Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New York Times uses WebRTC to gather local IP addresses

webrtchacks.com

Post reply on HN
Print view View original

111–120 of 128 posts

Re: The New York Times uses WebRTC to gather local IP addresses

#111

Post by ibc »

userbinator wrote: post #69
1ris wrote: post #51

In other news: If you create a IP connection the other party knows your IP-Address. With WebRTC some parts of this ugly NAT madness are gone. Nothing to see here.

The issue isn't that the other party knows your IP, it's that this is an unexpected connection for no other purpose than to obtain your public IP, in addition to your LAN IP .

There is not even a connection. During the RTCPeerConnection's "ICE Gathering" process local IPs are discovered and, if STUN/TURN servers are configured within the RTCPeerConnection, STUN requests are sent to those servers (which help retrieving the public IP of the computer/router). But you don't need even to send a single packet in order to get local IPs (private ones, VPN ones, etc).

Re: The New York Times uses WebRTC to gather local IP addresses

#112

Post by user_0001 »

WalterGR wrote: post #97
noir_lord wrote: post #76

Earlier quoted context omitted.

Yeah, I ran into a site a while back that was clever enough to spot that I wasn't using a browser. So I did, Selenium allows you to automate a real browser and capture the responses, hell if need be you can create a fake profile with Chrome and make it completely indistinguishable. EDIT: explanation, it was a video tutorial site for one of the technologies I use, each video had a download link but it had no way to ba…

Selenium allows you to automate a real browser and capture the responses, hell if need be you can create a fake profile with Chrome and make it completely indistinguishable. Are there no headless browsers that let you accomplish the same thing? Honest question... I've used Selenium, but I just assumed that headless browsers were exactly: real browsers minus the UI.

headless browsers are easy to identify.

The best you have to not be ID'd and "kinda headless" is slimer or selenium to XVFB, which aren't really headless but sort of

[edit] slimer [AND] selenium to [OR]

Re: The New York Times uses WebRTC to gather local IP addresses

#113

Post by joosters »

nextw33k wrote: post #106
joosters wrote: post #7

Can they grab local IPv6 addresses using this? While a huge number of computers are going to be on 192.168.0.1, their IPv6 address could actually be unique, making user fingerprinting easier.

Yes they can grab the IPv6 address but IPv6 has a privacy extension to cater for this. It will alter your local IPv6 address periodically. You could configure it to update every hour and effectively they'd be thinking you were a new PC on the network. IPv4 you'd have a small range of IP addresses but with IPv6 you can have a different IPv6 address each hour if you so choose. http://www.internetsociety.org/deploy360/r…

Thanks for that link (IPv6 newbie here, I really need to properly learn it some day...)

Re: The New York Times uses WebRTC to gather local IP addresses

#114

Post by donohoe »

To be clear, its not a developer at the NYTimes that has implemented.

It looks like the script in question is hosted on a domain ("tagsrvcs.com") that Adobe uses when loading JS assets for Omniture.

This is very likely a standard Adobe Omniture thing. So its not the NYT acting alone (or necessarily with awareness of this).

Re: The New York Times uses WebRTC to gather local IP addresses

#115

Post by cpncrunch »

api wrote: post #10

It's easy to gather local IP addresses. WebRTC is just one of dozens of methods of doing this. Others include various DNS tricks, reverse TCP traceroute, tag tricks, JavaScript/XMLHttpRequest tricks, etc. Private IP addresses (10.x.x.x) are not all that private.

All of these just get the public ip address, which the server already has.

Re: The New York Times uses WebRTC to gather local IP addresses

#116

Post by gorhill »

mahouse wrote: post #23
AdmiralAsshat wrote: post #2

Just a friendly reminder for anyone using uBlock Origin on Chrome or Firefox that you can now configure it to prevent webRTC from leaking your real IP: http://www.ghacks.net/2015/07/02/you-can-block-webrtc-from-l... You do need to enable this. After reading the article I immediately checked by dashboard and saw that the option was available, but unchecked.

After enabling it I keep seeing my public address here. https://diafygi.github.io/webrtc-ips/ — What gives?

The real issue is WebRTC exposing your ISP address when behind a VPN.

If you are not behind a VPN, it is expected that your ISP address is visible -- WebRTC or not.

Re: The New York Times uses WebRTC to gather local IP addresses

#118

Post by joshmn »

x0 wrote: post #87
joshmn wrote: post #74

Earlier quoted context omitted.

Financial card fraud; Most of the time someone just hops on a SOCKS4/SOCKS5 proxy, doesn't have a VPN behind that. We can grab the user's IP. Original discussion: https://news.ycombinator.com/item?id=8949953

That's beautiful. One of my passions in life is seeing carders get caught.

I was one in a former life. Now I use my insights to help.

You'd be sickened and surprised by how many startups overlook handling chargebacks.

Re: The New York Times uses WebRTC to gather local IP addresses

#119

Post by api »

cpncrunch wrote: post #115
api wrote: post #10

It's easy to gather local IP addresses. WebRTC is just one of dozens of methods of doing this. Others include various DNS tricks, reverse TCP traceroute, tag tricks, JavaScript/XMLHttpRequest tricks, etc. Private IP addresses (10.x.x.x) are not all that private.

All of these just get the public ip address, which the server already has.

Nope. You can go beyond that in a variety of ways. :)

Re: The New York Times uses WebRTC to gather local IP addresses

#120

Post by profmonocle »

MichaelGG wrote: post #83
makomk wrote: post #65

Earlier quoted context omitted.

It's necessary if the NAT device doesn't support hairpinning. Unfortunately, historically many didn't, so users couldn't connect to other users on the same NAT using their public IPs, even with techniques that worked fine for connecting to other identical NAT setups elsewhere.

Is it necessary ? You could do a broadcast on the LAN if the public IP is the same.

It's not safe to assume that multiple clients behind the same public IP are on the same LAN. At my office, wired and wireless clients NAT to the same public IP, despite being on different subnets.

Plus, thanks to IPv4 depletion there might be multiple layers of NAT involved, because ISPs are having to deploy carrier-grade NAT.

Post reply on HN