can install this

https://chrome.google.com/webstore/detail/webrtc-leak-preven...

and test here:

https://diafygi.github.io/webrtc-ips/

though google sure seems to be dragging their feet on this so I'm sure they'll break this workaround soon

Re: The New York Times uses WebRTC to gather local IP addresses

#10

Post by api » Wed, Jul 15, 2015, 9:16 PM UTC

It's easy to gather local IP addresses. WebRTC is just one of dozens of methods of doing this. Others include various DNS tricks, reverse TCP traceroute, tag tricks, JavaScript/XMLHttpRequest tricks, etc. Private IP addresses (10.x.x.x) are not all that private.