Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We are considering adding an extension to restrict the use of WebRTC”

bugzilla.mozilla.org

Post reply on HN
Print view View original

11–20 of 159 posts

Re: “We are considering adding an extension to restrict the use of WebRTC”

#11

Post by rc4algorithm »

anfedorov wrote: post #2

The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?

Don't be simple. This can reveal people that are using proxies like Tor and VPNs, and it's already being exploited by trackers:

https://webrtchacks.com/dear-ny-times/

Re: “We are considering adding an extension to restrict the use of WebRTC”

#12

Post by madeofpalk »

jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

WebRTC is being singled out as it leaks user information that wasn't leaking before.

AFAIK, the conspiracy-minded people are claiming that this is a move by 'advertisers' to collect more user-identifying data.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#13

Post by jnbiche »

gbl08ma wrote: post #4
anfedorov wrote: post #2

The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?

Knowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.

So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens?

Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#16

Post by jnbiche »

madeofpalk wrote: post #12
jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

WebRTC is being singled out as it leaks user information that wasn't leaking before. AFAIK, the conspiracy-minded people are claiming that this is a move by 'advertisers' to collect more user-identifying data.

Well, websockets introduced a massive new opportunity for advertisers to exfiltrate user data that wasn't even subject to the normal cross-site restrictions until recently in most browsers. But nobody proposed eliminating Websockets, or requiring explicit user approval for connections. Instead, they fixed the problem.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#18

Post by pornel »

How about not disabling it, but merely making use of it visible? (e.g. an icon or a notice in the addressbar)

It would discourage reputable sites from abusing it, because users would start asking questions why a news site wants a p2p/videoconference connection.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#19

Post by pjc50 »

jnbiche wrote: post #10
pjc50 wrote: post #3

Earlier quoted context omitted.

It makes it somewhat easier to XSS into your router. (P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)

Can you expand on this, please? How does it make it easier to XSS?

Previously you'd have to guess that the router was on 192.168.x.1. http://www.gironsec.com/blog/2015/01/owning_modems_and_route...

Re: “We are considering adding an extension to restrict the use of WebRTC”

#20

Post by chadrs »

jnbiche wrote: post #10
pjc50 wrote: post #3

Earlier quoted context omitted.

It makes it somewhat easier to XSS into your router. (P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)

Can you expand on this, please? How does it make it easier to XSS?

Well, I'm not sure about XSS, but imagine you know someone's home IP is:

192.168.1.10

Based on this, you can probably guess the router is 192.168.1.1 and maybe even have a clue about the vendor based on the IP assigning patterns.

Then you can direct them to a page with an submitting POST that makes modifications to their router settings. This is more like CSRF than XSS though.

Post reply on HN