Local IP discovery with HTML5 WebRTC: Security and privacy risk?
1–10 of 16 posts
Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#2This is really scary that it can be used as a very reliable fingerprinting technique.
http://tools.ietf.org/html/draft-ietf-rtcweb-security-05#sec...
It doesn't seem like the issue is addressed in the webrtc draft.
Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#3is it possible to get a hostname(computer name)?
Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#4I'm not getting anything on the page linked to in this article: http://net.ipcalf.com/
On Chrome I get nothing, on Firefox, I get a printed out shell command.
Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#5It might be a good idea to prompt for rights to use that feature, same as with the webcam or fullscreen.
Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#6is it possible to get a hostname(computer name)?
Mo
Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#7NAT-is-a-security-feature is such a zombie meme...
Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#8Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#9This is really scary that it can be used as a very reliable fingerprinting technique. http://tools.ietf.org/html/draft-ietf-rtcweb-security-05#sec... It doesn't seem like the issue is addressed in the webrtc draft.
I am under the assumption that most APs/Routers use 192.168.1.0/24 as the default network? I think it wouldn't be unique enough for use in fingerprinting.
Re: Local IP discovery with HTML5 WebRTC: Security and privacy risk?
#10Well, it's a complicated answer, I think.
Generally, it's not an additional risk over how screwed you generally are. If you're taking precautions against existing attacks, then yeah.
Question is, can it be fixed? The WebRTC SDP's for getting a peer-to-peer connection, so the general case seems to need to share IP addresses..
But that's not really needed, if you're normally behind a NAT, you're going to be behind a NAT this time, and don't need to share your real IPs -- just STUN/ICE data. If you're not behind a NAT, they already have your IP address.