[deleted]
The New York Times uses WebRTC to gather local IP addresses
101–110 of 128 posts
Re: The New York Times uses WebRTC to gather local IP addresses
#102I believe that WebRTC, just like JavaScript, should be disabled by default and enabled only on sites that you really trust and need it; and in the case of WebRTC, the argument is much stronger since its use-case is so specific.
...like JavaScript, should be disabled by default and enabled only
on sites that you really trust and need it...
It's a royal pain in the ass.
I can't imagine that non-power users would have any tolerance at all for all that hassle.
Re: The New York Times uses WebRTC to gather local IP addresses
#103Just a friendly reminder for anyone using uBlock Origin on Chrome or Firefox that you can now configure it to prevent webRTC from leaking your real IP: http://www.ghacks.net/2015/07/02/you-can-block-webrtc-from-l... You do need to enable this. After reading the article I immediately checked by dashboard and saw that the option was available, but unchecked.
After enabling it I keep seeing my public address here. https://diafygi.github.io/webrtc-ips/ — What gives?
I went there with Firefox without ublock and saw my public and local addresses (docker0, eth0 and virbr0 - VirtualBox). I installed Disable WebRTC https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-... and all the addresses disappeared.
NoScript mitigates the problem because WebRTC won't work with scripts blocked but I'll still have to disable the plugin to make it work on legitimate sites. It's annoying and I'd prefer a browser permission popup along the lines of what has been suggested in other posts here.
Re: The New York Times uses WebRTC to gather local IP addresses
#104Forum post from Dan Kaminsky, co-founder of WhiteOps[1][2]: "Dan Kaminsky here, my apologies for kicking up a ruckus. This is part of a bot detection framework I've built at White Ops; we basically are able to detect browser automation using resources exposed in JavaScript. Nothing dangerous to users -- or we'd go file bugs on it, which we do from time to time -- but it does provide useful data regarding post-exploit…
Honest question, why? What problems are caused by browser automation? Slightly more on point, what issues might the NYT be seeing that detecting browser automation is the sensible solution?
I deal with this all day every day working with advertisements. A lot of money is spent trying to detect "bad users" and/or "bots" (usually the same thing). I'm talking hundreds of thousands of dollars, if not millions a year in some cases.
I'm actually working on developing a system to track browser analytics and usage to detect if it's a person on the other end or a bot.
The quick solution of course would be to have a captcha when viewing ads on sites so the advertiser could confirm it's actually a legitimate user, but there are users that are doing everything they can to not be tracked/or view ads, so what incentive do they have to confirm they are a human just so they can be targeted for advertisements? That's why there are companies trying to work behind the scenes to see if the browser is a legitimate session, or a bot session.
Companies looking to buy advertisement space are really honing in now on bots, because it's become such an issue where server farms are set up that will automate views on pages to inflate profits, or like in the case of the company that runs this script on NYtimes, to see if the user is viewing the page through a legitimate viewing session, or if the user is running software in the background of their computer pushing page views automatically.
I could probably talk all day long with this, but advertising is a huge HUGE market. There is little to no day-to-day talk of the users that are running ad block on their computer, it's a low percentage of the actual users we are running into. The large talk is the people that have created botnets of hundreds of computers to push thousands of fake impressions and how to handle that.
Re: The New York Times uses WebRTC to gather local IP addresses
#105www world really needs more www "browsers", particularly some more that do not implement javascript. Would it hurt to give users more choice and see what they choose? Only my opinion but there is much one can do without all the .js I certainly do not need Javascript to fetch some newspaper articles via HTTP.
I use dillo and netsurf for that. Both are quite fast, dillo is the faster one, netsurf's layout breaks less.
Dillo is freaking fast, once you try it you start to wonder where the web went all bloated. Of course its layout engine is quite dated, AFAIK no HTML5 support whatsoever and I think there are many layout bugs too. I use it to load up huge static html pages, they just kill Firefox or Chromium on my netbook. It's certainly nicer than lynx, sometimes you want to look at images too.
Re: The New York Times uses WebRTC to gather local IP addresses
#106Can they grab local IPv6 addresses using this? While a huge number of computers are going to be on 192.168.0.1, their IPv6 address could actually be unique, making user fingerprinting easier.
Yes they can grab the IPv6 address but IPv6 has a privacy extension to cater for this. It will alter your local IPv6 address periodically. You could configure it to update every hour and effectively they'd be thinking you were a new PC on the network.
IPv4 you'd have a small range of IP addresses but with IPv6 you can have a different IPv6 address each hour if you so choose.
http://www.internetsociety.org/deploy360/resources/privacy-e...
Re: The New York Times uses WebRTC to gather local IP addresses
#107So wasn't everyone up in arms about WHOIS recently but seemingly uses the service to identify who wrote this script?
WHOIS to identify companies is good, WHOIS to identify people can be dangerous.
Re: The New York Times uses WebRTC to gather local IP addresses
#108Earlier quoted context omitted.
Yeah, I ran into a site a while back that was clever enough to spot that I wasn't using a browser. So I did, Selenium allows you to automate a real browser and capture the responses, hell if need be you can create a fake profile with Chrome and make it completely indistinguishable. EDIT: explanation, it was a video tutorial site for one of the technologies I use, each video had a download link but it had no way to ba…
Selenium allows you to automate a real browser and capture the responses, hell if need be you can create a fake profile with Chrome and make it completely indistinguishable. Are there no headless browsers that let you accomplish the same thing? Honest question... I've used Selenium, but I just assumed that headless browsers were exactly: real browsers minus the UI.
Quite possibly but I use selenium extensively during dev to automate boring tasks (filling in forms over and over is boring) as well as for integration and functional testing.
So I had a hammer and the problem looked like a nail. ;)
Re: The New York Times uses WebRTC to gather local IP addresses
#109It's easy to gather local IP addresses. WebRTC is just one of dozens of methods of doing this. Others include various DNS tricks, reverse TCP traceroute, tag tricks, JavaScript/XMLHttpRequest tricks, etc. Private IP addresses (10.x.x.x) are not all that private.
Interesting, do you have links for these other techniques?
Re: The New York Times uses WebRTC to gather local IP addresses
#110Earlier quoted context omitted.
After enabling it I keep seeing my public address here. https://diafygi.github.io/webrtc-ips/ — What gives?
I went there with Firefox without ublock and saw my public and local addresses (docker0, eth0 and virbr0 - VirtualBox). I installed Disable WebRTC https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-... and all the addresses disappeared. NoScript mitigates the problem because WebRTC won't work with scripts blocked but I'll still have to disable the plugin to make it work on legitimate sites. It's annoying and…
Going to about:config and setting media.peerconnection.enabled to false seems to work, without the need for an extension.
Now to find out how many sites break in fun and exciting ways for having done this ;)