Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium based browsers leak user local IP via WebRTC foundation attribute

niespodd.github.io

Post reply on HN
Print view View original

51–60 of 88 posts

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#51

Post by RuggedPineapple »

bearjaws wrote: post #49
jovial_cavalier wrote: post #43

It gets "leaked" to a web app that I'm choosing to connect to? Why do I care?

Yeah we don't need privacy, especially to third party extensions loaded by sites, we should just set our user agent to our full name, address and phone number.

I know you said this as a joke, but I think you underestimate the convenience draw of that. Already if I have to sign up for something on not-my-primary-computer I'm annoyed because I can't use the Chrome autofill to take care of entering my address/phone/credit card details. For a large number of people the privacy concerns take a definite backseat to seamless and quick experiences and there isn't anything wrong with making that value judgement.

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#52

Post by jackewiehose »

lelandfe wrote: post #31
jackewiehose wrote: post #26

How to disable WebRTC on Firefox Mobile? I have uBlock which prevents from leaking the local IP but I don't want WebRTC at all. Why did they take about:config from us?

Damned if you do, damned if you don’t. Disabling WebRTC would make your Firefox instance extremely unique and thus easily fingerprinted.

Yes, but as far as I understand, the fight against fingerprinting is lost anyway.

Having WebRTC enabled can be dangerous for other reasons. You could be seeding a torrent unknowingly just by visiting a website. This can turn into a freaking disaster if you live in country like Germany.

It's a shame that browsers don't ask you for WebRTC like they do with webcams.

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#53

Post by webrtcdev1 »

rollcat wrote: post #36
codedokode wrote: post #20

Earlier quoted context omitted.

I don't think that there are many people using WebRTC especially within the same LAN, but fingerprinting is used by almost every commercial site. So I can assume that this "feature" was used in 99.99% cases for fingerprinting. This shows how browser developers race to push new features without proper estimation of privacy concerns. Luckily this was somewhat fixed by using randomized Apple mDNS names instead of IPs. B…

> But as a result the browser has to support Apple DNS protocol which can potentially increase attack surface. The "Apple" DNS protocol is standard DNS, over a multicast IP address, on port 5353. You can literally use plain old dig to perform mDNS lookups: $ dig @224.0.0.251 -p 5353 +short hello.local 192.168.123.45 If DNS lookups considerably increase your attack surface, something is very, very wrong with your arch…

> literally

The DNS names WebRTC generates for this purpose are random, and known only to the signaling participants.

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#54

Post by jackewiehose »

capitainenemo wrote: post #32
jackewiehose wrote: post #26

How to disable WebRTC on Firefox Mobile? I have uBlock which prevents from leaking the local IP but I don't want WebRTC at all. Why did they take about:config from us?

Yeah, that one was as annoying as what they did to extensions, but at least the Fennec build in F-Droid has it enabled. https://f-droid.org/en/packages/org.mozilla.fennec_fdroid/

Thank you, I will try that. Although I hope that for critical security updates they will be faster... Right now it is lagging behind (105.1.0 vs. current 106.1.0)

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#56

Post by megous »

Etheryte wrote: post #5
Semaphor wrote: post #2

What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?) edit: Thanks everyone, I completely forgot about fingerprinting.

Leaking any kind of data is yet another data point for fingerprinting. You only need a few to uniquely identify a user.

Yeah. All that's needed is to leak link-local IPv6 address from a single interface. There's your unique commputer identifier, unless someone's using mac randomization.

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#57

Post by Fnoord »

WebRTC was already known to leak local IP. Which can be dangerous if you're behind a VPN.

I use two browsers. One with WebRTC disabled (Firefox) and one with WebRTC enabled (Safari/Chromium). The former also runs a myriad of other addons which increase privacy. The latter I use to connect to PiKVM.

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#59

Post by kevincox »

thesuperbigfrog wrote: post #55

If you are unfamiliar with WebRTC I recommend checking out "WebRTC for the Curious": https://webrtcforthecurious.com/ WebRTC is designed to be secure, so a privacy leak is not good.

WebRTC is designed to support direct peer-to-peer connections so the privacy leak is required.

Maybe it would have made more sense to make peer-to-peer opt-in explicit?

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#60

Post by Sean-Der »

kevincox wrote: post #59
thesuperbigfrog wrote: post #55

If you are unfamiliar with WebRTC I recommend checking out "WebRTC for the Curious": https://webrtcforthecurious.com/ WebRTC is designed to be secure, so a privacy leak is not good.

WebRTC is designed to support direct peer-to-peer connections so the privacy leak is required. Maybe it would have made more sense to make peer-to-peer opt-in explicit?

I liked that idea also.

The concern was dialog fatigue. If a web site prompts permission to ‘gather local candidates’ most users are just going to hit OK. So this wouldn’t stop abusive uses of WebRTC as hoped.

Post reply on HN