Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New York Times uses WebRTC to gather local IP addresses

webrtchacks.com

Post reply on HN
Print view View original

61–70 of 128 posts

Re: The New York Times uses WebRTC to gather local IP addresses

#61

Post by pki »

userbinator wrote: post #58
bri3d wrote: post #50

Earlier quoted context omitted.

It sounds like the requests were a bug: https://github.com/EFForg/privacybadgerchrome/issues/431#iss... This looks like it's trying to exercise every dark corner of the user's browser in order to ensure that the browser is a real, eyeball-facing browser and not just a URL fetcher, PhantomJS/SlimerJS, or a clickjacking plugin being used to fraudulently click ads. I think it's easy to see both sides here: tools like th…

This looks like it's trying to exercise every dark corner of the user's browser in order to ensure that the browser is a real, eyeball-facing browser and not just a URL fetcher, PhantomJS/SlimerJS, or a clickjacking plugin being used to fraudulently click ads. It sounds like it would be quite easy to circumvent just by running a real browser... especially with lightweight VMs.

which it also attempts to enumerate common files such as virtualbox or vmware drivers via and off file://

Re: The New York Times uses WebRTC to gather local IP addresses

#62

Post by meowface »

joosters wrote: post #54
bri3d wrote: post #50

Earlier quoted context omitted.

It sounds like the requests were a bug: https://github.com/EFForg/privacybadgerchrome/issues/431#iss... This looks like it's trying to exercise every dark corner of the user's browser in order to ensure that the browser is a real, eyeball-facing browser and not just a URL fetcher, PhantomJS/SlimerJS, or a clickjacking plugin being used to fraudulently click ads. I think it's easy to see both sides here: tools like th…

Their motives might be good, but if their actions are indistinguishable from the bad guys, then there's still a problem.

I'd argue that collecting unique information from your browser does not necessarily make you "the bad guys". Lots of legitimate anti-fraud products used on bank/investment websites collect that information and detect/prevent account takeovers before fraudsters can steal money and identities, for example.

What can make it bad is:

1. What you do with that information.

2. Who or what you share it with.

3. How far your reach extends.

An ad network which can place that code on multiple websites can put itself in a position of power and track devices, and thus browsing habits, of individuals.

However, if you have fingerprinting code only on your own website, and don't share that information with any other people/companies/websites, and use it solely to detect malicious bots, users, and behaviors, then I don't really think it's bad. It's like the difference between a gas station owner pointing a closed circuit camera at the door and someone flying a surveillance drone over a whole state. Both are surveillance, but one kind is much less ethical.

Re: The New York Times uses WebRTC to gather local IP addresses

#63

Post by altano »

userbinator wrote: post #60

I believe that WebRTC, just like JavaScript, should be disabled by default and enabled only on sites that you really trust and need it; and in the case of WebRTC, the argument is much stronger since its use-case is so specific.

And what should browsers prompt users with? "Would you like to use WebRTC?" What would that do to improve security for users?

Re: The New York Times uses WebRTC to gather local IP addresses

#64

Post by pjc50 »

btown wrote: post #8

The only possible reason I can fathom that this would be useful would be for tracking unique users behind a NAT (i.e. corporate or educational) who block all cookies. Seems like a pretty niche edge case in the U.S., but I'd imagine this could be useful in, say, the EU where cookies are opt-in by law?

Tracking, and any other kind of fingerprinting, is opt-in in the EU. The directive does not say "cookie".

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...

"The use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller."

So acquiring my internal IP address without consent for reasons other than need for establishing a webrtc connection that the user has asked for is against the law.

Re: The New York Times uses WebRTC to gather local IP addresses

#65

Post by makomk »

cbhl wrote: post #52
harshreality wrote: post #48

Earlier quoted context omitted.

If you want to hide the IP you're connecting from, and you want to use IPv6, then you have to find an IPv6-enabled VPN (or make one yourself with a cheap vps). The major use case for webrtc ip leak blocking is preventing leaking of rfc1918 IPs (or link/site-local IPv6 addresses) and preventing leaking of alternate LAN and alternate public IPs. For example, if you web browse through a VPN, this webrtc functionality wi…

Doesn't it help if two people are sitting right next to each other behind the same NAT?

It's necessary if the NAT device doesn't support hairpinning. Unfortunately, historically many didn't, so users couldn't connect to other users on the same NAT using their public IPs, even with techniques that worked fine for connecting to other identical NAT setups elsewhere.

Re: The New York Times uses WebRTC to gather local IP addresses

#66

Post by pjc50 »

api wrote: post #15
TD-Linux wrote: post #13

Earlier quoted context omitted.

Don't forget Flash, the #1 tool for persistent tracking. Uninstalling Flash should be your first priority if you care about this.

Look into browser fingerprinting, among other things. This is a losing battle. I am deeply pessimistic about the potential for tracker-blind browsing without extraordinary measures. A simple plugin or cookie rules simply do not and cannot cut it. There are just umpteen million ways to fingerprint a device. What plugins do you have installed? What is your font list? What can be deduced about your device's make/model/r…

Privacy is not a boolean. EU-style data protection regulation in the US could substantially improve the situation against private company level privacy threats.

Re: The New York Times uses WebRTC to gather local IP addresses

#67

Post by userbinator »

altano wrote: post #63
userbinator wrote: post #60

I believe that WebRTC, just like JavaScript, should be disabled by default and enabled only on sites that you really trust and need it; and in the case of WebRTC, the argument is much stronger since its use-case is so specific.

And what should browsers prompt users with? "Would you like to use WebRTC?" What would that do to improve security for users?

I'm sure someone could do better than this but here is a first try at a suitably informative prompt:

    $site_name wants to use WebRTC.

    WebRTC allows voice calling, video chat, and P2P file
    sharing, but can also be a privacy risk. We recommend
    allowing WebRTC only on sites that you expect to use
    such features on.

    [Link to learn more]

    Allow WebRTC for $site_name?
Something like Flash's audio/video access prompt would also be a good idea:

https://voicethread.com/image/howto/flash_settings_camera_mi...

Re: The New York Times uses WebRTC to gather local IP addresses

#68

Post by JoshTriplett »

meowface wrote: post #62
joosters wrote: post #54

Earlier quoted context omitted.

Their motives might be good, but if their actions are indistinguishable from the bad guys, then there's still a problem.

I'd argue that collecting unique information from your browser does not necessarily make you "the bad guys". Lots of legitimate anti-fraud products used on bank/investment websites collect that information and detect/prevent account takeovers before fraudsters can steal money and identities, for example. What can make it bad is: 1. What you do with that information. 2. Who or what you share it with. 3. How far your r…

If it's possible to collect enough information from your browser to uniquely identify you, your browser needs fixing.

Re: The New York Times uses WebRTC to gather local IP addresses

#69

Post by userbinator »

1ris wrote: post #51

In other news: If you create a IP connection the other party knows your IP-Address. With WebRTC some parts of this ugly NAT madness are gone. Nothing to see here.

The issue isn't that the other party knows your IP, it's that this is an unexpected connection for no other purpose than to obtain your public IP, in addition to your LAN IP.

Re: The New York Times uses WebRTC to gather local IP addresses

#70

Post by meowface »

JoshTriplett wrote: post #68
meowface wrote: post #62

Earlier quoted context omitted.

I'd argue that collecting unique information from your browser does not necessarily make you "the bad guys". Lots of legitimate anti-fraud products used on bank/investment websites collect that information and detect/prevent account takeovers before fraudsters can steal money and identities, for example. What can make it bad is: 1. What you do with that information. 2. Who or what you share it with. 3. How far your r…

If it's possible to collect enough information from your browser to uniquely identify you, your browser needs fixing.

I would agree, but there are very few browsers out there to which that doesn't apply.
Post reply on HN