4 ms·
When you run "pktstat -n" while watching the video, you can see the IPs of other visitors of the website. I see people from Sweden, the USA, Japan, Brazil... S
by TekMol 10y ago
When you run "pktstat -n" while watching the video, you can see the IPs of other visitors of the website. I see people from Sweden, the USA, Japan, Brazil...
Since among the HN users there are probably a lot of developers, I tried to put some of the IPs into my browser. And indeed, already the second IP I tried sent back a reply from a (misconfigured) server.
I have to say it feels frightening, that the other users can see my IP. And probably other data about me.
Also I would expect it's not legal in most places around the world to give away the IP of a visitor to other visitors. Can't imagine it is legal in Europe.
- whadar 10y agoWhen a user access any website of content providers online, they implicitly agree to the terms of service of that provider. When using Peer5, the terms of service includes a language about public IP temporarily visible to other users.
- TekMol 10y agoThis line of thinking makes me feel uncomfortable. That you can secretly give away data about me and which videos I watch because of some text in your TOS. I also doubt it would hold in court. TOS have a very restricted applicability. You can not use them to restrict people's rights in unexpected ways.
- brilliantcode 10y agoWhy not use VPN if you feel that uncomfortable? That's what it's designed for to hide your real IP.
- oliwarner 10y agoAn IP address is not PII. Linking it to viewed videos is still not PII. Good luck in court.
- detaro 10y agoTrue in the US, not true in the EU. There is a reason Google Analytics has a switch to throw a few bits of an IP away, and it surely isn't because Google hates data. Given that they are selling a CDN, and thus likely want to sell to globally operating customers, that might become relevant relatively quickly.
- dbbk 10y agoI can tell you at the BBC it was 100% considered PII.
- dyu 10y agoIP addresses are not secret anyway.
- TylerE 10y agoMore importantly they are also basically 100% allocated, so it's not like, say, telephone numbers where there are large unused swathes of the numberspace.
- detaro 10y agoWhy is that important?
- TylerE 10y agoBecause it means that knowing an IP address is active doesn't really tell you anything. 99.99% of them are.
- detaro 10y agothe interesting thing about a phone number also isn't if it is active or not, it is who it belongs to/what other activity originates from it. Knowledge about an IPs activity wouldn't be more useful if there were billions of unused IPs. E.g. introduction and rising adoption of IPv6, with massive unused space does not make data about an IPv4 address worth less.
- tyingq 10y agoI agree that it's a bit frightening, but I would put that more on the browser makers than sites in general. The various browsers decided that webrtc (websockets as well) didn't need to follow the "same origin" rules that they set up for XmlHttpRequest. It almost feels like browsers should have some way to delineate "web pages" from "web applications" and provide different ways to present them to end users, different rules, etc.
- TekMol 10y agoI think browsers should simply pop up a dialog "WebRTC Request: This website wants to connect your computer to other computers. Allow?". For now, I have disabled WebRTC in FireFox by setting media.peerconnection.enabled to false in about:config.
- tyingq 10y agoThat seems to work for now, but I'm thinking more of where it's headed. Websockets, WebRTC, WebWorkers, and then other pending proposals all eventually end up being like a "VM" running apps on your local machine. At some point, it's much closer to an "App Store", which arguably has finer grained (and more usable) control presented to the user to manage what applications can (and cannot) do.