21–30 of 159 posts
Earlier quoted context omitted.
It makes it somewhat easier to XSS into your router. (P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)
Can you expand on this, please? How does it make it easier to XSS?
Chrome users, look here: https://chrome.google.com/webstore/detail/webrtc-block/nphkk... or https://chrome.google.com/webstore/detail/webrtc-leak-preven...
I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…
WebRTC is being singled out as it leaks user information that wasn't leaking before. AFAIK, the conspiracy-minded people are claiming that this is a move by 'advertisers' to collect more user-identifying data.
In other news, Mozilla is considering the restriction of IPv6, because it leaks the internal IP. (VPN leakage is a valid concern though)
How about not disabling it, but merely making use of it visible? (e.g. an icon or a notice in the addressbar) It would discourage reputable sites from abusing it, because users would start asking questions why a news site wants a p2p/videoconference connection.
Why can't they just disable WebRTC by default and ask the user for permission like they do with location and so on, without revealing the IP before the user accepts the connection? Also, maybe the user could easily whitelist some connections/WebRTC IDs?
Earlier quoted context omitted.
Knowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.
So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens? Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.
With that said, now let me express an opinion (not a fact): for every technological innovation there are downsides and upsides, and it's up to people to decide if the greatness makes up for the (potential) problems. With cell phones for instance, most people accept potentially having their location disclosed to the accuracy cell towers and triangulation allow, because it's super damn convenient to be able to place and receive calls and text from just about anywhere. Of course, there's a minority that is not comfortable with this and refuses to use cell phones or takes extra precautions.
Similarly, people may be willing to accept the problems of WebRTC because its applications are enough to make up for the disadvantages. People who don't accept will find ways to not use it. If the majority of users ends up blocking it, we can conclude that people don't want a peer-to-peer web, but a more sensible conclusion will be that people were not OK with that particular implementation of peer-to-peer networking, and a different implementation is in order, or that at least patches to the current implementation are needed.
> Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies.
I think that most likely, these data-scarfing companies (and other parties) will learn to use WebRTC (as it is now) for nefarious purposes, before it hurts a tiny bit of their bottom line. I bet it's much easier and there is much more immediate monetary support for developing the pieces necessary to track users with WebRTC, than to implement an actual peer-to-peer application with it.
Could somebody please explain whether it is a technical requirement to leak the internal IP address for this technology to succeed or, if not, what possible reasons could exist for this design decision?
The user can then choose to allow it for one time or to whitelist or blacklist the site.
Earlier quoted context omitted.
Knowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.
So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens? Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.
IPv6 with its built in true end-to-end connectivity just called and wants to have a word with you, but you were stuck behind some inferior IPv4 NAT blockade.