Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN leaks users’ IPs via WebRTC

voidsec.com

Post reply on HN
Print view View original

111–120 of 172 posts

Re: VPN leaks users’ IPs via WebRTC

#111

Post by joering2 »

I'm suprised to see NordVPN is leaking.

I see commercials everywhere all the time and its #1 or #2 on most VPN reviews websites.

I was very tempted to switch, especially when they routers' Firmware is available for the newest/coolest routers out there; but kind of got used to ExpressVPN over the years, so went with them and their firmware for NETGEAR Nighthawk R7000 is very easy to use. Glad to see ExpressVPN is not leaking and I continue not to find any bad news about them (versus HideMyAss for example LOL)

Re: VPN leaks users’ IPs via WebRTC

#112

Post by giancarlostoro »

lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

The weird thing for me is I'm on Firefox on my Mac and I ran all those tests and it said WebRTC is enabled, but never gave my actual factual IP address. I'm running Private Internet Access which they claim is vulnerable... So I'm not sure whose doing that test but they might have their settings a bit jacked up? If you have Private Internet Access there is an "Advanced Settings" panel where you can click on "IPv6 leak protection" it disabled IPv6 while using the VPN, seems to have been enough to fool these leak tests.

Re: VPN leaks users’ IPs via WebRTC

#113

Post by matheusmoreira »

MichaelGG wrote: post #61
lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is…

What if the entire system is configured to use Tor? Does the use of Tails mitigate this weakness?

Re: VPN leaks users’ IPs via WebRTC

#115

Post by fwip »

superkuh wrote: post #89
gruez wrote: post #81

Earlier quoted context omitted.

>You can consume and that's about it. Uploading videos isn't "consuming". Writing blogs/articles isn't "consuming". Contributing to open source projects isn't "consuming". Neither of those activities require forwarded ports.

True enough. But they also aren't participating in the net. They're using other people and companies' resources to do things rather than participating yourself. And that's bad because it leads to centralization. And centralization leads to perverse incentives to spy and censor.

You've got a weird definition of participation.

Re: VPN leaks users’ IPs via WebRTC

#116

Post by mirimir »

MichaelGG wrote: post #61
lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is…

Yes, this is largely the browser's problem. Because all available uplinks are available. Tor browser doesn't leak, because WebRTC is blocked. But other browsers with WebRTC enabled will leak with a standard Tor setup.

However, using Whonix for Tor, even if you install a random browser with WebRTC enabled, there is no WebRTC leak. Because the workstation VM has no Internet access except through Tor. The gateway VM is not a router. There is no forwarding, and it's firewalled. It just exposes Tor ports to a private internal network, for the workstation VM.

And one can do the same for VPNs, using pfSense VMs as VPN gateways. Apps in workspace VMs have no Internet access except through the VPN client running in the gateway VM.

Re: VPN leaks users’ IPs via WebRTC

#117

Post by djrogers »

rainieri wrote: post #72
confounded wrote: post #37

Earlier quoted context omitted.

Seems very unlikely to me. Both the founder (Andrew Lee) and the CEO (Ted Kim) are known in the industry, have made their views on encryption and authoritarianism pretty clear in interviews, articles, and even full-page ads in the NYT and WaPo to argue for broadband privacy[0] and encryption. PIA also seems pretty profitable; they certainly have enough to contribute to various open source projects, join pro-net-neutr…

What's your take on the recent releases that claim that the US government is funding the Tor network and its development? Information obtained from FOIA requests.

The US Government has a legitimate reason for creating and supporting mechanisms anonymous Internet use by those under the control of oppressive regimes.

Other parts of the US Government appear to have a desire to know everything about everyone all the time.

The "US Government" is not one thing, it's an enormous collection of agencies, bureaus, and humans, who sometimes have desires that are at odds with one another.

Re: VPN leaks users’ IPs via WebRTC

#118

Post by lallysingh »

MichaelGG wrote: post #108
Paul-ish wrote: post #100

Earlier quoted context omitted.

My impression is that this is a conflict between the WebRTC folks and the UX folks. The WebRTC team is happy to prompt you to use data channels, but the UX team doesn't want to over saturate people with security warnings. Especially warnings that people wont understand.

I'm only going off some in-person dealing with folks behind WebRTC and they know that permissions suck and would hurt adoption and hence fight to make sure they don't happen. They dismiss all privacy concerns with "you can't have privacy in a browser" and "fingerprinting will work anyways so we can't make it worse". It's head-in-sand approach to privacy and it's bad. Even then, Firefox is simply wrong to tell people…

Lots of people in webrtc are critically concerned with the safety and privacy of their users.

Re: VPN leaks users’ IPs via WebRTC

#119

Post by lallysingh »

swiley wrote: post #90
lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

This is why when I actually do anything with tor it's always curl -H "" Using something as complex as firefox for anything important is just stupid.

Or just use Qubes on Tor

Re: VPN leaks users’ IPs via WebRTC

#120

Post by _jomo »

While this has long been known, I was never able to actually reproduce this and I'm not sure how it's technically even supposed to work.

Assuming we're using IPv4, the default gateway is a VPN and the machine is behind a NAT: Any outside service (e.g. STUN server) would see the VPN's IP address. How would the browser even technically be able to know the public (i.e. the NAT's) IP address?

However, the WebExtensions API allows tweaking this via the webRTCIPHandlingPolicy to only reveal the public "interface" IP address.

FWIW, I'm always connected to a VPN and I have configured my macOS [0] and Android [1] firewalls to drop any connection other than the VPN's.

0: Wrote it down here: https://jomo.tv/security/pf-prevent-traffic-bypassing-vpn

1: Quite self-explaining: https://f-droid.org/packages/dev.ukanth.ufirewall/

Post reply on HN