41–50 of 128 posts
WebRTC, a protocol proposed by Google to W3C has applications in user tracking and detection of bots. Cui bono.
Forum post from Dan Kaminsky, co-founder of WhiteOps[1][2]: "Dan Kaminsky here, my apologies for kicking up a ruckus. This is part of a bot detection framework I've built at White Ops; we basically are able to detect browser automation using resources exposed in JavaScript. Nothing dangerous to users -- or we'd go file bugs on it, which we do from time to time -- but it does provide useful data regarding post-exploit…
Additionally, the STUN attempts are supposedly gone since yesterday: https://github.com/EFForg/privacybadgerchrome/issues/431#iss...
Here's another White Hat use case for local IP addresses. You can use it to unobtrusively monitor license compliance for a SaaS biz. You charge each user. A user is constantly logging on from multiple browsers during the day (e.g. IE and Chrome). With local IP knowledge you can determine whether or not this is being done from the same machine (still abiding by license terms), or from multiple machines (most likely sh…
no, no, no, no, no.
scenario: a dhcp server that doesn't remember ip/mac associations.
i've had a bit to drink, can someone ELI5 this to me?
Here's another White Hat use case for local IP addresses. You can use it to unobtrusively monitor license compliance for a SaaS biz. You charge each user. A user is constantly logging on from multiple browsers during the day (e.g. IE and Chrome). With local IP knowledge you can determine whether or not this is being done from the same machine (still abiding by license terms), or from multiple machines (most likely sh…
Earlier quoted context omitted.
Additionally, the STUN attempts are supposedly gone since yesterday: https://github.com/EFForg/privacybadgerchrome/issues/431#iss...
Wow, so if I'm reading that right, they wrote a tracker that generates a new request every 5 seconds? These scumbags are ruining the web. And they wonder why people use ad blockers...
We are still very early in the age of the Internet. People are sending all sorts of trashy traffic. There is ample opportunity to optimize but net neutrality means we have to treat it all the same. It's nuts.
WebRTC, a protocol proposed by Google to W3C has applications in user tracking and detection of bots. Cui bono.
Or they could just use upnp like everyone else and enjoy a decent P2P connectivity rate without exposing your private IPs and making you fingerprintable.
More concerning, though, is that this stuff isn't triggering a permission dialog in Firefox.
Just a friendly reminder for anyone using uBlock Origin on Chrome or Firefox that you can now configure it to prevent webRTC from leaking your real IP: http://www.ghacks.net/2015/07/02/you-can-block-webrtc-from-l... You do need to enable this. After reading the article I immediately checked by dashboard and saw that the option was available, but unchecked.
When I visit the NYT, it gets a full IPv6 address, non-NAT. Isn't this just as bad? Should we tell everyone to turn off IPv6 support?
The major use case for webrtc ip leak blocking is preventing leaking of rfc1918 IPs (or link/site-local IPv6 addresses) and preventing leaking of alternate LAN and alternate public IPs.
For example, if you web browse through a VPN, this webrtc functionality will by default reveal not only your public VPN exit IP, but also your VPN rfc1918 ip, and also your real rfc1918 ip, and your primary, non-vpn public IP. All in the name of better connectivity for webrtc. It's horrible.
I don't understand why webrtc does this. How does revealing non-global addresses help improve (edit: reliably improve) connectivity? Those addresses aren't guaranteed to be globally unique, so if you have two webrtc app users on the same non-global netblock, so what? Even if they have the same public IP, it's not guaranteed that they can talk to each other with their non-global addresses; they could be on different (isolated) internal networks. So the app will be blindly trying to connect to random internal ip addresses. Sounds fun for NIDS.
Here's another White Hat use case for local IP addresses. You can use it to unobtrusively monitor license compliance for a SaaS biz. You charge each user. A user is constantly logging on from multiple browsers during the day (e.g. IE and Chrome). With local IP knowledge you can determine whether or not this is being done from the same machine (still abiding by license terms), or from multiple machines (most likely sh…
I hope that doesn't catch on. I have a laptop, two desktops and a phone that I use depending on where I happen to be sitting. They are all me, though. Even desktop software like Adobe Creative Suite seems to acknowledge that people use more than one device these days.
Earlier quoted context omitted.
Additionally, the STUN attempts are supposedly gone since yesterday: https://github.com/EFForg/privacybadgerchrome/issues/431#iss...
Wow, so if I'm reading that right, they wrote a tracker that generates a new request every 5 seconds? These scumbags are ruining the web. And they wonder why people use ad blockers...
https://github.com/EFForg/privacybadgerchrome/issues/431#iss...
This looks like it's trying to exercise every dark corner of the user's browser in order to ensure that the browser is a real, eyeball-facing browser and not just a URL fetcher, PhantomJS/SlimerJS, or a clickjacking plugin being used to fraudulently click ads.
I think it's easy to see both sides here: tools like this are a powerful way to detect and combat botnets and click fraud, but if/when weaponized they're also a form of browser fingerprinting which is a nasty way to ruin anonymity across the web.
IMO there are a lot of bigger targets on the Taxonomy of Bad Internet Things: malware-serving bottom-tier ad networks, "wrapped download" sites, clickjacking, and especially cross-site correlative "analytics" companies come to mind as being more sinister to privacy than Dan Kaminsky going botnet hunting.