“We are considering adding an extension to restrict the use of WebRTC” • Hacker News Board

Re: “We are considering adding an extension to restrict the use of WebRTC”

#51

Post by LMAlVvQjSGj » Tue, Jul 28, 2015, 12:08 PM UTC

yAnonymous wrote: post #46

jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

For one, the way it's implemented now, it's only a matter of time until we see WebRTC torrent malware downloading copyrighted files to give copyright holders a reason to sue / C&D users. In a time where sharing an MP3 can cost thousands of dollars, having a protocol that can share data like that without the users' consent is crazy.

Can they actually sue users when the copyright holders are the ones distributing the content?

Re: “We are considering adding an extension to restrict the use of WebRTC”

#52

Post by langarto » Tue, Jul 28, 2015, 12:09 PM UTC

yAnonymous wrote: post #46

jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

For one, the way it's implemented now, it's only a matter of time until we see WebRTC torrent malware downloading copyrighted files to give copyright holders a reason to sue / C&D users. In a time where sharing an MP3 can cost thousands of dollars, having a protocol that can share data like that without the users' consent is crazy.

What is crazy is that “sharing an MP3 can cost thousands of dollars”, not any protocol.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#53

Post by monstruoso » Tue, Jul 28, 2015, 12:09 PM UTC

anfedorov wrote: post #49

kuschku wrote: post #23

Earlier quoted context omitted.

The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/

And by "exactly that purpose" you mean preventing ad fraud [1], right? They weren't using WebRTC to put you in a "VPN user" advertising segment. 1. https://www.reddit.com/r/netsec/comments/3dgwee/how_the_new_...

Doesn't matter. Privacy is not about right or wrong, it is about privacy.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#54

Post by jnbiche » Tue, Jul 28, 2015, 12:12 PM UTC

higherpurpose wrote: post #32

jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

Look at it this way - if Tor (which is based on Firefox) allowed WebRTC by default, it would be useless for its intended privacy purpose.

I agree that Tor is a special case, but who uses Tor without Tor Button, Tor Browser, or something similar? It's easy to disable WebRTC in those instances.

Regarding internal VPN IPs, I don't understand how this would help an attacker. If someone has broken into a VPN network and is in a position where they could make use of that data, then it's game over anyway. Otherwise, what do you want with an internal IP, besides fingerprinting?

By the way, fingerprinting no doubt is an issue, along with a dozen or so other JavaScript APIs that leak data. If you don't want to be fingerprinted, use something like NoScript. Advertisers can already uniquely identify you based on various other data leaked by JS, don't know why WebRTC has been singled out for this reason.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#55

Post by jalfresi » Tue, Jul 28, 2015, 12:17 PM UTC

jnbiche wrote: post #13

gbl08ma wrote: post #4

Earlier quoted context omitted.

Knowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.

So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens? Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.

The web isn't peer to peer. Why would I want a web browser to do peer to peer? Its a web browser!

Re: “We are considering adding an extension to restrict the use of WebRTC”

#56

Post by madeofpalk » Tue, Jul 28, 2015, 12:21 PM UTC

kuschku wrote: post #23

madeofpalk wrote: post #12

Earlier quoted context omitted.

WebRTC is being singled out as it leaks user information that wasn't leaking before. AFAIK, the conspiracy-minded people are claiming that this is a move by 'advertisers' to collect more user-identifying data.

The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/

Although NYT shouldn't get off scott-free, I think it's worth pointing out that they probably had very little to do with this and more than likely had no idea about it. The WebRTC 'tracking' was from a script from an ad network[1] used by at least Ars Technica and The Washington Post.

As someone who works on sites implementing display advertising using these sorts of networks, I have nothing but contempt for the developers that are writing these JS. I've lost count of all the JS errors they cause (currently I see a lot of `Can't find variable: _body`), or just errant console.log messages (one on every browser scroll or resize was fun).

[1]: Edit: Amusingly I found a developer arguing for this WebRTC-punching, who says he's from White Ops (whiteops.com) working on anti-bot tools https://github.com/EFForg/privacybadgerchrome/issues/431#iss...

Re: “We are considering adding an extension to restrict the use of WebRTC”

#57

Post by Grue3 » Tue, Jul 28, 2015, 12:24 PM UTC

What the fuck, this leaked your real IP behind VPN since January 2014 and this isn't fixed yet? This sure looks like a Heartbleed-tier high-priority security hole to me. How is this not bigger news?

Re: “We are considering adding an extension to restrict the use of WebRTC”

#58

Post by giantdongfuz » Tue, Jul 28, 2015, 12:26 PM UTC

Grue3 wrote: post #57

What the fuck, this leaked your real IP behind VPN since January 2014 and this isn't fixed yet? This sure looks like a Heartbleed-tier high-priority security hole to me. How is this not bigger news?

there's no way this is in the same tier

Re: “We are considering adding an extension to restrict the use of WebRTC”

#59

Post by JupiterMoon » Tue, Jul 28, 2015, 12:29 PM UTC

madeofpalk wrote: post #56

kuschku wrote: post #23

Earlier quoted context omitted.

The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/

Although NYT shouldn't get off scott-free, I think it's worth pointing out that they probably had very little to do with this and more than likely had no idea about it. The WebRTC 'tracking' was from a script from an ad network[1] used by at least Ars Technica and The Washington Post. As someone who works on sites implementing display advertising using these sorts of networks, I have nothing but contempt for the deve…

There's quite a lot of case law that says that companies can be held responsible for their subcontractors. See e.g. Deepwater Horizon

I am not a lawer. This is not legal advice.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#60

Post by yAnonymous » Tue, Jul 28, 2015, 12:30 PM UTC

LMAlVvQjSGj wrote: post #51

yAnonymous wrote: post #46

Earlier quoted context omitted.

For one, the way it's implemented now, it's only a matter of time until we see WebRTC torrent malware downloading copyrighted files to give copyright holders a reason to sue / C&D users. In a time where sharing an MP3 can cost thousands of dollars, having a protocol that can share data like that without the users' consent is crazy.

Can they actually sue users when the copyright holders are the ones distributing the content?

In many European countries they can. They set up honey pots, log everything and then send costly C&Ds to thousands of people. Courts usually believe their "proof", no matter how bad it is.

It's probably a billion dollar business by now.