Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN leaks users’ IPs via WebRTC

voidsec.com

Post reply on HN
Print view View original

101–110 of 172 posts

Re: VPN leaks users’ IPs via WebRTC

#101

Post by progval »

tobltobs wrote: post #31
cosmiccartel wrote: post #2

Just want to point anyone looking to test their own VPN to https://ipleak.net/ . That's been my go-to, and it seems more comprehensive than the linked service.

Or try https://www.doileak.com . (Shameless plug of of a project of mine)

> WebRTC IP Leak: Your local IP: 10.41.41.2 .

> Your browser supports WebRTC! Your real IP address is visible to every website you visit.

>

> Web Real-Time Communication (WebRTC) is enabled by default in Firefox, Opera and Google Chrome, and enables video chat, voice calling and P2P sharing from within your browser.

> A neat trick, but it allows any website to instantly see your true IP address. The only way to avoid sharing your IP address this way is to disable WebRTC completely.

Nope, that's not my "real" IP address

Re: VPN leaks users’ IPs via WebRTC

#102

Post by progval »

tobltobs wrote: post #31
cosmiccartel wrote: post #2

Just want to point anyone looking to test their own VPN to https://ipleak.net/ . That's been my go-to, and it seems more comprehensive than the linked service.

Or try https://www.doileak.com . (Shameless plug of of a project of mine)

> Timezone Difference: The time zone of your browser is while your request IP location timezone is Europe/Paris.

Looks like there is a word missing.

Re: VPN leaks users’ IPs via WebRTC

#103

Post by fauigerzigerk »

bubblethink wrote: post #94
fauigerzigerk wrote: post #41

Earlier quoted context omitted.

>Its not "VPN providers" its "VPN provider software" OpenVPN leaks DNS on every default Ubuntu installation I have tried. But I think it's actually Ubuntu NetworkManager's fault. The WebRTC leaks discussed in this article are not prevented by OpenVPN either (last time I checked, which was a while ago). You have to disable WebRTC in the browser.

>OpenVPN leaks DNS on every default Ubuntu installation I have tried. But I think it's actually Ubuntu NetworkManager's fault. Yeah, that's known behaviour. I think it's working as intended from Ubuntu/NM's standpoint since that bug has been open for a while with no fixes. The one line fix for that is to comment out dns=dnsmasq in NM's config. This is the bug for reference: https://bugs.launchpad.net/ubuntu/+source/n…

>The one line fix for that is to comment out dns=dnsmasq in NM's config.

There is no such line on either of the two leaking systems I just checked.

Re: VPN leaks users’ IPs via WebRTC

#104

Post by Waterluvian »

MichaelGG wrote: post #61
lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is…

I use wrbrtc for lossy robot pose data. It would suck to require another approval popup in my software, but really, it's no big deal. Certainly the UX cost is worth the security benefits if we can't have both.

Re: VPN leaks users’ IPs via WebRTC

#105

Post by jaxn »

OrganicMSG wrote: post #53
jaxn wrote: post #19

Earlier quoted context omitted.

Profitability (or the possibility of profitability) is absolutely a measure of whether something can be relied on. And if it can't possibly be profitable, then it means there is likely a non-obvious revenue stream or funding source, which means a ulterior motive. So yeah, if a service can't be profitable, it can't be trusted.

A decent emergency medical response service is never profitable. It requires a vast amount of hospitals to ensure that there is one local enough to wherever you get ill or injured and they all have to be staffed by lots of different highly qualified specialists who are in as regular practice as possible. If you were going to require that they be profitable, there simply are not enough rich people for the doctors to w…

Good point. I should have been more clear about "non-obvious" funding sources. If a service isn't profitable, but has a clear funding source (philanthropy, government, etc), that is a little different. But the motive for that funding would need to be clear as well.

So yeah, charities can be ok.

Re: VPN leaks users’ IPs via WebRTC

#106

Post by Sohcahtoa82 »

superkuh wrote: post #59
Hnrobert42 wrote: post #9

Earlier quoted context omitted.

> By using a VPN you cut yourself off from participating as an equal citizen on the net. What?

You can't host servers off a VPN. You don't have control or use of your own ports. You can consume and that's about it.

If I wanted to host servers, I'd host them somewhere else, not on my home internet connection.

I'm really not sure what point you're trying to make, or how you're defining "participating" in this context.

Re: VPN leaks users’ IPs via WebRTC

#107

Post by MichaelGG »

Aloha wrote: post #68
blattimwind wrote: post #64

Earlier quoted context omitted.

TBH just from setting up one (1) PBX with about half a dozen devices from only two manufacturers -- I would never take a job anywhere near anything having something todo with SIP, ever.

SIP is one of a few protocols where two completely standard-compliant implementations are commonly unable to interop.

Oh it gets better. I have implemented SIP software (written, from scratch). On the SIP implementors mailing list, one of the authors defends the insane parsing rules by saying that C and Java allow you to be flexible with syntax, so why not SIP?

They are totally detached from actually implementing elegant or high performance software. Actual engineers achieve this despite of SIP's terrible decisions. Granted, many of those are inherited from HTTP. Tell me how many HTTP stacks handle comments and line folding properly...

It opens up security holes, too. One proxy interprets \r\r\n as 1 line break, another as 2 line breaks and start of body. Oops, now you can end up sending fun headers to your target because they try to be flexible in accepting input.

IIRC there is essentially no way to implement SIP standardly because of so many broken implementations. You have to make some decisions on certain parsing that will break one but any other way will break another.

Text-based protocols invite abuse by designers and implementors alike. IETF compounds these by living in a fantasy world.

Re: VPN leaks users’ IPs via WebRTC

#108

Post by MichaelGG »

Paul-ish wrote: post #100
MichaelGG wrote: post #61

Earlier quoted context omitted.

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is…

My impression is that this is a conflict between the WebRTC folks and the UX folks. The WebRTC team is happy to prompt you to use data channels, but the UX team doesn't want to over saturate people with security warnings. Especially warnings that people wont understand.

I'm only going off some in-person dealing with folks behind WebRTC and they know that permissions suck and would hurt adoption and hence fight to make sure they don't happen.

They dismiss all privacy concerns with "you can't have privacy in a browser" and "fingerprinting will work anyways so we can't make it worse". It's head-in-sand approach to privacy and it's bad.

Even then, Firefox is simply wrong to tell people it'll use your proxy, then throw that out.

Re: VPN leaks users’ IPs via WebRTC

#109

Post by th0ma5 »

bubblethink wrote: post #83
th0ma5 wrote: post #63

Earlier quoted context omitted.

I tried some of the leak tests here, it seems to leak my NAT address not my nearest public IP? Can anyone chime in?

It's not even the local ip of your home network. It's the ip of the tunnel interface. I don't know how this can be misused. It's only on firefox though. On chromium, it just shows 0.0.0.0 instead.

Yes that's exactly what I see. This seems to me to be a non-issue but perhaps other configurations and VPNs behave differently? I was using my phone into my home router with OpenVPN and it showed my VPN assigned NAT address 10.x.x.x ...
Post reply on HN