Chromium based browsers leak user local IP via WebRTC foundation attribute
1–10 of 88 posts
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#2What’s the issue there? How is knowing the local IP a security issue?
And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?)
edit: Thanks everyone, I completely forgot about fingerprinting.
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#3What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?) edit: Thanks everyone, I completely forgot about fingerprinting.
It's both security and privacy issue. Whonix wiki explains the latter in more detail https://www.whonix.org/wiki/Data_Collection_Techniques#:~:te...
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#4I seem to recall Fallon (based on Chromium) has a feature which disables that.
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#5What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?) edit: Thanks everyone, I completely forgot about fingerprinting.
Leaking any kind of data is yet another data point for fingerprinting. You only need a few to uniquely identify a user.
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#6What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?) edit: Thanks everyone, I completely forgot about fingerprinting.
> How is knowing the local IP a security issue?
It's a privacy issue. You can use it to fingerprint a user, local IP will give you quite many bits of entropy. https://coveryourtracks.eff.org/>
Honestly I'm not even sure if I'm surprised, but it's 2022 and we've been having this problem basically since the day WebRTC was introduced. At this point, if you care about privacy, you should probably put it in the same bag as third-party cookies and just block it entirely.
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#7What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?) edit: Thanks everyone, I completely forgot about fingerprinting.
> How is knowing the local IP a security issue? It's a privacy issue. You can use it to fingerprint a user, local IP will give you quite many bits of entropy. https://coveryourtracks.eff.org/ > Honestly I'm not even sure if I'm surprised, but it's 2022 and we've been having this problem basically since the day WebRTC was introduced. At this point, if you care about privacy, you should probably put it in the same bag…
Well, the big non-adtech browser is not vulnerable, so there’s that.
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#8What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?) edit: Thanks everyone, I completely forgot about fingerprinting.
It's both security and privacy issue. Whonix wiki explains the latter in more detail https://www.whonix.org/wiki/Data_Collection_Techniques#:~:te...
If you use Chrome-exclusive links, please at least also link to the closest standard section [0] and preferably, mention the Chrome-linked text directly.
That said, they don't say anything about security, I obviously forgot about fingerprinting, but still don’t see security issues?
[0] https://www.whonix.org/wiki/Data_Collection_Techniques#Finge...
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#9What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?) edit: Thanks everyone, I completely forgot about fingerprinting.
Leaking any kind of data is yet another data point for fingerprinting. You only need a few to uniquely identify a user.
I've yet to see a normally configured browser _not_ be uniquely identifiable many times over through fingerprinting.
At some point it feels like trying to drain the ocean with a cup. Maybe we just need to accept that anyone who really wants to fingerprint you _can_ fingerprint you unless you use a specialist browser.
At that point the solution is fairly obvious, make it legally difficult to use unique fingerprinting and move on (ie stuff like gdpr). People will still do it, but they'll have to balance it with not falling foul of the law and wont be able to abuse it too much.
We wont stop real world facial recognition by all trying to make our faces more similar either, we have to accept it's generally possible to do, but discourage the actual doing of it rather than trying to make it impossible.
(note in both cases, actually preventing it when you have a reason to is totally possible and valid, via specialist browser modes and physical masks respectively)
Re: Chromium based browsers leak user local IP via WebRTC foundation attribute
#10I am using Microsoft Edge and the test on the linked page times out without detecting anything. Perhaps it is because I've enabled the "Anonymize local IPs exposed by WebRTC" flag.