I don't really understand how it can leak the real IP address when using VPN. Since everything is going to the VPN anyway, how this would work ?
“We are considering adding an extension to restrict the use of WebRTC”
31–40 of 159 posts
Re: “We are considering adding an extension to restrict the use of WebRTC”
#32I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…
Look at it this way - if Tor (which is based on Firefox) allowed WebRTC by default, it would be useless for its intended privacy purpose.
Re: “We are considering adding an extension to restrict the use of WebRTC”
#33Earlier quoted context omitted.
It makes it somewhat easier to XSS into your router. (P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)
Can you expand on this, please? How does it make it easier to XSS?
It doesn't. All major browsers block connections to 192.168.XX.XX (and any other externally unroutable IP) from external (http on the Web, not localhost) web pages.
Re: “We are considering adding an extension to restrict the use of WebRTC”
#34Could somebody please explain whether it is a technical requirement to leak the internal IP address for this technology to succeed or, if not, what possible reasons could exist for this design decision?
Advantages are better chance of connection success for a multihomed device and finding more direct connections (e.g. if you are in the same network as your peer, a direct connection likely is quicker than one which has to go through your internet gateway, and can be established more reliably if you are behind NAT towards the internet)
Re: “We are considering adding an extension to restrict the use of WebRTC”
#35I don't really understand how it can leak the real IP address when using VPN. Since everything is going to the VPN anyway, how this would work ?
Your network interface still has information about your regular internet connection, even when connected through a VPN. Local apps can query this information. Webrtc clients do this in order to assist setting up direct connections -- it doesn't know you're using a VPN, and will happily hand over info about your network interface to any site.
Re: “We are considering adding an extension to restrict the use of WebRTC”
#36I don't really understand how it can leak the real IP address when using VPN. Since everything is going to the VPN anyway, how this would work ?
[deleted]
Re: “We are considering adding an extension to restrict the use of WebRTC”
#37Earlier quoted context omitted.
Knowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.
So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens? Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.
No, just make sure the web's big shot at peer-to-peer networking doesn't poke yet another hole in the already shabby privacy of today's average web user.
I won't even go into the debate of whether or not we want "the web" to be the support for the p2p network of the future.
> Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies.
On the other hand, this particular problem is another ace in the hands of those huge personal data-scarfing companies.
Re: “We are considering adding an extension to restrict the use of WebRTC”
#38The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?
It makes DNS rebinding attacks simpler, for example:
https://miki.it/blog/2015/4/20/the-power-of-dns-rebinding-st...
Re: “We are considering adding an extension to restrict the use of WebRTC”
#39I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…
Look at it this way - if Tor (which is based on Firefox) allowed WebRTC by default, it would be useless for its intended privacy purpose.
TorBrowser might be a reskinned and customized Firefox, but the Tor network is not.
Re: “We are considering adding an extension to restrict the use of WebRTC”
#40The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?
I think this is a legitimate question. If people are saying knowledge of specific computer addresses is harmful it's the same as saying IPv6 is harmful, which would be a shame.
I also understand the proxy / vpn IP leaking issue. But since firefox is self reporting here, surely it would be possible to have a plugin to mask the actual IP or report garbage for those who have privacy concerns? It's overkill to disable or lobotomize the whole feature because of that one use case.