If Mozilla is really concerned with leaking user information, then the extension should extend the use of WebRTC with a default to restrict the use of WebRTC
“We are considering adding an extension to restrict the use of WebRTC”
131–140 of 159 posts
Re: “We are considering adding an extension to restrict the use of WebRTC”
#132Chrome users, look here: https://chrome.google.com/webstore/detail/webrtc-block/nphkk... or https://chrome.google.com/webstore/detail/webrtc-leak-preven...
For Chrome, UBlock Origin also has the option to prevent WebRTC IP Leaks: https://chrome.google.com/webstore/detail/ublock-origin/cjpa...
How cool, thanks. Have not seen that before!
Re: “We are considering adding an extension to restrict the use of WebRTC”
#133Does anyone else feel that there's something terribly odd going on when restricting something needs to be an extension ? IMHO it should be a configuration option, per-site, and off by default. WebRTC also isn't the only thing that applies to.
The recent moves to turn the browser into its own OS are worrying. The problem I see is that no one seems to care. Its full steam ahead and its only later do we realize that these new feature and standards are trivial to abuse. I really wish there was some kind of web mission statement on where browsers are going instead of this kitchen sink approach. I have no idea what the W3C is thinking. I don't think even the W3…
This situation will become 10x worse when WebAssembly is available and everybody can bypass the usual browser features by uploading their own DRMed/obscured version of freetype. I seriously cannot think of a feature more pathological to the open web.
I normally rely on Hanlon's razor and assume this is the work of a bunch of short-sighted nerds that are only looking at the fun-and-shiny features. In light of stuff like BULLRUN and the methods described in PHK's amazing "Operation Orchestra"[1], I am forced to wonder who is pushing this crap - because someone is obviously trying to create a digital imprimatur[2].
[1] https://archive.fosdem.org/2014/schedule/event/nsa_operation...
Re: “We are considering adding an extension to restrict the use of WebRTC”
#134Earlier quoted context omitted.
The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/
Although NYT shouldn't get off scott-free, I think it's worth pointing out that they probably had very little to do with this and more than likely had no idea about it. The WebRTC 'tracking' was from a script from an ad network[1] used by at least Ars Technica and The Washington Post. As someone who works on sites implementing display advertising using these sorts of networks, I have nothing but contempt for the deve…
Why are you even running scripts from a third party on your own site?
If the ad is a static image, use an tag. If it's text, show the text. If it's a video, use . If they want to run custom code, tell them to get lost.
Yeah, it's ultimately the ad networks' fault, but what did you expect?
Re: “We are considering adding an extension to restrict the use of WebRTC”
#135Earlier quoted context omitted.
I agree that Tor is a special case, but who uses Tor without Tor Button, Tor Browser, or something similar? It's easy to disable WebRTC in those instances. Regarding internal VPN IPs, I don't understand how this would help an attacker. If someone has broken into a VPN network and is in a position where they could make use of that data, then it's game over anyway. Otherwise, what do you want with an internal IP, besid…
Because IP addresses feel private. Even though you send one with every packet. Even though the extra one sent by webrtc is the one behind your NAT, and probably just 192.168.[0,1].
They can actually be private. What if you set up a proxy or a VPN with the express purpose of masking your real IP address, and then WebRTC barfs it out on demand anyway?
Re: “We are considering adding an extension to restrict the use of WebRTC”
#136Earlier quoted context omitted.
For Chrome, UBlock Origin also has the option to prevent WebRTC IP Leaks: https://chrome.google.com/webstore/detail/ublock-origin/cjpa...
How cool, thanks. Have not seen that before!
This and uMatrix (https://github.com/gorhill/uMatrix/wiki) both forked from HTTP Switchboard.
uBlock is an adblocker, uMatrix has finely grained matrix controls for which http requests are even allowed to go through and requires tuning for most sites. I like having both :)
Re: “We are considering adding an extension to restrict the use of WebRTC”
#137Earlier quoted context omitted.
Leaking a client IP address is not even near the same universe of severity as remotely obtaining a web servers private TLS key. Given the lack of perfect forward secrecy used by web servers at the time, Heartbleed was a "read any encrypted traffic sent by the server, ever" issue.
WebRTC doesn't just leak the client IP address, it also leaks the public IP address of all network interfaces on the machine. If you're on a VPN, it can mean you leak your real IP address, too. Many Chinese use VPNs to circumvent censorship or participate in speech, so leaking your real IP address is potentially life threatening.
Yes, and Java can leak your real IP address and Flash can leak your real IP address.
If you attack scenario is trying to circumvent authoritative governments, don't use a web browser with extra features or plugins like WebRTC turned on.
"Hiding a users 's true IP at all costs who are using a VPN" is not a reasonable design expectation for mainstream browsers. They are fixing bugs and adding features. This is an extreme edge case at best for them.
Re: “We are considering adding an extension to restrict the use of WebRTC”
#138I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…
Yeah, it seems like the issue is running unverified third-party javascript on your webpage. This is part of the reason why I use privacy badger because many sites seem to do this.
If you want to prevent data from being sent to servers about you, you pretty much have to disable javascript completely though.
Re: “We are considering adding an extension to restrict the use of WebRTC”
#139Earlier quoted context omitted.
Although NYT shouldn't get off scott-free, I think it's worth pointing out that they probably had very little to do with this and more than likely had no idea about it. The WebRTC 'tracking' was from a script from an ad network[1] used by at least Ars Technica and The Washington Post. As someone who works on sites implementing display advertising using these sorts of networks, I have nothing but contempt for the deve…
They aren't written for the user experience, they're written by low-level techs usually (because the JS part isn't as "cool/exciting/important" as the backend part) to just get the ad on the page somehow. It's probably the worst of the worst in JS engineering sadly.
Probably so... maybe if the browsers put limits as to the amount of JS content can go into a given iframe (including child frames) to say 80KB, that would cut a lot of it out. It would still allow for a LOT of code, but not nearly the kitchen sink + the kitchen.
Then again between Ghostery and uBlock, I don't see most of it.
Re: “We are considering adding an extension to restrict the use of WebRTC”
#140Earlier quoted context omitted.
Better to just disable it from the about:config menu in my opinion, no need for an extension. To do this In Firefox: 1) Type 'about:config' in your address bar 2) Set 'media.peerconnection.enabled' value to 'false'. (The Default value is 'true')
This addon does as you suggest but with a simple click as opposed to having to go into about:config. Better if you think you might use webrtc from time to time.
I can actually see WebRTC becoming very useful... I actually miss the days where the likes of IRC, AOL and Yahoo group chats were more common... I wouldn't even know where to begin if I just wanted to chat with random people who are relatively local to me today.
Not just voice/video but text. That said, I'm not sure how useful the P2P aspects of text are, but being able to send files directly would be a nice ability.