In other news: If you create a IP connection the other party knows your IP-Address. With WebRTC some parts of this ugly NAT madness are gone.
Nothing to see here.
The New York Times uses WebRTC to gather local IP addresses
51–60 of 128 posts
Re: The New York Times uses WebRTC to gather local IP addresses
#52Earlier quoted context omitted.
When I visit the NYT, it gets a full IPv6 address, non-NAT. Isn't this just as bad? Should we tell everyone to turn off IPv6 support?
If you want to hide the IP you're connecting from, and you want to use IPv6, then you have to find an IPv6-enabled VPN (or make one yourself with a cheap vps). The major use case for webrtc ip leak blocking is preventing leaking of rfc1918 IPs (or link/site-local IPv6 addresses) and preventing leaking of alternate LAN and alternate public IPs. For example, if you web browse through a VPN, this webrtc functionality wi…
Doesn't it help if two people are sitting right next to each other behind the same NAT?
Re: The New York Times uses WebRTC to gather local IP addresses
#53I said this when the vulnerability/bug/whatever you want to call it was posted here: I use the same method for fraud detection, and it works unreasonably well.
That said, I'd rather there be permissions surrounding WebRTC, but my clients are happy.
Re: The New York Times uses WebRTC to gather local IP addresses
#54Earlier quoted context omitted.
Wow, so if I'm reading that right, they wrote a tracker that generates a new request every 5 seconds? These scumbags are ruining the web. And they wonder why people use ad blockers...
It sounds like the requests were a bug: https://github.com/EFForg/privacybadgerchrome/issues/431#iss... This looks like it's trying to exercise every dark corner of the user's browser in order to ensure that the browser is a real, eyeball-facing browser and not just a URL fetcher, PhantomJS/SlimerJS, or a clickjacking plugin being used to fraudulently click ads. I think it's easy to see both sides here: tools like th…
Their motives might be good, but if their actions are indistinguishable from the bad guys, then there's still a problem.
Re: The New York Times uses WebRTC to gather local IP addresses
#55Earlier quoted context omitted.
Wow, so if I'm reading that right, they wrote a tracker that generates a new request every 5 seconds? These scumbags are ruining the web. And they wonder why people use ad blockers...
It is scenarios like this that make me unhappy with net neutrality principles that suggest all packets are equal. We are still very early in the age of the Internet. People are sending all sorts of trashy traffic. There is ample opportunity to optimize but net neutrality means we have to treat it all the same. It's nuts.
No. Net neutrality means the ISPs cannot "optimize" this stuff. Everyone else is welcome to do so. That's the entire point.
Re: The New York Times uses WebRTC to gather local IP addresses
#56Here's a tool I wrote that grabs your internal IP and scans your LAN using response timings and HTTP asset fingerprints:
Demo: http://joevennix.com/lan-js/examples/dashboard.html Code: https://github.com/joevennix/lan-js
If you are interested and have some time, find and contribute HTTP "fingerprint" assets from devices on your LAN to src/db.js.
Re: The New York Times uses WebRTC to gather local IP addresses
#57Just a friendly reminder for anyone using uBlock Origin on Chrome or Firefox that you can now configure it to prevent webRTC from leaking your real IP: http://www.ghacks.net/2015/07/02/you-can-block-webrtc-from-l... You do need to enable this. After reading the article I immediately checked by dashboard and saw that the option was available, but unchecked.
When I visit the NYT, it gets a full IPv6 address, non-NAT. Isn't this just as bad? Should we tell everyone to turn off IPv6 support?
With ipv6 there are the privacy extensions[1] for SLAAC which will assign your computer a new v6 address from your network prefix in a regular interval.
This is enabled by default on windows, osx and some linux systems.
But I do wonder whether webrtc can find your other v6 addresses, a host often has more than one.
Re: The New York Times uses WebRTC to gather local IP addresses
#58Earlier quoted context omitted.
Wow, so if I'm reading that right, they wrote a tracker that generates a new request every 5 seconds? These scumbags are ruining the web. And they wonder why people use ad blockers...
It sounds like the requests were a bug: https://github.com/EFForg/privacybadgerchrome/issues/431#iss... This looks like it's trying to exercise every dark corner of the user's browser in order to ensure that the browser is a real, eyeball-facing browser and not just a URL fetcher, PhantomJS/SlimerJS, or a clickjacking plugin being used to fraudulently click ads. I think it's easy to see both sides here: tools like th…
This looks like it's trying to exercise every dark corner of the user's browser in order to ensure that the browser is a real, eyeball-facing browser and not just a URL fetcher, PhantomJS/SlimerJS, or a clickjacking plugin being used to fraudulently click ads.
It sounds like it would be quite easy to circumvent just by running a real browser... especially with lightweight VMs.
Re: The New York Times uses WebRTC to gather local IP addresses
#59Earlier quoted context omitted.
Don't forget Flash, the #1 tool for persistent tracking. Uninstalling Flash should be your first priority if you care about this.
Look into browser fingerprinting, among other things. This is a losing battle. I am deeply pessimistic about the potential for tracker-blind browsing without extraordinary measures. A simple plugin or cookie rules simply do not and cannot cut it. There are just umpteen million ways to fingerprint a device. What plugins do you have installed? What is your font list? What can be deduced about your device's make/model/r…
The TOR Browser Bundle is a great example of what can be done. I think it's actually pretty effective, especially with the more paranoid modes. It doesn't provide font lists, doesn't run JS, doesn't expose WebGL, picks one of a few standard screen sizes, etc.
I'd agree though that preventing general purpose browser fingerprinting is pretty much dead.
Re: The New York Times uses WebRTC to gather local IP addresses
#60I believe that WebRTC, just like JavaScript, should be disabled by default and enabled only on sites that you really trust and need it; and in the case of WebRTC, the argument is much stronger since its use-case is so specific.