81–90 of 159 posts
I don't really understand how it can leak the real IP address when using VPN. Since everything is going to the VPN anyway, how this would work ?
Earlier quoted context omitted.
It is a technical requirement, because the protocol attempts to connect over the local network if both peers are under the same NAT. The local IP is shared so that the peers can attempt to make a local connection.
I'd assume that this is a rather rare usecase in the world wide web, so why is it not disabled by default?
Note: this is a simplified explanation. Some details are glossed-over/wrong. But it will give you the basic idea. In order for someone to be able to talk to your machine they need to know your IP address. In general, this if fine because you can just tell people your IP address. However if you are on an internal LAN then you have the same external IP address as everybody else on the LAN. There needs to be a way to route packets to you.
A P2P application needs to have some way of telling the outside world, "If you want to send packets to me, this is how to do it". Of course, LANs are designed to stop people from being able to randomly send packets from outside the LAN to machines inside the LAN for obvious security reasons. So if you do this, then you are compromising the security of your LAN to a certain degree.
As I said, P2P apps need the ability to advertise how to connect to you or else you can only connect outwards. In other words, if it were a telephone, you could make outgoing calls, but couldn't receive incoming calls because nobody knows where you are. So when you start up Skype or Bittorrent, etc, it usually uses some tricks to figure out how people can contact you and advertises it.
The problem with WebRTC is not so much that it has this capability -- it needs it. The problem is that it is accessible remotely and doesn't ask for permission. You can go to a website that will jam some javascript at you that gets this information.
You can't even turn it off in the case that you don't want to use WebRTC. Requests to change the functionality to prompt the user (or at least have an option to prompt the user) when this functionality is used has been turned down. Not a lot of coherent reasoning has been given (as far as I can tell), but I imagine that the implementation is difficult and they don't think the majority of users will care.
I suppose as a middle-ground they have offered this plugin. I have my own strongly held beliefs on this topic (which may be evident from what I wrote), but hopefully this is neutral enough that you can understand the issue, do some reading and form your own opinion.
Could somebody please explain whether it is a technical requirement to leak the internal IP address for this technology to succeed or, if not, what possible reasons could exist for this design decision?
It is a technical requirement, because the protocol attempts to connect over the local network if both peers are under the same NAT. The local IP is shared so that the peers can attempt to make a local connection.
What the fuck, this leaked your real IP behind VPN since January 2014 and this isn't fixed yet? This sure looks like a Heartbleed-tier high-priority security hole to me. How is this not bigger news?
They leak the internal IP assigned to you by a VPN, which is not the same IP as the one seen by the websites you browse, nor is it the same as the IP assigned to you by your ISP.
Though, I did test this on a college campus, so the network might just be leaking my internal ip, which ends up being my external ip also because of how they have the network setup. Which in hindsight is actually even scarier.
Could somebody please explain whether it is a technical requirement to leak the internal IP address for this technology to succeed or, if not, what possible reasons could exist for this design decision?
It is a technical requirement, because the protocol attempts to connect over the local network if both peers are under the same NAT. The local IP is shared so that the peers can attempt to make a local connection.
That's an optimization, not a requirement.
Earlier quoted context omitted.
Doesn't matter. Privacy is not about right or wrong, it is about privacy.
Privacy is not an absolute to be maximized at all costs. Do you have blacked out windows, or do you concede that the practical day-to-day infringement of your privacy is so minuscule and so easily mitigated by window shades that it's not worth the trade-off?
The distinction is both important, and blatantly obvious. Privacy control must remain with the one whose privacy is at stake.
I suppose there might be a problem with IPv4 since there are so few IP addresses, so you'd still be vulnerable to targeted attacks, but it would solve the ad network problem.
Am I missing something or just underestimating the usefulness of hashing?
If they restrict WebRTC then they restrict decentralization and that would move Mozilla out of the Freedom column and into the Fascism column with Microsoft.
Earlier quoted context omitted.
Citation please.
> http://www.pcwelt.de/ratgeber/Die-Abmahnindustrie-Jeden-kann... Estimates of 500,000 yearly C&Ds in Germany from 2011. > http://www.wortfilter.de/news11Q1/news3945.html C&D industry in Germany makes about 400 million a year. Don't have numbers from other countries, but it's definitely a big business in Europe.