VPN leaks users’ IPs via WebRTC • Hacker News Board

Re: VPN leaks users’ IPs via WebRTC

#61

Post by MichaelGG » Wed, Mar 28, 2018, 7:12 PM UTC

lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission.

But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels.

Firefox is absolutely in the wrong to ignore your proxy settings, especially without getting consent first to start a call. It's a complete mess. Regardless of what the "spec" says, Firefox is responsible for implementing broken software that harms users.

Then again, so is STUN/ICE and basically every single thing that has to do with SIP/VoIP. It's like they go out of their way to be obtuse and come up with shitty standards then take glee in how bad it gets. As an example, look up SIP Torture Tests. There's an RFC just to illustrate the moronic edge-cases in SIP parsing that at one point implies your software needs to be conscious to infer the intention of malformed messages.

t. been working in telecom for far too long

Re: VPN leaks users’ IPs via WebRTC

#62

Post by CamTin » Wed, Mar 28, 2018, 7:14 PM UTC

OrganicMSG wrote: post #53

jaxn wrote: post #19

Earlier quoted context omitted.

Profitability (or the possibility of profitability) is absolutely a measure of whether something can be relied on. And if it can't possibly be profitable, then it means there is likely a non-obvious revenue stream or funding source, which means a ulterior motive. So yeah, if a service can't be profitable, it can't be trusted.

A decent emergency medical response service is never profitable. It requires a vast amount of hospitals to ensure that there is one local enough to wherever you get ill or injured and they all have to be staffed by lots of different highly qualified specialists who are in as regular practice as possible. If you were going to require that they be profitable, there simply are not enough rich people for the doctors to w…

In the US, we essentially do require that they all be profitable or else not exist at all. This is "solved" by just charging you (or your insurance company) tons of money if you actually need to use it. A medical emergency requiring an ER and an ambulance can easily cost as much or more than an ordinary person will earn in their whole lifetime.

Re: VPN leaks users’ IPs via WebRTC

#63

Post by th0ma5 » Wed, Mar 28, 2018, 7:17 PM UTC

lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

I tried some of the leak tests here, it seems to leak my NAT address not my nearest public IP? Can anyone chime in?

Re: VPN leaks users’ IPs via WebRTC

#64

Post by blattimwind » Wed, Mar 28, 2018, 7:18 PM UTC

MichaelGG wrote: post #61

lovelearning wrote: post #22

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how W…

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is…

TBH just from setting up one (1) PBX with about half a dozen devices from only two manufacturers -- I would never take a job anywhere near anything having something todo with SIP, ever.

Re: VPN leaks users’ IPs via WebRTC

#65

Post by roywiggins » Wed, Mar 28, 2018, 7:18 PM UTC

lr4444lr wrote: post #42

zorkw4rg wrote: post #21

Clickbait? Its not "VPN providers" its "VPN provider software", I never even thought of using their software, most just give you the credentials for OpenVPN/IPSEC/PPTP or similar. Also if anonymity is of "real" concern you should never use a system that knows your real IP address in the first place. Instead create the vpn tunnel on a separate host system and run something like Tails in a VM (or better yet separate ph…

I can appreciate the use of Tails in a VM, but doesn't the provider of the "separate host system" have your identity through your payment information?

Running Tails in a VM is so your browser can't leak your real IP to the wider internet even if it wants to, because it doesn't know what it is. Your VM provider still knows your real IP address.

Re: VPN leaks users’ IPs via WebRTC

#66

Post by mahkoh » Wed, Mar 28, 2018, 7:18 PM UTC

fauigerzigerk wrote: post #41

zorkw4rg wrote: post #21

Clickbait? Its not "VPN providers" its "VPN provider software", I never even thought of using their software, most just give you the credentials for OpenVPN/IPSEC/PPTP or similar. Also if anonymity is of "real" concern you should never use a system that knows your real IP address in the first place. Instead create the vpn tunnel on a separate host system and run something like Tails in a VM (or better yet separate ph…

>Its not "VPN providers" its "VPN provider software" OpenVPN leaks DNS on every default Ubuntu installation I have tried. But I think it's actually Ubuntu NetworkManager's fault. The WebRTC leaks discussed in this article are not prevented by OpenVPN either (last time I checked, which was a while ago). You have to disable WebRTC in the browser.

>You have to disable WebRTC in the browser

Incorrect. An easy and foolproof way of using VPNs is with network namespaces. You start the VPN in your init network namespace and then move the created device into a dedicated VPN namespace. OpenVPN has support for this because it allows you to execute a shell script after the VPN device has been created. Then you simply start your browser, torrent client, whatever in this namespace and you are completely safe:

1. If the VPN fails, then the only network device inside the network namespace disappears (modulo the lo device) and the programs in this namespace cannot use the internet.

2. Since the browser can only see the devices within the network namespace, the only IP it can see is the one assigned to you by your VPN provider (usually 10.x.y.z or similar.)

DNS leaks can be prevented by using a generic DNS provider such as 8.8.8.8.

Re: VPN leaks users’ IPs via WebRTC

#67

Post by matthewmacleod » Wed, Mar 28, 2018, 7:19 PM UTC

superkuh wrote: post #59

Hnrobert42 wrote: post #9

Earlier quoted context omitted.

> By using a VPN you cut yourself off from participating as an equal citizen on the net. What?

You can't host servers off a VPN. You don't have control or use of your own ports. You can consume and that's about it.

I’m not sure why you have that idea. I’m not entirely familiar with how most off-the-shelf VPN providers work, but I have a simple IKEv2 VPN hosted on Digitalocean that just gives me a public IP address, to which I can route a thing I want. This service appears be be specifically tailored for that use case, though I know nothing about it: https://staticvpnip.com

Re: VPN leaks users’ IPs via WebRTC

#68

Post by Aloha » Wed, Mar 28, 2018, 7:22 PM UTC

blattimwind wrote: post #64

MichaelGG wrote: post #61

Earlier quoted context omitted.

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is…

TBH just from setting up one (1) PBX with about half a dozen devices from only two manufacturers -- I would never take a job anywhere near anything having something todo with SIP, ever.

SIP is one of a few protocols where two completely standard-compliant implementations are commonly unable to interop.

Re: VPN leaks users’ IPs via WebRTC

#69

Post by rahimnathwani » Wed, Mar 28, 2018, 7:24 PM UTC

ensignro2340 wrote: post #3

Anyone interested in setting up their own VPN should check out Algo: https://github.com/trailofbits/algo

Not 'anyone'. Algo is not suitable for avoiding censorship, and it doesn't target this use-case.

Re: VPN leaks users’ IPs via WebRTC

#70

Post by IronBacon » Wed, Mar 28, 2018, 7:24 PM UTC

I think I've started reading suggestions to disable WebRTC at least a couple of years ago in regards to avoid VPN detection from Netflix, so I thought it was a common knowledge.