4 ms·

I think WebRTC is secure by default and everything is supposed to be encrypted and served over https...Chrome for example doesn't allow unsecure usage of the AP

I think WebRTC is secure by default and everything is supposed to be encrypted and served over https...Chrome for example doesn't allow unsecure usage of the API's. See this for more: http://webrtc-security.github.io http://webrtc-security.github.io

pmontra 10y ago
I'm still blocking it with https://github.com/ChrisAntaki/disable-webrtc-firefox https://github.com/ChrisAntaki/disable-webrtc-firefox because it leaks the local IP addresses of the client over VPNs. Yes, addresses because there can be many of them at the same time, so it's useful for fingerprinting. Check your ones at https://www.privacytools.io/webrtc.html https://www.privacytools.io/webrtc.html I really don't know why the local IP addresses must be known to the server, maybe there are good technical reasons, but it's not OK.
- tokenizerrr 10y ago
  > I really don't know why the local IP addresses must be known to the server, maybe there are good technical reasons, but it's not OK. So they can pair you with other clients sharing a local network with you? This allows the client to talk peer to peer over their LAN which is extremely valuable.
  - pmontra 10y ago
    The public address could be enough for the server to realize there are two browsers from the same LAN. Then it tells the browsers to look for each other. I'm not really sure that it is practical with large LANs (a /16) but it doesn't look impossible. If they design for privacy they could develop an algorithm that works. And if I connect with a VPN I probably don't want to bypass it. I've got customers that accept unconveniences to protect their network with VPNs. Should browsers break it with WebRTC? I didn't think so. It's a vulnerability that I keep blocked.
    - tokenizerrr 10y ago
      > The public address could be enough for the server to realize there are two browsers from the same LAN. Then it tells the browsers to look for each other. > I'm not really sure that it is practical with large LANs (a /16) but it doesn't look impossible. If they design for privacy they could develop an algorithm that works. Not even a little bit practical. Most big lans disallow broadcasts, or limit them in various ways. The only way for peers to find each other is to know each other's private IP address. And private IP addresses contain nothing of value. Now if you're using a VPN which you intend to use to protect your privacy, well... There are countless of other problems with that if you just turn that on, use the same software as always, and think you are now 'anonymous'. > And if I connect with a VPN I probably don't want to bypass it. I've got customers that accept unconveniences to protect their network with VPNs. Should browsers break it with WebRTC? I didn't think so. It's a vulnerability that I keep blocked. It's not a vulnerability. It is a very, very useful feature. You just happen to think that enabling a VPN will magically give you a privacy shield, which is misguided at best.

pmontra 10y ago

I'm still blocking it with https://github.com/ChrisAntaki/disable-webrtc-firefox https://github.com/ChrisAntaki/disable-webrtc-firefox because it leaks the local IP addresses of the client over VPNs. Yes, addresses because there can be many of them at the same time, so it's useful for fingerprinting. Check your ones at https://www.privacytools.io/webrtc.html https://www.privacytools.io/webrtc.html I really don't know why the local IP addresses must be known to the server, maybe there are good technical reasons, but it's not OK.

tokenizerrr 10y ago
> I really don't know why the local IP addresses must be known to the server, maybe there are good technical reasons, but it's not OK. So they can pair you with other clients sharing a local network with you? This allows the client to talk peer to peer over their LAN which is extremely valuable.
- pmontra 10y ago
  The public address could be enough for the server to realize there are two browsers from the same LAN. Then it tells the browsers to look for each other. I'm not really sure that it is practical with large LANs (a /16) but it doesn't look impossible. If they design for privacy they could develop an algorithm that works. And if I connect with a VPN I probably don't want to bypass it. I've got customers that accept unconveniences to protect their network with VPNs. Should browsers break it with WebRTC? I didn't think so. It's a vulnerability that I keep blocked.
  - tokenizerrr 10y ago
    > The public address could be enough for the server to realize there are two browsers from the same LAN. Then it tells the browsers to look for each other. > I'm not really sure that it is practical with large LANs (a /16) but it doesn't look impossible. If they design for privacy they could develop an algorithm that works. Not even a little bit practical. Most big lans disallow broadcasts, or limit them in various ways. The only way for peers to find each other is to know each other's private IP address. And private IP addresses contain nothing of value. Now if you're using a VPN which you intend to use to protect your privacy, well... There are countless of other problems with that if you just turn that on, use the same software as always, and think you are now 'anonymous'. > And if I connect with a VPN I probably don't want to bypass it. I've got customers that accept unconveniences to protect their network with VPNs. Should browsers break it with WebRTC? I didn't think so. It's a vulnerability that I keep blocked. It's not a vulnerability. It is a very, very useful feature. You just happen to think that enabling a VPN will magically give you a privacy shield, which is misguided at best.