Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We are considering adding an extension to restrict the use of WebRTC”

bugzilla.mozilla.org

Post reply on HN
Print view View original

111–120 of 159 posts

Re: “We are considering adding an extension to restrict the use of WebRTC”

#111

Post by lallysingh »

jnbiche wrote: post #54
higherpurpose wrote: post #32

Earlier quoted context omitted.

Look at it this way - if Tor (which is based on Firefox) allowed WebRTC by default, it would be useless for its intended privacy purpose.

I agree that Tor is a special case, but who uses Tor without Tor Button, Tor Browser, or something similar? It's easy to disable WebRTC in those instances. Regarding internal VPN IPs, I don't understand how this would help an attacker. If someone has broken into a VPN network and is in a position where they could make use of that data, then it's game over anyway. Otherwise, what do you want with an internal IP, besid…

Because IP addresses feel private. Even though you send one with every packet. Even though the extra one sent by webrtc is the one behind your NAT, and probably just 192.168.[0,1].

Re: “We are considering adding an extension to restrict the use of WebRTC”

#112

Post by lallysingh »

yAnonymous wrote: post #46
jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

For one, the way it's implemented now, it's only a matter of time until we see WebRTC torrent malware downloading copyrighted files to give copyright holders a reason to sue / C&D users. In a time where sharing an MP3 can cost thousands of dollars, having a protocol that can share data like that without the users' consent is crazy.

That's pure FUD. Regular HTTP can do all that now.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#113

Post by rumdz »

SG- wrote: post #29

I think the sensible solution (and this goes for anything where there's security or privacy concern like WebGL) is to block it by default however to prompt the user that the website wants to use WebRTC. The user can then choose to allow it for one time or to whitelist or blacklist the site.

I really hope someone from Mozilla reads your comment. That sounds like a good solution to me too.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#114

Post by ickwabe »

asquabventured wrote: post #103
ickwabe wrote: post #97

Earlier quoted context omitted.

And firefox users here: https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...

Better to just disable it from the about:config menu in my opinion, no need for an extension. To do this In Firefox: 1) Type 'about:config' in your address bar 2) Set 'media.peerconnection.enabled' value to 'false'. (The Default value is 'true')

This addon does as you suggest but with a simple click as opposed to having to go into about:config. Better if you think you might use webrtc from time to time.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#115

Post by Semaphor »

therealmarv wrote: post #15

Chrome users, look here: https://chrome.google.com/webstore/detail/webrtc-block/nphkk... or https://chrome.google.com/webstore/detail/webrtc-leak-preven...

For Chrome, UBlock Origin also has the option to prevent WebRTC IP Leaks: https://chrome.google.com/webstore/detail/ublock-origin/cjpa...

Re: “We are considering adding an extension to restrict the use of WebRTC”

#116

Post by dont_care »

Wow, big deal. An extension. Oh noes.

Plug-ins and extensions are, like, mostly non-existent entities, when released under circumstances without any actual demand for them. (compare/contrast: Java to AdBlock)

  > But-but-but evil corporate overlords!
So what? They can do whatever they want on their core networks, so long as it doesn't bleed outside their edge.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#117

Post by hyperpape »

sp332 wrote: post #98
hyperpape wrote: post #50

Earlier quoted context omitted.

Because if you really need to be anonymous, it's not good enough to catch it being used after the fact. Notifying the user after the fact sometimes works for things that are nuisances, but isn't good for privacy/security (imagine if your browser would execute unsandboxed JS and show you an icon each time it did it).

It wouldn't have to be after the fact. Firefox already has a little pop-up when sites want to get your location. The options are yes/no/never for this site.

Definitely, though that's not the suggestion I was responding to.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#118

Post by return0 »

jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

> I don't understand why a peer-to-peer network connection is different from Ajax

Ajax is one-way

Re: “We are considering adding an extension to restrict the use of WebRTC”

#119

Post by Grue3 »

Shish2k wrote: post #80
Grue3 wrote: post #57

What the fuck, this leaked your real IP behind VPN since January 2014 and this isn't fixed yet? This sure looks like a Heartbleed-tier high-priority security hole to me. How is this not bigger news?

Approximately nobody outside the tech industry uses VPNs to hide their real IPs (the number of people using VPNs, period, is relatively tiny compared to the overall population of the internet); approximately everybody who uses the internet uses HTTPS.

By nobody you of course mean "nobody in the US". You're forgetting about the people of China and other states with widespread Internet censorship for whom this leak might not only be critical, but possibly life-threatening.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#120

Post by diafygi »

billyhoffman wrote: post #75
Grue3 wrote: post #57

What the fuck, this leaked your real IP behind VPN since January 2014 and this isn't fixed yet? This sure looks like a Heartbleed-tier high-priority security hole to me. How is this not bigger news?

Leaking a client IP address is not even near the same universe of severity as remotely obtaining a web servers private TLS key. Given the lack of perfect forward secrecy used by web servers at the time, Heartbleed was a "read any encrypted traffic sent by the server, ever" issue.

WebRTC doesn't just leak the client IP address, it also leaks the public IP address of all network interfaces on the machine. If you're on a VPN, it can mean you leak your real IP address, too. Many Chinese use VPNs to circumvent censorship or participate in speech, so leaking your real IP address is potentially life threatening.
Post reply on HN