7 ms·

How about the security issue with WebRTC where the browser leaks the IP address? It's part of the way WebRTC works so I can't see how that can be fixed. It's bo

How about the security issue with WebRTC where the browser leaks the IP address? It's part of the way WebRTC works so I can't see how that can be fixed. It's both a security issue and a key enabling feature. Update: It looks like Google Chrome (desktop) team has published a plugin that alleviates the problem but can cause performance degradations with apps that use WebRTC. They seem to suggest that a decent fix won't be possible until UDP proxies are in wide use and Chrome adds support for that.

nemothekid 11y ago
I don't have a full understanding of WebRTC, but AFAIK its a browser-to-browser connection library. How would that work without leaking the ip address? The browser at least has to know who to connect to?
- ilostmykeys 11y ago
  1. http://www.techworm.net/2015/07/google-releases-a-chrome-extension-to-fix-the-critical-vpn-security-hole.html http://www.techworm.net/2015/07/google-releases-a-chrome-ext... 2. https://chrome.google.com/webstore/detail/webrtc-network-limiter/npeicpdbkakmehahjeeohfdhnlpdklia?hl=en-US https://chrome.google.com/webstore/detail/webrtc-network-lim...
- richdougherty 11y ago
  I don't really know anything about this topic, but the parent comment leads me to believe that you would use a UDP proxy to hide your address. Instead of sending out your address, you'd send out the proxy's address. When the proxy receives data, it would pass it to you. That way the other party doesn't know your address; they only know the proxy address. This is just a guess based on how I assume proxies would work, so I may be wrong.
  - HappyTypist 11y ago
    Who is going to pay for the proxy's bandwidth? Apple, Google, Mozilla? Good luck. The site owner? Well, the site owner now has your IP!
    - boyaka 11y ago
      People are typically okay with site owners having their IP, because site owners tend to not be malicious. You could only connect with people that you completely trust, but with many applications the users might be complete strangers or merely internet acquaintances. Given the power, there would be malicious users taking advantage of it. This was a big deal with Skype because people weren't aware that adding a contact could reveal their IP to that person, and/or were not aware that revealing their IP could lead to DDOS attacks or other forms of abuse/stalking.
      - k__ 11y ago
        If you want this behavior, you have to use WebSockets. WebRTC is peer-2-peer.
    - richdougherty 11y ago
      Yes, it's a tradeoff.
ChrisAntaki 11y ago
> How about the security issue with WebRTC where the browser leaks the IP address Yes, even if the user is behind a VPN, WebRTC will expose their ISP-given public IP. Luckily Firefox allows WebRTC to be disabled. Recently they added a new setting that alleviates that leak for the majority of VPN users, while allowing WebRTC to still be enabled. Would be awesome if Chrome allowed WebRTC to be disabled as well.
- tehbeard 11y ago
  Forgive my lack of networking knowledge, but why aren't the UDP packets also sent over the VPN?
  - JupiterMoon 11y ago
    If the information in the packets contains your original IP address it doesn't matter how the packet is routed in terms of privacy.
  - giovannibajo1 11y ago
    The browser doesn't know you're behind a VPN or more generically it doesn't know your public IP address.
- slac 11y ago
  Please read https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0HeBeEA/discussion https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0... The new Chrome behavior should alleviate the need to disable. Basically, the behavior that caused the concern has been changed significantly.
  - ChrisAntaki 11y ago
    That's a great change!
slac 11y ago
Chrome team has now made a permanent change in behavior for the browser, and it is being rolled out to users with Chrome 48 as documented here: https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0HeBeEA/discussion https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0... This implements the behavior proposed to the IETF https://tools.ietf.org/html/draft-shieh-rtcweb-ip-handling-00 https://tools.ietf.org/html/draft-shieh-rtcweb-ip-handling-0...
kdeldycke 11y ago
Install uBlock origin plugin, which has a "Prevent WebRTC from leaking local IP address" option: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...
- ilostmykeys 11y ago
  that doesn't work and if it worked it would cripple WebRTC apps

nemothekid 11y ago

I don't have a full understanding of WebRTC, but AFAIK its a browser-to-browser connection library. How would that work without leaking the ip address? The browser at least has to know who to connect to?

ilostmykeys 11y ago
1. http://www.techworm.net/2015/07/google-releases-a-chrome-extension-to-fix-the-critical-vpn-security-hole.html http://www.techworm.net/2015/07/google-releases-a-chrome-ext... 2. https://chrome.google.com/webstore/detail/webrtc-network-limiter/npeicpdbkakmehahjeeohfdhnlpdklia?hl=en-US https://chrome.google.com/webstore/detail/webrtc-network-lim...
richdougherty 11y ago
I don't really know anything about this topic, but the parent comment leads me to believe that you would use a UDP proxy to hide your address. Instead of sending out your address, you'd send out the proxy's address. When the proxy receives data, it would pass it to you. That way the other party doesn't know your address; they only know the proxy address. This is just a guess based on how I assume proxies would work, so I may be wrong.
- HappyTypist 11y ago
  Who is going to pay for the proxy's bandwidth? Apple, Google, Mozilla? Good luck. The site owner? Well, the site owner now has your IP!
  - boyaka 11y ago
    People are typically okay with site owners having their IP, because site owners tend to not be malicious. You could only connect with people that you completely trust, but with many applications the users might be complete strangers or merely internet acquaintances. Given the power, there would be malicious users taking advantage of it. This was a big deal with Skype because people weren't aware that adding a contact could reveal their IP to that person, and/or were not aware that revealing their IP could lead to DDOS attacks or other forms of abuse/stalking.
    - k__ 11y ago
      If you want this behavior, you have to use WebSockets. WebRTC is peer-2-peer.
  - richdougherty 11y ago
    Yes, it's a tradeoff.

ChrisAntaki 11y ago

> How about the security issue with WebRTC where the browser leaks the IP address Yes, even if the user is behind a VPN, WebRTC will expose their ISP-given public IP. Luckily Firefox allows WebRTC to be disabled. Recently they added a new setting that alleviates that leak for the majority of VPN users, while allowing WebRTC to still be enabled. Would be awesome if Chrome allowed WebRTC to be disabled as well.

tehbeard 11y ago
Forgive my lack of networking knowledge, but why aren't the UDP packets also sent over the VPN?
- JupiterMoon 11y ago
  If the information in the packets contains your original IP address it doesn't matter how the packet is routed in terms of privacy.
- giovannibajo1 11y ago
  The browser doesn't know you're behind a VPN or more generically it doesn't know your public IP address.
slac 11y ago
Please read https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0HeBeEA/discussion https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0... The new Chrome behavior should alleviate the need to disable. Basically, the behavior that caused the concern has been changed significantly.
- ChrisAntaki 11y ago
  That's a great change!

slac 11y ago

Chrome team has now made a permanent change in behavior for the browser, and it is being rolled out to users with Chrome 48 as documented here: https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0HeBeEA/discussion https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0... This implements the behavior proposed to the IETF https://tools.ietf.org/html/draft-shieh-rtcweb-ip-handling-00 https://tools.ietf.org/html/draft-shieh-rtcweb-ip-handling-0...

kdeldycke 11y ago

Install uBlock origin plugin, which has a "Prevent WebRTC from leaking local IP address" option: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

ilostmykeys 11y ago
that doesn't work and if it worked it would cripple WebRTC apps