Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We are considering adding an extension to restrict the use of WebRTC”

bugzilla.mozilla.org

Post reply on HN
Print view View original

41–50 of 159 posts

Re: “We are considering adding an extension to restrict the use of WebRTC”

#41

Post by DonHopkins »

josteink wrote: post #30
jnbiche wrote: post #13

Earlier quoted context omitted.

So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens? Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.

> So we're willing to destroy the web's big shot at peer-to-peer networking IPv6 with its built in true end-to-end connectivity just called and wants to have a word with you, but you were stuck behind some inferior IPv4 NAT blockade.

>"IPV6 ... just called"

IPV6 over POTS? How retro!

Re: “We are considering adding an extension to restrict the use of WebRTC”

#42

Post by jacquesm »

higherpurpose wrote: post #32
jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

Look at it this way - if Tor (which is based on Firefox) allowed WebRTC by default, it would be useless for its intended privacy purpose.

From my understanding of how this works that's mostly a consequence of the Tor browser trying to achieve network privacy and anonymity at the wrong layer.

The right way would be to route all the requests through Tor, not just those from the engine of the browser.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#43

Post by michaelmior »

pornel wrote: post #18

How about not disabling it, but merely making use of it visible? (e.g. an icon or a notice in the addressbar) It would discourage reputable sites from abusing it, because users would start asking questions why a news site wants a p2p/videoconference connection.

WebRTC is not just for videoconferencing and I don't think it's obvious that there aren't any legitimate use cases.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#44

Post by michaelmior »

pornel wrote: post #18

How about not disabling it, but merely making use of it visible? (e.g. an icon or a notice in the addressbar) It would discourage reputable sites from abusing it, because users would start asking questions why a news site wants a p2p/videoconference connection.

WebRTC is not just for videoconferencing and I don't think it's obvious that there aren't any legitimate use cases.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#45

Post by anfedorov »

rc4algorithm wrote: post #11
anfedorov wrote: post #2

The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?

Don't be simple. This can reveal people that are using proxies like Tor and VPNs, and it's already being exploited by trackers: https://webrtchacks.com/dear-ny-times/

Good point re: VPN [0]. The example you point to is not a tracker, though.

Looks like the Tor bundle disabled WebRTC about two years ago [1] [2]. I think a VPN user would expect the WebRTC connection to be routed via a VPN, as well, but I'm still figuring out how those work, exactly :)

0. PPTP exposes that you're on VPN and your computer's IP http://i.imgur.com/mKKfjj7.png, as does L2TP http://i.imgur.com/C68HvSN.png, while OpenVPN only exposes that you're (probably) on a VPN: http://i.imgur.com/IVQkwsd.png.

1. https://trac.torproject.org/projects/tor/ticket/8178

2. http://i.imgur.com/9zEPduB.png

Re: “We are considering adding an extension to restrict the use of WebRTC”

#46

Post by yAnonymous »

jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

For one, the way it's implemented now, it's only a matter of time until we see WebRTC torrent malware downloading copyrighted files to give copyright holders a reason to sue / C&D users.

In a time where sharing an MP3 can cost thousands of dollars, having a protocol that can share data like that without the users' consent is crazy.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#47

Post by makomk »

j-pb wrote: post #14

In other news, Mozilla is considering the restriction of IPv6, because it leaks the internal IP. (VPN leakage is a valid concern though)

Most IPv6 implementations these days use a randomly-generated address which is periodically rotated to avoid this problem. Unfortunately, I'm pretty sure WebRTC renders this useless because it leaks all the IPv6 addresses, including link-local ones containing the hardware MAC address.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#48

Post by callesgg »

pjc50 wrote: post #3
anfedorov wrote: post #2

The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?

It makes it somewhat easier to XSS into your router. (P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)

"Somewhat" is kind of important here. In practice you can easily just test 10 or so most common router ip addresses in under 5 seconds. And probably get a 95% hit ratio:

192.168.1.1 192.168.0.1 192.168.2.1 192.168.10.1 192.168.100.1 10.0.0.1 172.30.0.1 172.30.1.1 172.30.1.1

Re: “We are considering adding an extension to restrict the use of WebRTC”

#49

Post by anfedorov »

kuschku wrote: post #23
madeofpalk wrote: post #12

Earlier quoted context omitted.

WebRTC is being singled out as it leaks user information that wasn't leaking before. AFAIK, the conspiracy-minded people are claiming that this is a move by 'advertisers' to collect more user-identifying data.

The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/

And by "exactly that purpose" you mean preventing ad fraud [1], right? They weren't using WebRTC to put you in a "VPN user" advertising segment.

1. https://www.reddit.com/r/netsec/comments/3dgwee/how_the_new_...

Re: “We are considering adding an extension to restrict the use of WebRTC”

#50

Post by hyperpape »

pornel wrote: post #18

How about not disabling it, but merely making use of it visible? (e.g. an icon or a notice in the addressbar) It would discourage reputable sites from abusing it, because users would start asking questions why a news site wants a p2p/videoconference connection.

Because if you really need to be anonymous, it's not good enough to catch it being used after the fact.

Notifying the user after the fact sometimes works for things that are nuisances, but isn't good for privacy/security (imagine if your browser would execute unsandboxed JS and show you an icon each time it did it).

Post reply on HN