Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium based browsers leak user local IP via WebRTC foundation attribute

niespodd.github.io

Post reply on HN
Print view View original

61–70 of 88 posts

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#61

Post by iosjunkie »

Semaphor wrote: post #34
tyingq wrote: post #28

Earlier quoted context omitted.

Have a look at this that scans your local network: http://samy.pl/webscan/ I think some browser changes might have hobbled it a bit, but it was startling when I first tried it.

A bit? The site claims it found a host on literally every single private IP that exists ;) And closing it nearly killed my FF (full freeze for ~10 seconds).

OTOH, using Mobile Safari, this site leaked my device’s IP as well as a number of connected devices on my internal network.

Anyone know an easy fix for this?

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#62

Post by Sean-Der »

xg15 wrote: post #46

Many comments on this thread are about the pros and cons of leaking the local IP in an ICE candidate entry . You can certainly discuss this, but in my understanding, that's not what this post is about at all. The issue is about leaking the local IP in the foundation which is supposed to be some sort of opaque UUID - the local IP isn't supported to be in there at all, whether you want LAN connections or not. Is this c…

Foundation was designed to be a tie breaker. If multiple candidates are valid with the same type you could use the lower foundation.

Foundation is specified in ICE RFC. Almost two decades before mDNS candidates were discussed! I doubt privacy of IPs was ever a consideration

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#63

Post by Sean-Der »

thesuperbigfrog wrote: post #55

If you are unfamiliar with WebRTC I recommend checking out "WebRTC for the Curious": https://webrtcforthecurious.com/ WebRTC is designed to be secure, so a privacy leak is not good.

Glad you liked it! Anyway we could make it better?

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#64

Post by Sean-Der »

codedokode wrote: post #20
londons_explore wrote: post #18

Earlier quoted context omitted.

It's because if you don't leak the local IP, then webRTC calls will typically fail between people on the same LAN. And, if they don't fail, then they will usually have to go via a TURN server on the internet adding a lot of latency. It's a privacy/functionality tradeoff. But most people consider not being able to videocall or do online gaming with someone in the same building to not be acceptable.

I don't think that there are many people using WebRTC especially within the same LAN, but fingerprinting is used by almost every commercial site. So I can assume that this "feature" was used in 99.99% cases for fingerprinting. This shows how browser developers race to push new features without proper estimation of privacy concerns. Luckily this was somewhat fixed by using randomized Apple mDNS names instead of IPs. B…

I see a lot of WebRTC usage just in the LAN. WebRTC sees a lot of usage outside of conferencing!

* Controlling Robots (formant.io)

* Security Cameras

* File Sharing

* Game Streaming/VNC

I keep a list of interesting open source WebRTC projects at https://github.com/pion/awesome-pion

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#66

Post by jovial_cavalier »

bearjaws wrote: post #49
jovial_cavalier wrote: post #43

It gets "leaked" to a web app that I'm choosing to connect to? Why do I care?

Yeah we don't need privacy, especially to third party extensions loaded by sites, we should just set our user agent to our full name, address and phone number.

Your full name is not the same as your local IP. Since your NAT subnet is almost always /24, there really are only 256 local IP addresses. Which one you happen to be using at the time is not really important. There are 10,000 other things about your browser that could be used to uniquely identify you. This is a feature of WebRTC that allows it to do what it does, not a bug. If you are worried about 3rd party web apps sniffing your local IP and somehow using that info against your interests, don't go on the internet.

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#68

Post by p1mrx »

proszkinasenne2 wrote: post #47
Eisenstein wrote: post #30

This can be disabled in Brave by turning "WebRTC IP handling policy" to "Disable non-Proxied UDP" in "settings - > Privacy and Security".

In Chrome/Chromium there is a WebRTC Network Limiter [1] extension that let you set "Use only my default public IP address" policy and render the method I presented ineffective. [1] https://chrome.google.com/webstore/detail/webrtc-network-lim...

Google abandoned that extension in 2016, which is why the last option (for disable_non_proxied_udp) is greyed out.

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#69

Post by dmm »

scratcheee wrote: post #9
Etheryte wrote: post #5

Earlier quoted context omitted.

Leaking any kind of data is yet another data point for fingerprinting. You only need a few to uniquely identify a user.

I've yet to see a normally configured browser _not_ be uniquely identifiable many times over through fingerprinting. At some point it feels like trying to drain the ocean with a cup. Maybe we just need to accept that anyone who really wants to fingerprint you _can_ fingerprint you unless you use a specialist browser. At that point the solution is fairly obvious, make it legally difficult to use unique fingerprinting…

> We wont stop real world facial recognition by all trying to make our faces more similar either

The normalization of mask wearing in public was a great step towards this. I really wish it had gone better. Alas!

Re: Chromium based browsers leak user local IP via WebRTC foundation attribute

#70

Post by CommitSyn »

iosjunkie wrote: post #61
Semaphor wrote: post #34

Earlier quoted context omitted.

A bit? The site claims it found a host on literally every single private IP that exists ;) And closing it nearly killed my FF (full freeze for ~10 seconds).

OTOH, using Mobile Safari, this site leaked my device’s IP as well as a number of connected devices on my internal network. Anyone know an easy fix for this?

If so, I'd love to hear it. As far as I know all iOS browsers are forced to use the same rendering engine, and I suspect there's no way to modify that.
Post reply on HN