> "WebRTC is not designed with the intention of protecting a user from a malicious website which wants to learn this information [IP Address]. Typically, such a

> "WebRTC is not designed with the intention of protecting a user from a malicious website which wants to learn this information [IP Address]. Typically, such a site will learn at least a user's server reflexive address from any HTTP transaction. Hiding the IP address from the server would require some kind of explicit privacy preserving mechanism on the client, and is out of scope of this report." This is very misleading. Anonymous VPN users (China, Australia, etc.) don't care about hiding their VPN IP. They care about hiding their real IP. Unfortunately, the default setup for WebRTC in browsers is to try STUN over _all_ network interfaces, which for default VPN setups on Windows, OSX, and Linux means sending packets outside of the VPN (which leaks your real IP!). Also unfortunately, triggering the STUN doesn't require user consent, so all it takes is to visit a webpage and you've leaked your real IP[1]. This can literally be deadly default behavior. WebRTC needs to either only perform STUN over the default route, or STUN needs to be behind user opt-in consent (just like getUserMedia). https://webrtchacks.com/dear-ny-times/ https://webrtchacks.com/dear-ny-times/