Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We are considering adding an extension to restrict the use of WebRTC”

bugzilla.mozilla.org

Post reply on HN
Print view View original

101–110 of 159 posts

Re: “We are considering adding an extension to restrict the use of WebRTC”

#101

Post by kuschku »

madeofpalk wrote: post #56
kuschku wrote: post #23

Earlier quoted context omitted.

The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/

Although NYT shouldn't get off scott-free, I think it's worth pointing out that they probably had very little to do with this and more than likely had no idea about it. The WebRTC 'tracking' was from a script from an ad network[1] used by at least Ars Technica and The Washington Post. As someone who works on sites implementing display advertising using these sorts of networks, I have nothing but contempt for the deve…

And this, everyone, is why using pay-per-view or pay-per-click ads online is so destructive.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#102

Post by asquabventured »

mikekchar wrote: post #82
lgrapenthin wrote: post #69

Earlier quoted context omitted.

I'd assume that this is a rather rare usecase in the world wide web, so why is it not disabled by default?

It is rare in WWW land, but not rare in P2P land. Note: this is a simplified explanation. Some details are glossed-over/wrong. But it will give you the basic idea. In order for someone to be able to talk to your machine they need to know your IP address. In general, this if fine because you can just tell people your IP address. However if you are on an internal LAN then you have the same external IP address as everyb…

>You can't even turn it off in the case that you don't want to use WebRTC.

In Firefox, you can easily disable it:

1) Type 'about:config' in your address bar

2) Set 'media.peerconnection.enabled' value to 'false'. (The Default value is 'true')

Re: “We are considering adding an extension to restrict the use of WebRTC”

#103

Post by asquabventured »

ickwabe wrote: post #97
therealmarv wrote: post #15

Chrome users, look here: https://chrome.google.com/webstore/detail/webrtc-block/nphkk... or https://chrome.google.com/webstore/detail/webrtc-leak-preven...

And firefox users here: https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...

Better to just disable it from the about:config menu in my opinion, no need for an extension.

To do this In Firefox:

1) Type 'about:config' in your address bar

2) Set 'media.peerconnection.enabled' value to 'false'. (The Default value is 'true')

Re: “We are considering adding an extension to restrict the use of WebRTC”

#104

Post by marcosdumay »

yAnonymous wrote: post #60
LMAlVvQjSGj wrote: post #51

Earlier quoted context omitted.

Can they actually sue users when the copyright holders are the ones distributing the content?

In many European countries they can. They set up honey pots, log everything and then send costly C&Ds to thousands of people. Courts usually believe their "proof", no matter how bad it is. It's probably a billion dollar business by now.

I'd expect the honey pots to require at least consent before incriminating someone. Successfully incriminating people based on an action that the "damaged" party forced them to do without even their consentiment is a bit too much to expect.

But then, I'm not completely insane. Laws often are.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#105

Post by the8472 »

jnbiche wrote: post #74
lgrapenthin wrote: post #69

Earlier quoted context omitted.

I'd assume that this is a rather rare usecase in the world wide web, so why is it not disabled by default?

No, it's not rare. This is something all peer-to-peer networks running over IPv4 must do. WebRTC video, audio, or data wouldn't work without this.

> all

Considering your emphasis, that's a bold claim. Simple to disprove with a single counter-example: Bittorrent does not communicate your internal IP to do its job

Re: “We are considering adding an extension to restrict the use of WebRTC”

#106

Post by the8472 »

yAnonymous wrote: post #96
anc84 wrote: post #90

Earlier quoted context omitted.

Those are about the Abmahnungen, no mention of honeypots.

To get the required log files, they have to seed the files themselves. No other (legal) way to do it. Swarm information is not enough as it doesn't prove that any data has been transfered.

You could easily download a few chunks from the clients to verify that they are sharing copyrighted works without ever uploading anything to them.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#107

Post by marcosdumay »

drzaiusapelord wrote: post #95
userbinator wrote: post #78

Does anyone else feel that there's something terribly odd going on when restricting something needs to be an extension ? IMHO it should be a configuration option, per-site, and off by default. WebRTC also isn't the only thing that applies to.

The recent moves to turn the browser into its own OS are worrying. The problem I see is that no one seems to care. Its full steam ahead and its only later do we realize that these new feature and standards are trivial to abuse. I really wish there was some kind of web mission statement on where browsers are going instead of this kitchen sink approach. I have no idea what the W3C is thinking. I don't think even the W3…

The kitchen sink approach is a Nash optimum strategy. Any browser that does not adopt it fails.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#108

Post by daxelrod »

jacquesm wrote: post #42
higherpurpose wrote: post #32

Earlier quoted context omitted.

Look at it this way - if Tor (which is based on Firefox) allowed WebRTC by default, it would be useless for its intended privacy purpose.

From my understanding of how this works that's mostly a consequence of the Tor browser trying to achieve network privacy and anonymity at the wrong layer. The right way would be to route all the requests through Tor, not just those from the engine of the browser.

I used to be of this opinion, but [1] changed my mind.

The problem is that there's a huge potential to deanonymize the user at an exit node because of all sorts of traffic other than web browsing. Do all of your chat programs encrypt everything? How about your email client? What about every daemon on your system that accesses the Internet?

At the very least, all of these can be used to fingerprint you.

WebRTC is a great example of why the user-agent turns out to be the right level to think about anonymity over Tor.

[1]: http://www.wired.com/2014/10/anonymity-routers/

Re: “We are considering adding an extension to restrict the use of WebRTC”

#109

Post by newscracker »

I hope Mozilla takes a quick decision on this based on its own principles. This sentence saying "we are considering adding an extension" seems to be in stark contrast with the way Pocket was added into the main browser instead of being an ad or recommendation on the new tab page.
Post reply on HN